Slashdot Mirror
VPNFilter Can Also Infect ASUS, D-Link, Huawei, Ubiquiti, UPVEL, and ZTE Devices (bleepingcomputer.com)
Catalin Cimpanu, writing for BleepingComputer: The VPNFilter malware that infected over 500,000 routers and NAS devices across 54 countries during the past few months is much worse than previously thought. According to new research technical details published today by the Cisco Talos security team, the malware -- which was initially thought to be able to infect devices from Linksys, MikroTik, Netgear, TP-Link, and QNAP -- can also infect routers made by ASUS, D-Link, Huawei, Ubiquiti, UPVEL, and ZTE. The list of devices vulnerable to VPNFilter has seen a sharp jump from Cisco's original report, going from 16 device models to 71 -- and possibly more.
I read because QNAP and the other mentioned models used BusyBox for their userland, and likely a vulnerable version. Synology uses discrete Linux binaries for its userland, so it wasn't vulnerable because of this.
I would say that Busybox is a good product, but there have been some CVEs last year which required updates.
Synology is a Taiwanese company, so I fear it less than a company on the mainland.
From a different article
Since the research is still ongoing, Talos researchers "do not have definitive proof on how the threat actor is exploiting the affected devices," but they strongly believe that VPNFilter does not exploit any zero-day vulnerability to infect its victims.
Instead, the malware targets devices still exposed to well-known, public vulnerabilities or have default credentials, making compromise relatively straightforward.
I don't see it on the list, and I'm pretty sure that they write their own Firmware. Never heard of an exploit of an Apple Router. Ever.
Apple, PLEASE come back to the Router Business!!!!
And, while you're at it, please add AirPlay 2 support to the AirPort Express 2 Router/DAC!!!