Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FBI tells router users to reboot now to kill malware infecting 500k devices

arstechnica.com

Post reply on HN
Print view View original

181–190 of 299 posts

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#181

Post by archgoon »

kfrzcode wrote: post #178

How can I verify some malicious code is actually present on my router? What does this code do? Could the FBI put their own malicious code on the router, via this supposed exploit? Why should I trust the FBI? Excuse my ignorance but I'm not not going to ask these types of questions. EDIT: After reading a bit - it seems the control is somehow "transferred" to the FBI rather than the malicious actor - any other external…

Why do you need to trust the FBI? This is a notification of a potential compromise of your security, you can ignore them if you want.

"The FBI is advising users of consumer-grade routers and network-attached storage devices to reboot them as soon as possible"

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#182

Post by badlucklottery »

kfrzcode wrote: post #178

How can I verify some malicious code is actually present on my router? What does this code do? Could the FBI put their own malicious code on the router, via this supposed exploit? Why should I trust the FBI? Excuse my ignorance but I'm not not going to ask these types of questions. EDIT: After reading a bit - it seems the control is somehow "transferred" to the FBI rather than the malicious actor - any other external…

>Why should I trust the FBI?

Because this is their job. And you'll probably need to reboot your router anyway in the near future so why now do it now just in case?

>Could the FBI put their own malicious code on the router, via this supposed exploit?

Sure. So could space aliens.

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#184

Post by ggm »

kfrzcode wrote: post #178

How can I verify some malicious code is actually present on my router? What does this code do? Could the FBI put their own malicious code on the router, via this supposed exploit? Why should I trust the FBI? Excuse my ignorance but I'm not not going to ask these types of questions. EDIT: After reading a bit - it seems the control is somehow "transferred" to the FBI rather than the malicious actor - any other external…

Explain how the FBI would leverage an advantage by telling you to reboot. Explain in a way, which doesn't depend on an unprovable.

The best I can come up with is a false sense of security, which given they actually expect you to also patch and upgrade and proffer advice to patch and upgrade, is a bit weak. Basically, I cannot construct a scenario where there is a significant, could-not-be-found-by-white-hat reason they'd do this, to secure some advantage.

I.E. Occams razor works for you, in this case.

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#185

Post by kfrzcode »

archgoon wrote: post #181
kfrzcode wrote: post #178

How can I verify some malicious code is actually present on my router? What does this code do? Could the FBI put their own malicious code on the router, via this supposed exploit? Why should I trust the FBI? Excuse my ignorance but I'm not not going to ask these types of questions. EDIT: After reading a bit - it seems the control is somehow "transferred" to the FBI rather than the malicious actor - any other external…

Why do you need to trust the FBI? This is a notification of a potential compromise of your security, you can ignore them if you want. "The FBI is advising users of consumer-grade routers and network-attached storage devices to reboot them as soon as possible"

I'm honestly far from a network expert or even engineer - but it seems if there's a vuln that the bad-actor had control over, then the ping-home domain of that vuln is controlled by the FBI, then the FBI is telling me to reboot my router, there is a non-negligible possibility that the FBI has an interest in using that vuln in their favor.

Granted I don't know many specifics here but that's why I'm employing the elenctic method.

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#186

Post by all_blue_chucks »

WalterBright wrote: post #177
all_blue_chucks wrote: post #170

Earlier quoted context omitted.

There shouldn't be liability for bugs; there should be liability for negligence. If you ship network-aware code you are negligent if you don't take reasonable steps to prevent bugs and have a reasonable process to patch bugs.

> There shouldn't be liability for bugs; there should be liability for negligence. All bugs can be argued as being the result of negligence.

Mistakes are inevitable. Deciding to ship without any upgrade capability is a choice. A deliberate, negligent choice.

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#187

Post by el-y0y0s »

dboreham wrote: post #171
el-y0y0s wrote: post #165

Just calling out the good guys at Microtik. They patched their router a year before being notified by Cisco.

Is this posted somewhere? I read the CERT release, TFA, and the MT forums and can't see any reference to a known fixed version. Thanks.

I can't say definitively, but I couldn't find a public posting on this by MicroTik at the time Cisco made their information public on Cisco's Talos bolg. So I contacted MT support through email and was told that they were notified of the vulnerability May 18, 2018 but had already patched it March of 2017. I looked at the changelog on MTs RouterOS and several vulnerabilities were patched back at the time.

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#188

Post by bsamuels »

vntok wrote: post #60
mikec3010 wrote: post #54

Earlier quoted context omitted.

Not true. Product liability lawsuits have been around for ages. It's just that the tech industry has been able to escape them, by and large. I think one of the greater injustices in business was Microsoft's avoidance of a lawsuit from their spate of windows malware from roughly 2003-2010. They just sat on their hands and let for-profit A/V companies and nonprofit volunteers secure their platform, while consumers lost…

> after being rooted by 4 lines of JavaScript Could you provide any sort of source for this extraordinary claim of yours?

I won't provide a source but i'll provide a modified real life example, since i'm pretty sure this vuln is still in the wild.

I was doing a pen test on a router whose manufacturer decided it would be an OK idea to use GET requests to launch their ping diagnostic tool on their router's unauthenticated QA web interface.

this ping diagnostic tool was triggered by doing GET http://192.168.1.1/diagnostic/trace&ip=X.X.X.X

The IP address in the URL parameter would get plugged directly into a "ping" command line command, so you could obtain command injection by going GET http://192.168.1.1/diagnostic/trace&ip=X.X.X.X&&telnetd

You could exploit this from literally any website on the internet, and since it's a GET request and we don't care about what it returns, CORS won't save your router. I think that counts as a javascript one-liner, but you get the idea how fucking awful some of these routers are.

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#189

Post by jlgaddis »

dboreham wrote: post #173
tarellel wrote: post #167

Earlier quoted context omitted.

As a Mikrotik devote, I love the active development and patches being pushed for their Packages and RouterBoard. If anyone maintains a Mikrotik router and/or switches and hasn't heard about the vulnerability and actively patched their systems, then they're completely at fault and putting themselves and possibly they're companies at risk.

It's also extremely easy to update RouterOS these days : a couple of clicks in winbox and reboot, for example.

Just make sure that you don't end up downloading a few DLLs you weren't expecting.

https://securelist.com/apt-slingshot/84312/

Re: FBI tells router users to reboot now to kill malware infecting 500k devices

#190

Post by jokoon »

rgbrenner wrote: post #80
zackmorris wrote: post #30

Does anyone know why router manufacturers aren't financially responsible for the exploits that allow their devices to be hacked? At the very least there should be some kind of policy or standard that allows someone on the inside of the network to know if the password or software has been changed. If the FBI can tell from the outside, then how in the world are people still in the dark about this?

If the exploit wasn't put there intentionally, then we're talking about a bug in the software. Do you really want liability for software bugs? The consequences of that would be substantial. Imagine if Apache or PHP were liable for their bugs used on websites across the internet. The projects would shutdown immediately.. no one could fund the potential liability.

Free software is generally delivered as is, without any guarantees.

Router software is part of something you actually pay for, so there should be liability.

Post reply on HN