be quiet! Pure Rock 2 review
Fractal Design Define 7 Compact review
Lian Li Galahad 360 liquid cooler review
Guru3D Rig of the Month - July 2020
Patriot Viper Steel DDR4 3600 MHz (64GB) review
Red Dead Redemption 2: PC graphics benchmark review (revisited)
Kioxia Exceria 960 GB SATA3 SSD review
HP Portable P500 1TB Portable USB3 SSD review
EK-Quantum Magnitude WaterBlock Review
Death Stranding: PC graphics performance benchmark review
Malware Spreading Through Linksys, Netgear, TP-Link routers and QNAP NAS
There is a report going viral at the moment, a new aggressive malware dubbed VPNFilter is spreading rapidly. Cisco is spreading the news that already over half a million devices in at least 54 countries already have been infected.
While the list may not be complete, the known devices affected by the malware called VPNFilter are Linksys, MikroTik, NETGEAR and TP-Link networking equipment in the small and home office (SOHO) space, as well at QNAP network-attached storage (NAS) devices. While we're always a bit careful pointing fingers, I'll just quote Cisco; "Cisco’s Talos cyber intelligence unit has high confidence that the Russian government is behind the campaign, according to Cisco researcher Craig Williams, because the hacking software shares code with malware used in previous cyber attacks that the U.S. government has attributed to Moscow".
VPNFilter allows hackers to access infected computers and devices. Then, according to Cisco, they can be used for espionage or the execution of attacks (DDoS) on other computers and networks. It is not yet clear how the devices precisely become infected however most routers and NAS servers targeted, particularly run older versions of OS software and/or have known public exploits or default credentials that make compromise relatively straightforward.
Routers from Linksys, Mikrotik, Netgear and TP-link and NAS systems from Qnap are most susceptible, Cisco recommends that users restore the devices to the factory settings to remove the malware. We obviously recommend you to install the latest firmware on your Router and internet connected NAS units.
Source: Cisco's Talos and Reuters.
Microsoft Agrees Windows 10 upgrade was pushed too aggressively - 12/24/2016 10:28 AM
In a video interview with Microsoft’s Chief Marketing Officer (CMO), Chris Capossela, he stated that Microsoft has been too aggressive in pushing the Windows 10 upgrade. ...
Act of Aggression Ships - 09/03/2015 08:26 AM
I've been hering good thigns about this game. Eugen Systems now offers Act of Aggression, their new real-time strategy game, which is available on Steam with a 15% launch discount. They also announc...
er557
Senior Member
Posts: 433
Joined: 2002-07-24
Senior Member
Posts: 433
Joined: 2002-07-24
#5549462 Posted on: 05/23/2018 10:00 PM
That's one of the reasons my routers are running either gargoyle or dd-wrt, in addition to long term stability. The original firmwares are always buggy or vulnerable
That's one of the reasons my routers are running either gargoyle or dd-wrt, in addition to long term stability. The original firmwares are always buggy or vulnerable
HeavyHemi
Senior Member
Posts: 6963
Joined: 2008-10-27
Senior Member
Posts: 6963
Joined: 2008-10-27
#5549473 Posted on: 05/23/2018 10:26 PM
Unfortunately, it is human nature to want answers, whether they are provable or not. Saying "we didn't do it" doesn't tell us who did. People are more satisfied with a cop-out answer than the unknown.
Note, I'm not by any means saying this is ok. In fact, I actively disapprove of it - unlike most people, I understand that not everything has an answer, and that's ok. Though I personally find it highly unnecessary for Cisco to point fingers without any real evidence, I also realize that if they didn't, it is they who would take the blame. And frankly - they should. If they did their job right with security, this wouldn't have happened.
Did you miss reading the attached link?
For several months, Talos has been working with public- and private-sector threat intelligence partners and law enforcement in researching an advanced, likely state-sponsored or state-affiliated actor's widespread use of a sophisticated modular malware system we call "VPNFilter." We have not completed our research, but recent events have convinced us that the correct way forward is to now share our findings so that affected parties can take the appropriate action to defend themselves. In particular, the code of this malware overlaps with versions of the BlackEnergy malware — which was responsible for multiple large-scale attacks that targeted devices in Ukraine. While this isn't definitive by any means, we have also observed VPNFilter, a potentially destructive malware, actively infecting Ukrainian hosts at an alarming rate, utilizing a command and control (C2) infrastructure dedicated to that country. Weighing these factors together, we felt it was best to publish our findings so far prior to completing our research. Publishing early means that we don't yet have all the answers — we may not even have all the questions — so this blog represents our findings as of today, and we will update our findings as we continue our investigation.
