Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

VPNFilter malware infecting 500K devices is worse than was thought

arstechnica.com

Post reply on HN
Print view View original

21–30 of 45 posts

Re: VPNFilter malware infecting 500K devices is worse than was thought

#21

Post by joewee »

eightysixfour wrote: post #15
joewee wrote: post #11

The details on this are very vague. No one knows or is sharing the initial attack vector. It could be a browser spear phishing attack that then attempts to use known default passwords for these routers and uploads a custom firmware image or backdoor script. The only thing that I don't get is why rebooting resolves the issue. This can't be accurate, if the compromise was via a user, its only a temporary resolution, an…

Rebooting removes later stages, the first stage is persistent but one of the AV companies took down the domain that the later stages are retrieved from, effectively cutting it off from those stages.

Thanks for the clarification!

Re: VPNFilter malware infecting 500K devices is worse than was thought

#22

Post by codewritinfool »

oakwhiz wrote: post #12
Scoundreller wrote: post #2

In the paytv hacking world, users would install a switch on the EEPROM’s WriteEnable line. That way, destructive updates could be blocked for as long as possible. Or save you from having to re-flash your receiver through desoldering a TSOP. Perhaps we need the same thing on routers. Or a group to run a “honeypot” of routers with a sensor on this EEPROM pin to identify when unauthorized updates have been installed and…

A switch wouldn't work on a serial EEPROM or serial Flash chip, you'd need a microcontroller-in-the-middle that proxies or virtualizes the EEPROM and ignores writes. This sort of thing would also break partitioned storage, where persistent state and the system image are located on different partitions within the same Flash chip.

Depends on the device. Some do have *WE pins.

Re: VPNFilter malware infecting 500K devices is worse than was thought

#23

Post by Scoundreller »

codewritinfool wrote: post #22
oakwhiz wrote: post #12

Earlier quoted context omitted.

A switch wouldn't work on a serial EEPROM or serial Flash chip, you'd need a microcontroller-in-the-middle that proxies or virtualizes the EEPROM and ignores writes. This sort of thing would also break partitioned storage, where persistent state and the system image are located on different partitions within the same Flash chip.

Depends on the device. Some do have *WE pins.

And some weird ones have a WE pin that only impacts half the memory space. In that case, sub in a chip that blocks it all-or-nothing, but some firmwares may not like that.

Re: VPNFilter malware infecting 500K devices is worse than was thought

#24

Post by joewee »

lubujackson wrote: post #5

Dumb question about this malware... with so many infected routers, why was this not noticed sooner? Just monitoring incoming/outgoing data should reveal that the routers are "calling home" at some point, yes?

No one was looking? It looks like the deployment was fairly sophisticated, these typically use things like twitter, instagram to send commands to compromised devices. These tend to only be discovered when they are used to attack a target or when someone happens upon a C&C machine.

Re: VPNFilter malware infecting 500K devices is worse than was thought

#25

Post by Scoundreller »

rorosaurus wrote: post #19
Scoundreller wrote: post #13

Earlier quoted context omitted.

As in another post, I’d suggest buying any router, taking it apart, identifying the flash chip, find the write-enable line in the data-sheet and MITM that line with a flip switch to block updates at all times.

That's actually a really good idea! I would love to see this built-in to future router models after something widespread like this. It's fairly reasonable to force users to be physically present to update. Plus, you could force them to flip the switch back by not working until the write-enable line is disconnected again.

BIOS updates used to be like that. You would have to switch a jumper to do the update.

Then they got rid of that, even though most people that bothered with BIOS updates could be directed to switch a jumper around...

Re: VPNFilter malware infecting 500K devices is worse than was thought

#26

Post by q3k »

Scoundreller wrote: post #7

Can we assume that dd-wrt and tomato are safe(r) from this?

I wouldn't trust DD-WRT with security further than I can throw it [1] [2]. Please migrate to OpenWRT or something else that's modern and maintained by more than one person.

[1] https://github.com/mirror/dd-wrt/blob/master/src/router/http...

[2] https://github.com/mirror/dd-wrt/blob/master/src/router/http...

Re: VPNFilter malware infecting 500K devices is worse than was thought

#28

Post by Scoundreller »

q3k wrote: post #26
Scoundreller wrote: post #7

Can we assume that dd-wrt and tomato are safe(r) from this?

I wouldn't trust DD-WRT with security further than I can throw it [1] [2]. Please migrate to OpenWRT or something else that's modern and maintained by more than one person. [1] https://github.com/mirror/dd-wrt/blob/master/src/router/http... [2] https://github.com/mirror/dd-wrt/blob/master/src/router/http...

Noted. Weekend project!!!

You just reminded me that some of the more obscure dd-wrt bins (for not so popular routers) and might be dangerous stuff.

Re: VPNFilter malware infecting 500K devices is worse than was thought

#29

Post by q3k »

Scoundreller wrote: post #28
q3k wrote: post #26

Earlier quoted context omitted.

I wouldn't trust DD-WRT with security further than I can throw it [1] [2]. Please migrate to OpenWRT or something else that's modern and maintained by more than one person. [1] https://github.com/mirror/dd-wrt/blob/master/src/router/http... [2] https://github.com/mirror/dd-wrt/blob/master/src/router/http...

Noted. Weekend project!!! You just reminded me that some of the more obscure dd-wrt bins (for not so popular routers) and might be dangerous stuff.

Fuzzing it should be cool and fruitful. Have fun :).
Post reply on HN