New Malware Spreading Through Linksys, Netgear, TP-Link routers and QNAP NAS

Discussion in 'Frontpage news' started by Hilbert Hagedoorn, May 23, 2018.

  1. Hilbert Hagedoorn

    Hilbert Hagedoorn Don Vito Corleone Staff Member

    Messages:
    32,391
    Likes Received:
    1,581
    GPU:
    AMD | NVIDIA
  2. Fox2232

    Fox2232 Ancient Guru

    Messages:
    6,564
    Likes Received:
    425
    GPU:
    Fury X +AW@240Hz
    LoL. "...because the hacking software shares code with..."
    So they have that code and dare to point finger? I say it is Cisco themselves trying to harm any kind of competition!
    If it is not them, then it can be anyone as code is apparently out there in the wild.
     
  3. WareTernal

    WareTernal Member Guru

    Messages:
    177
    Likes Received:
    17
    GPU:
    XFX R9 380X XXX
    Yeah, maybe it is Russia, but you've have to do better than this. Saying "it kinda looks like something the U.S. government has blamed on Moscow before" carries ZERO weight. Blaming Russia is SOP...
     
  4. Robbo9999

    Robbo9999 Master Guru

    Messages:
    867
    Likes Received:
    63
    GPU:
    GTX1070 @2050Mhz
    Ok, so this is a bit worrying unless I'm interpreting this article wrongly. The article reads:

    "the known devices affected by the malware called VPNFilter are Linksys, MikroTik, NETGEAR and TP-Link networking equipment in the small and home office (SOHO) space, as well at QNAP network-attached storage (NAS) devices"

    So this means anyone with a router from those companies are open to be infected with this thing? I own a router from one of these companies and the latest firmware is from 2016, nothing newer released. Is there any way to find out if your router is infected? If this is the case then pretty much everyone at home with a router could be affected given that popular list of manufacturers.

    EDIT: In the Reuters article it has the following advice to protect your router:
    "Netgear representative Nathan Papadopulos said the company was looking into the matter. He advised customers to make sure their routers are patched with the latest version of its firmware, disable remote management and make sure they have changed default passwords shipped with the device."

    Well I've already done those security procedures when I first had my router, so should be ok I guess then.
     
    Last edited: May 23, 2018

  5. schmidtbag

    schmidtbag Ancient Guru

    Messages:
    2,860
    Likes Received:
    311
    GPU:
    HIS R9 290
    I can't help but roll my eyes whenever Russia or China are suspected of such things. Sure, it's a real possibility, but Cisco seemed waaay too willing to point fingers.
     
  6. Fox2232

    Fox2232 Ancient Guru

    Messages:
    6,564
    Likes Received:
    425
    GPU:
    Fury X +AW@240Hz
    Issue I have with that is simple. You do not see USA government publicly stating: "Sorry world, our home grown hackers we have nothing in common with did this to you all."
    But they are always quick to blame some other government/country.
     
  7. schmidtbag

    schmidtbag Ancient Guru

    Messages:
    2,860
    Likes Received:
    311
    GPU:
    HIS R9 290
    Unfortunately, it is human nature to want answers, whether they are provable or not. Saying "we didn't do it" doesn't tell us who did. People are more satisfied with a cop-out answer than the unknown.

    Note, I'm not by any means saying this is ok. In fact, I actively disapprove of it - unlike most people, I understand that not everything has an answer, and that's ok. Though I personally find it highly unnecessary for Cisco to point fingers without any real evidence, I also realize that if they didn't, it is they who would take the blame. And frankly - they should. If they did their job right with security, this wouldn't have happened.
     
  8. er557

    er557 Master Guru

    Messages:
    334
    Likes Received:
    0
    GPU:
    2x 1080 sc acx 3.0 sli
    That's one of the reasons my routers are running either gargoyle or dd-wrt, in addition to long term stability. The original firmwares are always buggy or vulnerable
     
  9. HeavyHemi

    HeavyHemi Ancient Guru

    Messages:
    5,480
    Likes Received:
    142
    GPU:
    GTX1080Ti

    Did you miss reading the attached link?

    For several months, Talos has been working with public- and private-sector threat intelligence partners and law enforcement in researching an advanced, likely state-sponsored or state-affiliated actor's widespread use of a sophisticated modular malware system we call "VPNFilter." We have not completed our research, but recent events have convinced us that the correct way forward is to now share our findings so that affected parties can take the appropriate action to defend themselves. In particular, the code of this malware overlaps with versions of the BlackEnergy malware — which was responsible for multiple large-scale attacks that targeted devices in Ukraine. While this isn't definitive by any means, we have also observed VPNFilter, a potentially destructive malware, actively infecting Ukrainian hosts at an alarming rate, utilizing a command and control (C2) infrastructure dedicated to that country. Weighing these factors together, we felt it was best to publish our findings so far prior to completing our research. Publishing early means that we don't yet have all the answers — we may not even have all the questions — so this blog represents our findings as of today, and we will update our findings as we continue our investigation.

    Both the scale and the capability of this operation are concerning. Working with our partners, we estimate the number of infected devices to be at least 500,000 in at least 54 countries. The known devices affected by VPNFilter are Linksys, MikroTik, NETGEAR and TP-Link networking equipment in the small and home office (SOHO) space, as well at QNAP network-attached storage (NAS) devices. No other vendors, including Cisco, have been observed as infected by VPNFilter, but our research continues. The behavior of this malware on networking equipment is particularly concerning, as components of the VPNFilter malware allows for theft of website credentials and monitoring of Modbus SCADA protocols. Lastly, the malware has a destructive capability that can render an infected device unusable, which can be triggered on individual victim machines or en masse, and has the potential of cutting off internet access for hundreds of thousands of victims worldwide.

