Slashdot Mirror
FBI Tells Router Users To Reboot Now To Kill Malware Infecting 500,000 Devices (arstechnica.com)
The FBI is advising users of consumer-grade routers and network-attached storage devices to reboot them as soon as possible to counter Russian-engineered malware that has infected hundreds of thousands devices. Ars Technica reports: Researchers from Cisco's Talos security team first disclosed the existence of the malware on Wednesday. The detailed report said the malware infected more than 500,000 devices made by Linksys, Mikrotik, Netgear, QNAP, and TP-Link. Known as VPNFilter, the malware allowed attackers to collect communications, launch attacks on others, and permanently destroy the devices with a single command. The report said the malware was developed by hackers working for an advanced nation, possibly Russia, and advised users of affected router models to perform a factory reset, or at a minimum to reboot. Later in the day, The Daily Beast reported that VPNFilter was indeed developed by a Russian hacking group, one known by a variety of names, including Sofacy, Fancy Bear, APT 28, and Pawn Storm. The Daily Beast also said the FBI had seized an Internet domain VPNFilter used as a backup means to deliver later stages of the malware to devices that were already infected with the initial stage 1. The seizure meant that the primary and secondary means to deliver stages 2 and 3 had been dismantled, leaving only a third fallback, which relied on attackers sending special packets to each infected device.
The redundant mechanisms for delivering the later stages address a fundamental shortcoming in VPNFilter -- stages 2 and 3 can't survive a reboot, meaning they are wiped clean as soon as a device is restarted. Instead, only stage 1 remains. Presumably, once an infected device reboots, stage 1 will cause it to reach out to the recently seized ToKnowAll.com address. The FBI's advice to reboot small office and home office routers and NAS devices capitalizes on this limitation. In a statement published Friday, FBI officials suggested that users of all consumer-grade routers, not just those known to be vulnerable to VPNFilter, protect themselves. The Justice Department and U.S. Department of Homeland Security have also issued statements advising users to reboot their routers as soon as possible.
The redundant mechanisms for delivering the later stages address a fundamental shortcoming in VPNFilter -- stages 2 and 3 can't survive a reboot, meaning they are wiped clean as soon as a device is restarted. Instead, only stage 1 remains. Presumably, once an infected device reboots, stage 1 will cause it to reach out to the recently seized ToKnowAll.com address. The FBI's advice to reboot small office and home office routers and NAS devices capitalizes on this limitation. In a statement published Friday, FBI officials suggested that users of all consumer-grade routers, not just those known to be vulnerable to VPNFilter, protect themselves. The Justice Department and U.S. Department of Homeland Security have also issued statements advising users to reboot their routers as soon as possible.
If only a reboot solved all problems! Can't they also suggest reflashing with something immune to this malware like any of the third party router firmwares? On my bad days, watching over the cyberwarfare, and now that the domain has been seized, I can imagine the FBI P0wning your router, rather than the original authors - because now they have the capability to do so. Reboot and reflash., damn it.
The FBI have taken over the control center, they're going to update the malware to do their bidding by spying on you and attacking other targets. Never reboot your router ever again!
It's great to be capable huh?
Reboot and reflash ...
I tested this statement on several of my followers who have questioned me regarding this matter.
You know what the reaction was.
It little behooves the best of us to comment on the rest of us.
Reboot and reflash ...
I tested this statement on several of my followers who have questioned me regarding this matter.
You know what the reaction was.
Thanks for the warning, but I fail to see what sending my nudes to Facebook again will do to prevent router problems.
Yeah right if the idiots with vulnerable routers could get the needed firmware on the router without doing the same backdoor shit the hackers did it would of been done...
Now, if they actually listed which router/NAS models and firmware versions were problematic. Or how to diagnose if you were impacted...
If you have remote management turned on for your router or NAS, you should always expect special surprises.
Meh, I've rebooted. what's the harm?
Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
it gets rebooted often because of frequent power outages caused by squirrels committing suicide on the power transformer out on the power pole or by the frequent thunderstorms blowing through the area this time of year, so my router has been rebooted about 3 or 4 times just this month
Politics is Treachery, Religion is Brainwashing
First time ever, my phone keeps disconnecting from the Wi-Fi this evening. So I yanked the plug to the router and modem, it went back to normal.
Can't say its related but I never saw these symptoms before.
Wat
The Russians, capable of installing Donald TRUMP, are obviously capable of anything and will go to no end to keep decent people like Hillary from being elected.
I find it *sickening*
Hopefully terminal cancer will soon come to you and prevent you from spewing your bullshit opinions to the rest of the world.
So i see some moron modded up another completely useless comment that had nothing to do with the article and offers nothing in the way of factual evidence.
This is what slashdot has become another middle school. Go post this crap on reddit and help slashdot become like it use to be. My 11 yr daughter shows more maturity.
-Geekpoet
These days a VPN is pretty much required.
Now a rant -- Rebooting a router, are you serious ? Give me a break. So now all requests are routed through a FBI server ? I feel much safer now that I rebooted a stupid router. How about forcing a recall
Posted Anonymously for a reason
Sure thing, Ivan.
