Malware Spreading Through Linksys, Netgear, TP-Link routers and QNAP NAS
Click here to post a comment for Malware Spreading Through Linksys, Netgear, TP-Link routers and QNAP NAS on our message forum
Fox2232
LoL. "...because the hacking software shares code with..."
So they have that code and dare to point finger? I say it is Cisco themselves trying to harm any kind of competition!
If it is not them, then it can be anyone as code is apparently out there in the wild.
WareTernal
Robbo9999
Ok, so this is a bit worrying unless I'm interpreting this article wrongly. The article reads:
"the known devices affected by the malware called VPNFilter are Linksys, MikroTik, NETGEAR and TP-Link networking equipment in the small and home office (SOHO) space, as well at QNAP network-attached storage (NAS) devices"
So this means anyone with a router from those companies are open to be infected with this thing? I own a router from one of these companies and the latest firmware is from 2016, nothing newer released. Is there any way to find out if your router is infected? If this is the case then pretty much everyone at home with a router could be affected given that popular list of manufacturers.
EDIT: In the Reuters article it has the following advice to protect your router:
"Netgear representative Nathan Papadopulos said the company was looking into the matter. He advised customers to make sure their routers are patched with the latest version of its firmware, disable remote management and make sure they have changed default passwords shipped with the device."
Well I've already done those security procedures when I first had my router, so should be ok I guess then.
schmidtbag
I can't help but roll my eyes whenever Russia or China are suspected of such things. Sure, it's a real possibility, but Cisco seemed waaay too willing to point fingers.
Fox2232
schmidtbag
er557
That's one of the reasons my routers are running either gargoyle or dd-wrt, in addition to long term stability. The original firmwares are always buggy or vulnerable
HeavyHemi
https://blog.talosintelligence.com/2018/05/VPNFilter.html
Since you don't know what Cisco has, why are you making your own assumptions? This entire thread is composed of folks positing assumptions based on basically nothing.
Did you miss reading the attached link?
For several months, Talos has been working with public- and private-sector threat intelligence partners and law enforcement in researching an advanced, likely state-sponsored or state-affiliated actor's widespread use of a sophisticated modular malware system we call "VPNFilter." We have not completed our research, but recent events have convinced us that the correct way forward is to now share our findings so that affected parties can take the appropriate action to defend themselves. In particular, the code of this malware overlaps with versions of the BlackEnergy malware β which was responsible for multiple large-scale attacks that targeted devices in Ukraine. While this isn't definitive by any means, we have also observed VPNFilter, a potentially destructive malware, actively infecting Ukrainian hosts at an alarming rate, utilizing a command and control (C2) infrastructure dedicated to that country. Weighing these factors together, we felt it was best to publish our findings so far prior to completing our research. Publishing early means that we don't yet have all the answers β we may not even have all the questions β so this blog represents our findings as of today, and we will update our findings as we continue our investigation.
Both the scale and the capability of this operation are concerning. Working with our partners, we estimate the number of infected devices to be at least 500,000 in at least 54 countries. The known devices affected by VPNFilter are Linksys, MikroTik, NETGEAR and TP-Link networking equipment in the small and home office (SOHO) space, as well at QNAP network-attached storage (NAS) devices. No other vendors, including Cisco, have been observed as infected by VPNFilter, but our research continues. The behavior of this malware on networking equipment is particularly concerning, as components of the VPNFilter malware allows for theft of website credentials and monitoring of Modbus SCADA protocols. Lastly, the malware has a destructive capability that can render an infected device unusable, which can be triggered on individual victim machines or en masse, and has the potential of cutting off internet access for hundreds of thousands of victims worldwide.
The type of devices targeted by this actor are difficult to defend. They are frequently on the perimeter of the network, with no intrusion protection system (IPS) in place, and typically do not have an available host-based protection system such as an anti-virus (AV) package. We are unsure of the particular exploit used in any given case, but most devices targeted, particularly in older versions, have known public exploits or default credentials that make compromise relatively straightforward. All of this has contributed to the quiet growth of this threat since at least 2016.
This post provides the technical findings you would normally see in a Talos blog. In addition, we will detail some thoughts on the tradecraft behind this threat, using our findings and the background of our analysts, to discuss the possible thought process and decisions made by the actor. We will also discuss how to defend against this threat and how to handle a device that may be infected. Finally, we will share the IOCs that we have observed to this point, although we are confident there are more that we have not seen.
fry178
Funny how lots of ppl assume its NOT someone like china or russia or maybe even NK.
This isn't something a 12y old did sitting in his grandparents basement.
Seeing that there is voting season in the USA, and i doubt any US based agency is stupid enough not to hide it better or just to communicate with those companies stating its "them" messing with exploits.
Similar to things like nuclear missiles. Sure its not impossible that a single person could make/own one, but its multiple times more likely that its a bigger/1st world country that has the capability to make em..
Fox2232
DeskStar
Brit90
It's almost always Israel doing this kind of stuff. They do a lot of crap and blame it on the Russians, because everyone knows America hates them "commy bastards" (although I fail to realise why).
vonSternberg
Oh yeah, the big bad scary Russia is at again, infecting people's routers because they're so evil π π π
SSD_PRO
This is the strangest group of comments - kind of surprises me. Here we have everything from Lol, the USA blames everything on other countries to its the darn jews, they do things like this and make people think its russia. Seriously strange buffoonery. Half of these assumptions think some US citizen did it to themselves for distraction. That also assumes these people are skilled enough which means you obviously haven't worked in a US based industry where coding is required. The coders your company wants aren't graduating from Florida State. It seems much more likely given certain signatures that it was the work of a citizen of a mid-level once great company working on behalf of the country to gain what little leverage they still can.
Noisiv
Picolete
It's more than likely one of the CIA cyber weapons/exploits that got stolen
sykozis
SplashDown
fry178
@sykozis
Intelligent response does NOT equal correct information.
And anyone questioning why another country would do this? Because they can, same way the US crippled irans nuclear program by infecting their computer software running the centrifuges.
And anyone not realising how much you can do with access to usage/personal information from +50000 local networks...
sykozis