VPNFilter malware infecting 500K devices is worse than was thought
1–10 of 45 posts
Re: VPNFilter malware infecting 500K devices is worse than was thought
#2In the paytv hacking world, users would install a switch on the EEPROM’s WriteEnable line.
That way, destructive updates could be blocked for as long as possible. Or save you from having to re-flash your receiver through desoldering a TSOP.
Perhaps we need the same thing on routers.
Or a group to run a “honeypot” of routers with a sensor on this EEPROM pin to identify when unauthorized updates have been installed and need investigation.
This won’t work for non-persistent hacks. But for anything that wants to last longer than a reboot...
Re: VPNFilter malware infecting 500K devices is worse than was thought
#3Any startup writing router firmware in Rust?
Re: VPNFilter malware infecting 500K devices is worse than was thought
#4The most concerning aspect of this is the lack of details surrounding the initial attack vector and the fact that the IoC list is effectively useless to anyone downstream of these devices which sit at the perimeter of your network.
Anyone else having fun with the minor panic attacks incited by slow page-loads?
Re: VPNFilter malware infecting 500K devices is worse than was thought
#5Dumb question about this malware... with so many infected routers, why was this not noticed sooner? Just monitoring incoming/outgoing data should reveal that the routers are "calling home" at some point, yes?
Re: VPNFilter malware infecting 500K devices is worse than was thought
#6How about routers (and IoT devices for that matter) that have a ROM image, with a user intitiated ability to actually obliterate the entire contents of NVRAM and flash? i.e. the firmware (which is made up of various parts, multiple stage bootloader, kernel, initrd, root, NVRAM, maybe proprietary radio firmware and/or baseband files) would be wiped out. The ROM would have a very limited ability to "phone home" only via wired connection, and get an updated firmware payload.
Obviously the idea is to make sure the image in ROM is simple enough that it's really damn unlikely that it can be attacked, or attacked before the correct and intended firmware is downloaded and installed.
Re: VPNFilter malware infecting 500K devices is worse than was thought
#7Can we assume that dd-wrt and tomato are safe(r) from this?
Re: VPNFilter malware infecting 500K devices is worse than was thought
#8The most concerning aspect of this is the lack of details surrounding the initial attack vector and the fact that the IoC list is effectively useless to anyone downstream of these devices which sit at the perimeter of your network. Anyone else having fun with the minor panic attacks incited by slow page-loads?
My speculation is that the attack vector was only in stream for a short period of time...
So unless you were capturing incoming packets at that time, we may not know.
Re: VPNFilter malware infecting 500K devices is worse than was thought
#9Any suggestions for a good router that is immune from this nonsense?
Re: VPNFilter malware infecting 500K devices is worse than was thought
#10> To accommodate for this limitation, stage 1 relies on a sophisticated mechanism to locate servers where stage 2 and stage 3 payloads were available. The primary method involved downloading images stored on Photobucket.com and extracting an IP address from six integer values used for GPS latitude and longitude stored in the EXIF field of the image. When Photobucket removed those images, VPNFilter used a backup method that relied on a server located at ToKnowAll.com.
That sounds as sophisticated as a drug dealer calling their pills “beans” or “almonds”. Like, it’s intelligent, but it’s just 1 step removed from just coding in the IP directly.