FBI tells router users to reboot now to kill malware infecting 500k devices

Post by jlgaddis » Sat, May 26, 2018, 3:59 PM UTC

TeMPOraL wrote: post #26

jlgaddis wrote: post #22

Earlier quoted context omitted.

Mikrotik devices were reportedly affected as well, although I haven't seen any specific model identified (they all run pretty much the same software, although various models are based on different CPU architectures).

I've read three articles about this today (this one included), and they all specified the same Mikrotik models: - Mikrotik RouterOS for Cloud Core Routers: Versions 1016, 1036, and 1072

Post by SmellyGeekBoy » Sat, May 26, 2018, 3:59 PM UTC

djrogers wrote: post #2

Headline is a bit incorrect - a reboot will interfere with the malware by restarting the it’s C&C process, which the FBI now controls. This does not eliminate the malware, but it will stop it’s data collection and makes it more difficult for an adversary to activate it on a large scale.

Post by jlgaddis » Sat, May 26, 2018, 4:00 PM UTC

zackmorris wrote: post #30

Does anyone know why router manufacturers aren't financially responsible for the exploits that allow their devices to be hacked? At the very least there should be some kind of policy or standard that allows someone on the inside of the network to know if the password or software has been changed. If the FBI can tell from the outside, then how in the world are people still in the dark about this?

Post by ddtaylor » Sat, May 26, 2018, 4:02 PM UTC

Godel_unicode wrote: post #27

djrogers wrote: post #2

Headline is a bit incorrect - a reboot will interfere with the malware by restarting the it’s C&C process, which the FBI now controls. This does not eliminate the malware, but it will stop it’s data collection and makes it more difficult for an adversary to activate it on a large scale.

As I say below, a reboot will force the router to hit the now-sinkholed domain. This will let the ISP identify customers with affected equipment and notify them. The core message here that everyone should reboot their router is simple enough to survive on Twitter and be understood, whereas specific instructions about which devices are bad will likely be screwed up.

Post by jlgaddis » Sat, May 26, 2018, 4:06 PM UTC

ashleyn wrote: post #36

userbinator wrote: post #28

Earlier quoted context omitted.

I wonder how the cost-benefit analysis goes between creating yet more e-waste, and letting some malware persist...

It'd be a lot better of a situation if router boards were designed to accept firmware upgrades at a low level. After an attack, you often need to use the software updater to reset it. That can no longer be trusted if it's compromised. Consumer-level routers have been very low-quality for quite a while.