Both the scale and the capability of this operation are concerning. Working with our partners, we estimate the number of infected devices to be at least 500,000 in at least 54 countries. The known devices affected by VPNFilter are Linksys, MikroTik, NETGEAR and TP-Link networking equipment in the small and home office (SOHO) space, as well at QNAP network-attached storage (NAS) devices. No other vendors, including Cisco, have been observed as infected by VPNFilter, but our research continues. The behavior of this malware on networking equipment is particularly concerning, as components of the VPNFilter malware allows for theft of website credentials and monitoring of Modbus SCADA protocols. Lastly, the malware has a destructive capability that can render an infected device unusable, which can be triggered on individual victim machines or en masse, and has the potential of cutting off internet access for hundreds of thousands of victims worldwide.
The type of devices targeted by this actor are difficult to defend. They are frequently on the perimeter of the network, with no intrusion protection system (IPS) in place, and typically do not have an available host-based protection system such as an anti-virus (AV) package. We are unsure of the particular exploit used in any given case, but most devices targeted, particularly in older versions, have known public exploits or default credentials that make compromise relatively straightforward. All of this has contributed to the quiet growth of this threat since at least 2016.
This post provides the technical findings you would normally see in a Talos blog. In addition, we will detail some thoughts on the tradecraft behind this threat, using our findings and the background of our analysts, to discuss the possible thought process and decisions made by the actor. We will also discuss how to defend against this threat and how to handle a device that may be infected. Finally, we will share the IOCs that we have observed to this point, although we are confident there are more that we have not seen.
https://blog.talosintelligence.com/2018/05/VPNFilter.html
Since you don't know what Cisco has, why are you making your own assumptions? This entire thread is composed of folks positing assumptions based on basically nothing.
Unfortunately, it is human nature to want answers, whether they are provable or not. Saying "we didn't do it" doesn't tell us who did. People are more satisfied with a cop-out answer than the unknown.
Note, I'm not by any means saying this is ok. In fact, I actively disapprove of it - unlike most people, I understand that not everything has an answer, and that's ok. Though I personally find it highly unnecessary for Cisco to point fingers without any real evidence, I also realize that if they didn't, it is they who would take the blame. And frankly - they should. If they did their job right with security, this wouldn't have happened.
Did you miss reading the attached link?
For several months, Talos has been working with public- and private-sector threat intelligence partners and law enforcement in researching an advanced, likely state-sponsored or state-affiliated actor's widespread use of a sophisticated modular malware system we call "VPNFilter." We have not completed our research, but recent events have convinced us that the correct way forward is to now share our findings so that affected parties can take the appropriate action to defend themselves. In particular, the code of this malware overlaps with versions of the BlackEnergy malware — which was responsible for multiple large-scale attacks that targeted devices in Ukraine. While this isn't definitive by any means, we have also observed VPNFilter, a potentially destructive malware, actively infecting Ukrainian hosts at an alarming rate, utilizing a command and control (C2) infrastructure dedicated to that country. Weighing these factors together, we felt it was best to publish our findings so far prior to completing our research. Publishing early means that we don't yet have all the answers — we may not even have all the questions — so this blog represents our findings as of today, and we will update our findings as we continue our investigation.
Both the scale and the capability of this operation are concerning. Working with our partners, we estimate the number of infected devices to be at least 500,000 in at least 54 countries. The known devices affected by VPNFilter are Linksys, MikroTik, NETGEAR and TP-Link networking equipment in the small and home office (SOHO) space, as well at QNAP network-attached storage (NAS) devices. No other vendors, including Cisco, have been observed as infected by VPNFilter, but our research continues. The behavior of this malware on networking equipment is particularly concerning, as components of the VPNFilter malware allows for theft of website credentials and monitoring of Modbus SCADA protocols. Lastly, the malware has a destructive capability that can render an infected device unusable, which can be triggered on individual victim machines or en masse, and has the potential of cutting off internet access for hundreds of thousands of victims worldwide.
The type of devices targeted by this actor are difficult to defend. They are frequently on the perimeter of the network, with no intrusion protection system (IPS) in place, and typically do not have an available host-based protection system such as an anti-virus (AV) package. We are unsure of the particular exploit used in any given case, but most devices targeted, particularly in older versions, have known public exploits or default credentials that make compromise relatively straightforward. All of this has contributed to the quiet growth of this threat since at least 2016.