    The type of devices targeted by this actor are difficult to defend. They are frequently on the perimeter of the network, with no intrusion protection system (IPS) in place, and typically do not have an available host-based protection system such as an anti-virus (AV) package. We are unsure of the particular exploit used in any given case, but most devices targeted, particularly in older versions, have known public exploits or default credentials that make compromise relatively straightforward. All of this has contributed to the quiet growth of this threat since at least 2016.

    This post provides the technical findings you would normally see in a Talos blog. In addition, we will detail some thoughts on the tradecraft behind this threat, using our findings and the background of our analysts, to discuss the possible thought process and decisions made by the actor. We will also discuss how to defend against this threat and how to handle a device that may be infected. Finally, we will share the IOCs that we have observed to this point, although we are confident there are more that we have not seen.


    https://blog.talosintelligence.com/2018/05/VPNFilter.html


    Since you don't know what Cisco has, why are you making your own assumptions? This entire thread is composed of folks positing assumptions based on basically nothing.
     
  10. fry178

    fry178 Master Guru

    Messages:
    753
    Likes Received:
    28
    GPU:
    MSI 1080 X@2GHz
    Funny how lots of ppl assume its NOT someone like china or russia or maybe even NK.
    This isn't something a 12y old did sitting in his grandparents basement.

    Seeing that there is voting season in the USA, and i doubt any US based agency is stupid enough not to hide it better or just to communicate with those companies stating its "them" messing with exploits.

    Similar to things like nuclear missiles. Sure its not impossible that a single person could make/own one, but its multiple times more likely that its a bigger/1st world country that has the capability to make em..
     

  11. Fox2232

    Fox2232 Ancient Guru

    Messages:
    6,564
    Likes Received:
    425
    GPU:
    Fury X +AW@240Hz
    Then it is clearly USA. It is voting distraction from some scandal in background. Like Trump panting to cancel Twitter account of people who say something he does not like.
    Or it is net neutrality kind of attack. Which again USA want to break and does.

    Did you like it? There is no proof left or right. But those big players are pointing fingers. Then there is that hangman of USA accusing anyone. In most cases it has been found afterwards that their accusation was false. Even accusations against NK were false. But media do not get to post about: "USA disinformation campaign increasing international tensions."

    USA officially puts it there like a fact, and when they retract message, it is done very quietly, so very few people notice. And then you continue living in lie.
     
  12. DeskStar

    DeskStar Master Guru

    Messages:
    334
    Likes Received:
    8
    GPU:
    4 eVGA GTX TITAN SC
    That's why I like Netgear because they're usually the first to slap on a firmware update. Especially when compared to that of linksys. I know they were first the last time some squabble came about in the interweb... But this is obviously a bit more severe it would seem.... Damn this hardware level infection shtuff....

    Anyone who uses the default anything on their hardware deserves a good'ol "backdooring" if you ask me...
     
    Robbo9999 likes this.
  13. Brit90

    Brit90 Active Member

    Messages:
    51
    Likes Received:
    7
    GPU:
    R390X 8GB
    It's almost always Israel doing this kind of stuff. They do a lot of crap and blame it on the Russians, because everyone knows America hates them "commy bastards" (although I fail to realise why).
     
    vonSternberg likes this.
  14. vonSternberg

    vonSternberg Member Guru

    Messages:
    141
    Likes Received:
    47
    GPU:
    ECS GT430
    Oh yeah, the big bad scary Russia is at again, infecting people's routers because they're so evil :D :D :D
     
  15. SSD_PRO

    SSD_PRO Member Guru

    Messages:
    141
    Likes Received:
    12
    GPU:
    EVGA GTX 1070
    This is the strangest group of comments - kind of surprises me. Here we have everything from Lol, the USA blames everything on other countries to its the darn jews, they do things like this and make people think its russia. Seriously strange buffoonery. Half of these assumptions think some US citizen did it to themselves for distraction. That also assumes these people are skilled enough which means you obviously haven't worked in a US based industry where coding is required. The coders your company wants aren't graduating from Florida State. It seems much more likely given certain signatures that it was the work of a citizen of a mid-level once great company working on behalf of the country to gain what little leverage they still can.
     

  16. Noisiv

    Noisiv Ancient Guru

    Messages:
    6,162
    Likes Received:
    160
    GPU:
    R9 290 AC 1150/1500
    Didn't you read the news? This apparently highly professional company, one of the world leaders in networking, has literally said:

    "It's the Russians, because the last time it happened our govt had said it was the Russians."

     
  17. Picolete

    Picolete Member Guru

    Messages:
    181
    Likes Received:
    21
    GPU:
    R9 290 Sapphire Tri-x
    It's more than likely one of the CIA cyber weapons/exploits that got stolen
     
  18. sykozis

    sykozis Ancient Guru

    Messages:
    20,450
    Likes Received:
    250
    GPU:
    XFX RX 470
  19. SplashDown

    SplashDown Master Guru

    Messages:
    441
    Likes Received:
    11
    GPU:
    EVGA 980ti Classy
    Ya I like my Netgear, it had a couple of updates there right in a row a month or so ago, But ya no problems here.
     
  20. fry178

    fry178 Master Guru

    Messages:
    753
    Likes Received:
    28
    GPU:
    MSI 1080 X@2GHz
    @sykozis
    Intelligent response does NOT equal correct information.

    And anyone questioning why another country would do this? Because they can, same way the US crippled irans nuclear program by infecting their computer software running the centrifuges.
    And anyone not realising how much you can do with access to usage/personal information from +50000 local networks...
     

Share This Page