Slashdot Mirror
Cyber-Espionage Groups Are Increasingly Leveraging Routers in Their Attacks (bleepingcomputer.com)
Catalin Cimpanu, reporting for BleepingComputer: Cyber-espionage groups -- also referred to as advanced persistent threats (APTs) -- are using hacked routers more and more during their attacks, according to researchers at Kaspersky Lab. "It's not necessarily something new. Not something that just exploded," said Costin Raiu, director of Global Research and Analysis Team (GReAT) at Kaspersky Lab, in a webinar today. "We've seen a bunch of router attack throughout the years. A very good example is SYNful Knock, a malicious implant for Cisco [routers] that was discovered by FireEye but also threat actors such as Regin and CloudAtlas. Both APTs have been known to have and own proprietary router implants." But the number of APTs leveraging routers for attacks has gone steadily up in the past year, and the tactic has become quite widespread in 2018. For example, the Slingshot APT (believed to be a US Army JSOC operation targeting ISIS militants) has used hacked MikroTik routers to infect victims with malware.
Not all that surprising considering the global situation.
Cyber-Espionage Groups Are Increasingly Leveraging Routers in Their Attacks
I'll panic when they get around to the bigger stuff, like band-saws and drill-presses.
It must have been something you assimilated. . . .
I'm absolutely not surprised by this. Routers are computers too, with storage (albeit limited), RAM, CPU, and other I/O. If someone pwns a router, there is a lot they can do with it, be it having a staging ground for attacks to dropping packets at random to cause consternation on the target's network, to even MITM-ing internal HTTP web traffic and adding malware payloads.
How to fix? Just as with anything security related, there is no magic bullet. Router makers are going to have to go back to the drawing board when it comes to security to keep their good names, ensuring unauthorized modifications of the router OS are protected against. Companies should start looking at policies like having critical internal machines have OS firewalls in addition to network firewalling and segmenting.
Researchers are increasingly getting better at finding router exploits.
More press releases by "computer security" imperial textile rackets as relayed by "bleepingcomputer". This is not news for nerds, and it really doesn't matter at all. But it's about all msmash is capable of, that mastermind "hacker".
via their support of Trump. Why would we trust them on this issue when they made Trump our ruler? And, why are their programmers not in prison for destroying our election?
lots of routers have special debugging pins for that purpose (often JTAG, sometime serial port)
okay, almost never are these pins available from the outside, and very frequently you'll have to solder your own header on the board.
but for the kind of people that frequent /. it is not impossible to directly flash a known firmware to the router bypassing whatever is there.
sometime it would be possible to boot the router into an alternative mode (from the boot loader in rom, not from the currently flashed firmware) that enables force firmware update.
(see the appropriate section about "un-bricking" routers from your favourite community firmware replacement web site: openwrt, etc.)
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
also, while i'm on the subject of forcing a firmware update, are socketed eeprom still a thing on expensive hardware ?
no matter what malicious firmware is deployed, it won't be able to resist a hardware eeprom programmer.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Cyber Espionage Groups might present an Advanced Persistent Threat if they are actively targeting one site/company/person. They may also just be throwing out a wide net and trying to profit from anyone they can gain any sort of access to. They aren't the same thing. Groups like Anonymous may present an Advanced Persistent Threat to a site they don't like, without themselves being a Cyber Espionage Group. Just a bunch of people independtly agreeing on a target in other words. Why do they even try to conflate the two terms???
You'll panic when they commandeer your IoT sex-toy.
Put some sort of induction hardware both sides of the router network and see if the router is communicating in strange ways?
Have the desktop OS and AV able to scan the router from the network?
Domestic spying is now "Benign Information Gathering"
And this is why DPI-SSL on firewalls is bad...