This post provides the technical findings you would normally see in a Talos blog. In addition, we will detail some thoughts on the tradecraft behind this threat, using our findings and the background of our analysts, to discuss the possible thought process and decisions made by the actor. We will also discuss how to defend against this threat and how to handle a device that may be infected. Finally, we will share the IOCs that we have observed to this point, although we are confident there are more that we have not seen.
https://blog.talosintelligence.com/2018/05/VPNFilter.html
Since you don't know what Cisco has, why are you making your own assumptions? This entire thread is composed of folks positing assumptions based on basically nothing.
fry178
Senior Member
Posts: 1518
Joined: 2012-04-30
Senior Member
Posts: 1518
Joined: 2012-04-30
#5549525 Posted on: 05/24/2018 02:36 AM
Funny how lots of ppl assume its NOT someone like china or russia or maybe even NK.
This isn't something a 12y old did sitting in his grandparents basement.
Seeing that there is voting season in the USA, and i doubt any US based agency is stupid enough not to hide it better or just to communicate with those companies stating its "them" messing with exploits.
Similar to things like nuclear missiles. Sure its not impossible that a single person could make/own one, but its multiple times more likely that its a bigger/1st world country that has the capability to make em..
Funny how lots of ppl assume its NOT someone like china or russia or maybe even NK.
This isn't something a 12y old did sitting in his grandparents basement.
Seeing that there is voting season in the USA, and i doubt any US based agency is stupid enough not to hide it better or just to communicate with those companies stating its "them" messing with exploits.
Similar to things like nuclear missiles. Sure its not impossible that a single person could make/own one, but its multiple times more likely that its a bigger/1st world country that has the capability to make em..
Fox2232
Senior Member
Posts: 10502
Joined: 2012-07-20
Senior Member
Posts: 10502
Joined: 2012-07-20
#5549555 Posted on: 05/24/2018 07:29 AM
Funny how lots of ppl assume its NOT someone like china or russia or maybe even NK.
This isn't something a 12y old did sitting in his grandparents basement.
Seeing that there is voting season in the USA, and i doubt any US based agency is stupid enough not to hide it better or just to communicate with those companies stating its "them" messing with exploits.
Similar to things like nuclear missiles. Sure its not impossible that a single person could make/own one, but its multiple times more likely that its a bigger/1st world country that has the capability to make em..
Then it is clearly USA. It is voting distraction from some scandal in background. Like Trump panting to cancel Twitter account of people who say something he does not like.
Or it is net neutrality kind of attack. Which again USA want to break and does.
Did you like it? There is no proof left or right. But those big players are pointing fingers. Then there is that hangman of USA accusing anyone. In most cases it has been found afterwards that their accusation was false. Even accusations against NK were false. But media do not get to post about: "USA disinformation campaign increasing international tensions."
USA officially puts it there like a fact, and when they retract message, it is done very quietly, so very few people notice. And then you continue living in lie.
Funny how lots of ppl assume its NOT someone like china or russia or maybe even NK.
This isn't something a 12y old did sitting in his grandparents basement.
Seeing that there is voting season in the USA, and i doubt any US based agency is stupid enough not to hide it better or just to communicate with those companies stating its "them" messing with exploits.
Similar to things like nuclear missiles. Sure its not impossible that a single person could make/own one, but its multiple times more likely that its a bigger/1st world country that has the capability to make em..
Then it is clearly USA. It is voting distraction from some scandal in background. Like Trump panting to cancel Twitter account of people who say something he does not like.
Or it is net neutrality kind of attack. Which again USA want to break and does.
Did you like it? There is no proof left or right. But those big players are pointing fingers. Then there is that hangman of USA accusing anyone. In most cases it has been found afterwards that their accusation was false. Even accusations against NK were false. But media do not get to post about: "USA disinformation campaign increasing international tensions."
USA officially puts it there like a fact, and when they retract message, it is done very quietly, so very few people notice. And then you continue living in lie.
Click here to post a comment for this news story on the message forum.
Senior Member
Posts: 5127
Joined: 2012-11-10
Issue I have with that is simple. You do not see USA government publicly stating: "Sorry world, our home grown hackers we have nothing in common with did this to you all."
But they are always quick to blame some other government/country.
Unfortunately, it is human nature to want answers, whether they are provable or not. Saying "we didn't do it" doesn't tell us who did. People are more satisfied with a cop-out answer than the unknown.
Note, I'm not by any means saying this is ok. In fact, I actively disapprove of it - unlike most people, I understand that not everything has an answer, and that's ok. Though I personally find it highly unnecessary for Cisco to point fingers without any real evidence, I also realize that if they didn't, it is they who would take the blame. And frankly - they should. If they did their job right with security, this wouldn't have happened.