Now the real question is why you can exploit routers using EXIF metadata.
FBI tells router users to reboot now to kill malware infecting 500k devices
201–210 of 299 posts
Re: FBI tells router users to reboot now to kill malware infecting 500k devices
#202How can I verify some malicious code is actually present on my router? What does this code do? Could the FBI put their own malicious code on the router, via this supposed exploit? Why should I trust the FBI? Excuse my ignorance but I'm not not going to ask these types of questions. EDIT: After reading a bit - it seems the control is somehow "transferred" to the FBI rather than the malicious actor - any other external…
> Why should I trust the FBI? So don't. No one is forcing you to reboot your router. No one who cares about this issue cares about your personal Jason Bourne fantasies. Reboot. Don't reboot. For the rest of the world, your decision makes zero difference. because skeptic It's just like English. Close enough.
I'm just trying to learn through discussion - I thought that HN would be a good place to do it, and that may be my mistake. I'm an interpersonal learner and admittedly ignorant on this topic.
I have no personal fantasies; I want to understand the truth and that's my only motive.
Re: FBI tells router users to reboot now to kill malware infecting 500k devices
#203Earlier quoted context omitted.
This is going to be really, really hard without turning into a mess. Software is complex, and bad software even more so, and an integrated hardware/software system is even worse. Even finding the vulnerabilities is hard already, because lots of systems are snowflakes and each needs to be analyzed individually, and usually in individual ways. And even assuming we have a definition of 'infrastructure software' and a wa…
Perhaps a “UL Labs” type of solution for software, so that if your software and organization are certified according to the current standard, then your liabilities would be reduced? And yes, organizations and versions of software would have to be recertified on a regular basis. You would want software versions to be able to be certified quickly and through an automated process, but there is already some best practice…
Ask and you shall receive, something...
Past event: https://www.aei.org/events/securing-the-internet-of-things-a...
Partial event video: https://www.youtube.com/watch?v=DrnFcLuqzd4
Re: FBI tells router users to reboot now to kill malware infecting 500k devices
#204Does anyone know why router manufacturers aren't financially responsible for the exploits that allow their devices to be hacked? At the very least there should be some kind of policy or standard that allows someone on the inside of the network to know if the password or software has been changed. If the FBI can tell from the outside, then how in the world are people still in the dark about this?
If the exploit wasn't put there intentionally, then we're talking about a bug in the software. Do you really want liability for software bugs? The consequences of that would be substantial. Imagine if Apache or PHP were liable for their bugs used on websites across the internet. The projects would shutdown immediately.. no one could fund the potential liability.
Consider Target or Equifax, when they get hacked they are court ordered to notify their customers. Does someone want to maintain a list of customers for every piece of hardware for connected in case something goes awry?
Re: FBI tells router users to reboot now to kill malware infecting 500k devices
#205Earlier quoted context omitted.
Mistakes are inevitable. Deciding to ship without any upgrade capability is a choice. A deliberate, negligent choice.
On the other hand, remote upgradability is how malware gets itself installed in the first place.
Most HTTP libraries verify certificates by default. That's all you really need to do...
Re: FBI tells router users to reboot now to kill malware infecting 500k devices
#206Earlier quoted context omitted.
If the exploit wasn't put there intentionally, then we're talking about a bug in the software. Do you really want liability for software bugs? The consequences of that would be substantial. Imagine if Apache or PHP were liable for their bugs used on websites across the internet. The projects would shutdown immediately.. no one could fund the potential liability.
> Do you really want liability for software bugs? Yeah, definitely. Especially for infrastructure. I realize the implications of this are significant. I don't think the solution is "all bugs cost every company money for every product", but there's definitely more or less risk involved in some software and we are well past the point of negligence from router manufacturers - the vulnerabilities we see from them are abs…
Have you ever been involved in development or written software?
Re: FBI tells router users to reboot now to kill malware infecting 500k devices
#207Earlier quoted context omitted.
Explain how the FBI would leverage an advantage by telling you to reboot. Explain in a way, which doesn't depend on an unprovable. The best I can come up with is a false sense of security, which given they actually expect you to also patch and upgrade and proffer advice to patch and upgrade, is a bit weak. Basically, I cannot construct a scenario where there is a significant, could-not-be-found-by-white-hat reason th…
I suppose I just don't know what exploits could be implanted -- are there forms of rootkits that can go undetected? Or have all of these infected firmware been reverse engineered and the exploit in question cataloged? According to ArsTech in this article ( https://arstechnica.com/information-technology/2018/05/hacke... ) the VPNFilter exploit can survive a reboot - so how can a simple reboot disinfect if the only del…
The attack had three components: infection, sign-in with an initiator head-end, and then second/third stage download.
As I understand it, from reading around: The FBI took over an "initiator" headend which bootstraps a simpler infection into the actual threat/attack code.
The low level infection can't be removed simply, that demands new code from the maker or an OpenWRT type source. The FBI took over the domain namer behind a service which acts as the sign-in site. The attack mode code is not in your firmware, it has to be re-downloaded. If you block the initiator login, you aren't "clean" but you cannot complete download of attack code to mount the DDOS
If you reboot, the low level infection tries to sign in, and is blocked, and so can't get the second/third stage downloads.
Re: FBI tells router users to reboot now to kill malware infecting 500k devices
#208Does anyone know why router manufacturers aren't financially responsible for the exploits that allow their devices to be hacked? At the very least there should be some kind of policy or standard that allows someone on the inside of the network to know if the password or software has been changed. If the FBI can tell from the outside, then how in the world are people still in the dark about this?
A very very good example of where a well meaning "perfect or none" law would immediately result in "none" instead of the hoped-for "perfect".
Re: FBI tells router users to reboot now to kill malware infecting 500k devices
#209Earlier quoted context omitted.
If the exploit wasn't put there intentionally, then we're talking about a bug in the software. Do you really want liability for software bugs? The consequences of that would be substantial. Imagine if Apache or PHP were liable for their bugs used on websites across the internet. The projects would shutdown immediately.. no one could fund the potential liability.
Consider Target or Equifax, when they get hacked they are court ordered to notify their customers. Does someone want to maintain a list of customers for every piece of hardware for connected in case something goes awry?
[deleted]
Re: FBI tells router users to reboot now to kill malware infecting 500k devices
#210Earlier quoted context omitted.
I have a very hard time believing you’ve developed software that has been released. I’ve always done my very best to release robust and stable software, and I’ve still shipped bugs. Should I be sued out of existence? We don’t need hardware and software costs spirally out of control like healthcare because of the liability. If device makers would just support their products (bug fixes) for 10(?) years I think that wou…
I've been shipping production software for years... I think you've misread my post if you think I said that every bug should lead to a lawsuit. It's right in the first part of my first post that we should not be holding every product equally liable for every bug. There is a line somewhere , and beyond that line is negligence. A developer exposing a potential vulnerability in an internal service that does not handle s…
Why would routers be handling sensitive information? You're doing something seriously wrong. Perhaps you should be fined for not encrypting your communications?