The details on this are very vague. No one knows or is sharing the initial attack vector. It could be a browser spear phishing attack that then attempts to use known default passwords for these routers and uploads a custom firmware image or backdoor script. The only thing that I don't get is why rebooting resolves the issue. This can't be accurate, if the compromise was via a user, its only a temporary resolution, and if the backdoor is as sophisticated as they say, it should definitely have persistence that last beyond reboot.
VPNFilter malware infecting 500K devices is worse than was thought
11–20 of 45 posts
Re: VPNFilter malware infecting 500K devices is worse than was thought
#12In the paytv hacking world, users would install a switch on the EEPROM’s WriteEnable line. That way, destructive updates could be blocked for as long as possible. Or save you from having to re-flash your receiver through desoldering a TSOP. Perhaps we need the same thing on routers. Or a group to run a “honeypot” of routers with a sensor on this EEPROM pin to identify when unauthorized updates have been installed and…
A switch wouldn't work on a serial EEPROM or serial Flash chip, you'd need a microcontroller-in-the-middle that proxies or virtualizes the EEPROM and ignores writes. This sort of thing would also break partitioned storage, where persistent state and the system image are located on different partitions within the same Flash chip.
Re: VPNFilter malware infecting 500K devices is worse than was thought
#13Any suggestions for a good router that is immune from this nonsense?
As in another post, I’d suggest buying any router, taking it apart, identifying the flash chip, find the write-enable line in the data-sheet and MITM that line with a flip switch to block updates at all times.
Re: VPNFilter malware infecting 500K devices is worse than was thought
#14Any startup writing router firmware in Rust?
ARM/MIPS are Tier 2 platforms for Rust:
https://forge.rust-lang.org/platform-support.html
Re: VPNFilter malware infecting 500K devices is worse than was thought
#15The details on this are very vague. No one knows or is sharing the initial attack vector. It could be a browser spear phishing attack that then attempts to use known default passwords for these routers and uploads a custom firmware image or backdoor script. The only thing that I don't get is why rebooting resolves the issue. This can't be accurate, if the compromise was via a user, its only a temporary resolution, an…
Rebooting removes later stages, the first stage is persistent but one of the AV companies took down the domain that the later stages are retrieved from, effectively cutting it off from those stages.
Re: VPNFilter malware infecting 500K devices is worse than was thought
#16The details on this are very vague. No one knows or is sharing the initial attack vector. It could be a browser spear phishing attack that then attempts to use known default passwords for these routers and uploads a custom firmware image or backdoor script. The only thing that I don't get is why rebooting resolves the issue. This can't be accurate, if the compromise was via a user, its only a temporary resolution, an…
Per the last thread: https://news.ycombinator.com/item?id=17162245
Re: VPNFilter malware infecting 500K devices is worse than was thought
#17Any suggestions for a good router that is immune from this nonsense?
Buy a small cheap computer with two ethernet ports and run debian.
Re: VPNFilter malware infecting 500K devices is worse than was thought
#18In the paytv hacking world, users would install a switch on the EEPROM’s WriteEnable line. That way, destructive updates could be blocked for as long as possible. Or save you from having to re-flash your receiver through desoldering a TSOP. Perhaps we need the same thing on routers. Or a group to run a “honeypot” of routers with a sensor on this EEPROM pin to identify when unauthorized updates have been installed and…
A switch wouldn't work on a serial EEPROM or serial Flash chip, you'd need a microcontroller-in-the-middle that proxies or virtualizes the EEPROM and ignores writes. This sort of thing would also break partitioned storage, where persistent state and the system image are located on different partitions within the same Flash chip.
I do recall 24 series 8-pin serial EEPROMs having a write enable line as well that could be locked via a switch.
Looking quickly on a random manuacturer’s 93 series, I don’t see such a line, BUT, programming operations are blocked when the voltage is below a certain level. A couple diodes on the Voltage line could be put in séries (via switch) to prevent writes unless desired.
Of course, if writes are required at some level for normal operation, your chip firewall strategy works much better.
The paytv providers actually implemented a flash writeability check (without trIggerinf a write) upon bootup. One of my ideas was to emulate the 24-series eeprom entirely. For the bigger “TSOP” chips, someone devised a high-speed logic gate that was fast enough to allow the check to pass, but still prevent actual writes.
Re: VPNFilter malware infecting 500K devices is worse than was thought
#19Any suggestions for a good router that is immune from this nonsense?
As in another post, I’d suggest buying any router, taking it apart, identifying the flash chip, find the write-enable line in the data-sheet and MITM that line with a flip switch to block updates at all times.
That's actually a really good idea! I would love to see this built-in to future router models after something widespread like this. It's fairly reasonable to force users to be physically present to update. Plus, you could force them to flip the switch back by not working until the write-enable line is disconnected again.
Re: VPNFilter malware infecting 500K devices is worse than was thought
#20Earlier quoted context omitted.
A switch wouldn't work on a serial EEPROM or serial Flash chip, you'd need a microcontroller-in-the-middle that proxies or virtualizes the EEPROM and ignores writes. This sort of thing would also break partitioned storage, where persistent state and the system image are located on different partitions within the same Flash chip.
I do recall 24 series 8-pin serial EEPROMs having a write enable line as well that could be locked via a switch. Looking quickly on a random manuacturer’s 93 series, I don’t see such a line, BUT, programming operations are blocked when the voltage is below a certain level. A couple diodes on the Voltage line could be put in séries (via switch) to prevent writes unless desired. Of course, if writes are required at som…
And oh ya, a JTAG interface could provide interesting real-time analysis of what’s going on.