Shut dowwn all vectors for intrusion how about we turn off the internet for say 7 day's? level 3 all the major providers just switch off as a protest over all this government intusion, just stop for 7 day's.
can be found here. It's linked too off of the Ars Technica but for some reason not in the /. one.
Only meddling was by FBI spies trying to rig the elction for Hitlary. Adolf was a leftist too you know, not alt-right or neo-con like the fake news keeps claiming.
You know it, Brian.
Because the United States never, ever spies on its own citizens. Only Russia would do such a thing.
Today's captcha is "diapers", maybe that means you should go have yours changed.
The listed devices are KNOWN to be affected.
Others are also affected, but haven't been tested and proven vulnerable. A reboot is probably a good idea for any router - won't hurt anything.
I've been using Draytek gear for years now, its pricey but also pretty decent. Every time I see one of these sky-is-falling router warnings I have to wonder, is the fact that Draytek never feature in them because they're that good, or because no-one bothers checking Drayteks?
User: "Help! My router is infected with vicious malware" Support: "Have you tried turning it off and then on again?"
Isn't "rebooting" something you do after you INSTALL something for things to take effect? And, you have a three letter agency telling everyone to do it. Does anyone else see the issue here or all of us just used to W10's methods of updating to realize routers work differently? Don't get me wrong, we've all probably unplugged our router in the past week or two just out of frustration, especially the IT guy at the office. But why the big warning all at once on a Friday? And, on a weekend if the targets are mostly businesses? "We've got some new spy on the public software we want to try but we need everyone to panic and unplug from the Internet to do it effectively and how convenient most people have a handful of providers to pick from for this to actually work" is what it sounds like.
I'm not exactly up on all this Russia stuff but this article just screams, "Reboot your routers so our rootkit can finish installing". I doubt it has anything to do with Russia at all.
Translation: We have just installed our backdoor into consumer-grade routers and network-attached storage devices, but to apply the changes the devices need to be rebooted. Since we won't have the ability to reboot them ourselves until after the change is fully applied, we need a convincing reason to ask the whole country to reboot their routers. Russian hackers should suffice.
You're an idiot
Now every body panic immediately and do as we tell you!
~ People that think they are better than anyone else for any reason are the cause of all the strife in the world.
Then back on again. Then turn it off, then on, then off, then on. Well known technique used by the windows support people and your isp.
See how americans spread fud:
Russian-engineered malware
hackers working for an advanced nation, possibly Russia
Daily Beast reported that VPNFilter was indeed developed by a Russian
yeah, American press is none but trustworthy
... IT'S A TRAP!!!
-- You are in a maze of little, twisty passages, all different... --
https://www.theregister.co.uk/2018/05/21/draytek_routers_security_vulnerability/
I've been running with a Pepwave, and I think it's immune to the current crop of things. Possibly it is legit secure, or possibly it is just a minor enough thing that no one has written the requisite malware yet. Either way these bulletins are never aimed at me.
As nice as it sounds the compatibility of third party routers is like Linux on mid 90s era laptops, and that's if your router isn't some integrated modem router combo.
Personally I've never owned a device compatible with any 3rd party firmware.
propably the fbi's own botnet, and with changing laws on privacy in europe, they now come claim this while it propably has been their own hacktool for years to check out everyone.
kids always think no one is on to their tactics. lol. The arrogance of thinking they are the smartest even more lol.
Hopefully one day you will learn to recognize irony. Appreciating it may remain beyond you.
I am sure that there are many other solipsists out there.
step 2, just like with Wannacry -- you know the malware that Microsoft, or NSA using their keys, digitally signed a finished patch for several months before the name was even in the news -- start sabotaging and blame Russia or China.
I have OpenWRT. I'm immune.
I own several and I've used dd-wrt, tomato, and merlin with no problems. Usually, in my experience, the hardware problems are there without the 3rd party firmware. They're just obfuscated so you can't figure out which part works and you just reboot the whole thing.
Cheap storage VM.
Iâ(TM)m not a fan of trump. Never have been. By decent?!?! What world do you live in?
I bought this only a month or two ago, updated immediately to latest firmware (which is still the latest)... and when I enabled telnet on my device, I see a lot of suspicious crap. Pretty sure the "latest firmware" that I'm updated to is vulnerable to this, so I'm not sure what good a "factory reset" would do.
I have a writeup of some of the stuff I found here: https://sites.google.com/site/antkowiak/netgear-vpnfilter-r7900
Not 100% sure if what I found is the result of this exploit... but it looks suspicious as hell to me.
I already have to reboot my Linksys router all the time because it's so flaky. Guess Cisco is on the job of protecting me after all!
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
what a complete and utter load of bollocks.
Go fuck yourself, dad!
Router vendors are notoriously lax with secity fixes for consumer routers. How about holding their feet to the fire over this, and make them provide at least 3 years of security fixes?
I already did, dear.
-Geekpoet
Due service glitches multiple times a week - during which we power cycle the whole chain of devices from cable modem, to router, to switch, to wi-fi just to make sure everything connects correctly again - we are following the FBI's recommendation. Cheers for Spectrum!
Starships were meant to fly, Hands up and touch the sky - Nicky Minaj
The FBI wants to see if their newest rootkit can survive a coldboot.
Decent? That cunt should spend the rest of her days in a deep dark hole for her crimes against humanity.