Just calling out the good guys at Microtik. They patched their router a year before being notified by Cisco.
Is this posted somewhere? I read the CERT release, TFA, and the MT forums and can't see any reference to a known fixed version. Thanks.
FBI tells router users to reboot now to kill malware infecting 500k devices
171–180 of 299 posts
Re: FBI tells router users to reboot now to kill malware infecting 500k devices
#172What's a good affordable router well supported by Tomato/OpenWRT, these days? (put differently: 2018's version of the Linksys WRT54G :) From what I understand, alternative firmwares like Tomato & OpenWRT are not inherently safe from VPNFilter, but it seems to me the rate at which they are maintained make them less easy targets (?). So this new flaw made me think now is a good time to replace my crappy router and its…
IMO both are obsolete especially if your connection is >50Mbps. If you must DIY use pfsense on a x86 machine with Intel NIC and low idle power draw. Otherwise use Ubiquti Edgerouter or Microtik.
Ubiquiti is overpriced and Mikrotik is underpowered. There are good consumer routers that have 802.11ac for the price of a wired-only Ubiquiti router. If you're comfortable installing OpenWRT, it still offers more capabilities for a lower price than those "prosumer" brands that pretend to be real enterprise-grade stuff.
Re: FBI tells router users to reboot now to kill malware infecting 500k devices
#173Just calling out the good guys at Microtik. They patched their router a year before being notified by Cisco.
As a Mikrotik devote, I love the active development and patches being pushed for their Packages and RouterBoard. If anyone maintains a Mikrotik router and/or switches and hasn't heard about the vulnerability and actively patched their systems, then they're completely at fault and putting themselves and possibly they're companies at risk.
It's also extremely easy to update RouterOS these days : a couple of clicks in winbox and reboot, for example.
Re: FBI tells router users to reboot now to kill malware infecting 500k devices
#174Earlier quoted context omitted.
Carmakers will not be liable if I break your brakes. Why should your router manufacturer be liable if I break your router? Clearly in both cases the company failed to manufacture a secure enough product.
One difference: you can repair your brakes, or replace them, without having to get a new car. Most routers do not have updates available after the first one or two patches, and you can't even install your own OS on most. Your only options are: live with it, or buy a complete new router.
You can repair your car, you can reset your router.
Neither will prevent a malicious party from breaking them.
Re: FBI tells router users to reboot now to kill malware infecting 500k devices
#175Earlier quoted context omitted.
All connected devices should be similar. IoT included.
Absolutely. How many smartphones, Smart TVs, old routers, etc, are out there running insecure software? A shit ton. This is insane.
There is a _huge_ business opportunity for the entrepreneurial mind. Auto update of firmware with proper monitoring and health checks as the roll out continues.
Re: FBI tells router users to reboot now to kill malware infecting 500k devices
#176Earlier quoted context omitted.
Just search for WRT54GL on Amazon. It's selling for $34.99, which is pretty affordable. N.B. the WRT54G doesn't work with Tomato.
At least get a WRT841N, they are like 15$+sales tax, unless you get the wrong vendor. Less if you find refurb's or buy bulk. They are the main workhorse for our local mesh network, with WRT1043 devices handling encrypted uplinks due to the lack of speed with chacha/poly running on the former (think under 10Mbit/s). Don't worry, they do handle advanced mesh routing algorithms at line rate, e.g. 2x2 mimo 802.11n and 10…
Thanks, I've only got 1.5Mb DSL, but that's a better price point and I appreciate your useful comments on mesh.
Re: FBI tells router users to reboot now to kill malware infecting 500k devices
#177Earlier quoted context omitted.
If the exploit wasn't put there intentionally, then we're talking about a bug in the software. Do you really want liability for software bugs? The consequences of that would be substantial. Imagine if Apache or PHP were liable for their bugs used on websites across the internet. The projects would shutdown immediately.. no one could fund the potential liability.
There shouldn't be liability for bugs; there should be liability for negligence. If you ship network-aware code you are negligent if you don't take reasonable steps to prevent bugs and have a reasonable process to patch bugs.
> There shouldn't be liability for bugs; there should be liability for negligence.
All bugs can be argued as being the result of negligence.
Re: FBI tells router users to reboot now to kill malware infecting 500k devices
#178How can I verify some malicious code is actually present on my router? What does this code do? Could the FBI put their own malicious code on the router, via this supposed exploit? Why should I trust the FBI?
Excuse my ignorance but I'm not not going to ask these types of questions.
EDIT: After reading a bit - it seems the control is somehow "transferred" to the FBI rather than the malicious actor - any other external agent controlling my software and hardware should be considered a malicious actor from a defensive standpoint, right?
Also, I don't buy the "FBI is better" argument, because I'm a skeptic.
EDIT 2: Moved the 'Why should I trust the FBI?' question to the end of my opening paragraph because I just want to know more about how a layman should approach verification of this vulnerability other than just "trust the powers that be"
Re: FBI tells router users to reboot now to kill malware infecting 500k devices
#179Earlier quoted context omitted.
I have a very hard time believing you’ve developed software that has been released. I’ve always done my very best to release robust and stable software, and I’ve still shipped bugs. Should I be sued out of existence? We don’t need hardware and software costs spirally out of control like healthcare because of the liability. If device makers would just support their products (bug fixes) for 10(?) years I think that wou…
It seems to me this is one of those situations where the programmer mindset does not properly interface with the lawyer mindset. In programming, you have true and false, and generally things fall into one or the other category with no human input. In law, you have concepts like "reasonable", and a whole lot of human input, by design. So my expectation would be that if software vendors were to be held responsible for…
On the contrary, it's the legal perspective that's most worrying. If every software bug carries the potential for liability, there's no way your legal department will let you have a widely-visible bug tracker, or easily report bugs at all. It'd be much like copyright violations are treated today, where there's a formal process to raise the issue and everyone's specifically trained not to discuss them openly.
Re: FBI tells router users to reboot now to kill malware infecting 500k devices
#180Earlier quoted context omitted.
What about a factory reset? (by pressing on the pinhole button for a few secs)
A factory reset, according to Cisco, will fix it. Correction: according to the original report a reset will mitigate the stage 2 and 3 attack only Source: https://blog.talosintelligence.com/2018/05/VPNFilter.html?m=...
It's really too bad that nobody makes hardware with the obvious solution - put the firmware in ROM. Then it cannot be altered by malware.
If the vendor really, really wants to update the firmware, have the write-enable switch be a physical one, not a software switch.