Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

VPNFilter malware infecting 500K devices is worse than was thought

arstechnica.com

Post reply on HN
Print view View original

31–40 of 45 posts

Re: VPNFilter malware infecting 500K devices is worse than was thought

#31

Post by Johnny555 »

rorosaurus wrote: post #19
Scoundreller wrote: post #13

Earlier quoted context omitted.

As in another post, I’d suggest buying any router, taking it apart, identifying the flash chip, find the write-enable line in the data-sheet and MITM that line with a flip switch to block updates at all times.

That's actually a really good idea! I would love to see this built-in to future router models after something widespread like this. It's fairly reasonable to force users to be physically present to update. Plus, you could force them to flip the switch back by not working until the write-enable line is disconnected again.

It could have the unintended side effect of making people even less likely to upgrade firmware.

Re: VPNFilter malware infecting 500K devices is worse than was thought

#32

Post by spydum »

jacob019 wrote: post #17
oprah2018 wrote: post #9

Any suggestions for a good router that is immune from this nonsense?

Buy a small cheap computer with two ethernet ports and run debian.

And most importantly: keep it updated.

About the only thing I would trust without updates is a bsd box. And even that, may eventually fall victim.

Re: VPNFilter malware infecting 500K devices is worse than was thought

#33

Post by ggm »

Scoundreller wrote: post #10

> To accommodate for this limitation, stage 1 relies on a sophisticated mechanism to locate servers where stage 2 and stage 3 payloads were available. The primary method involved downloading images stored on Photobucket.com and extracting an IP address from six integer values used for GPS latitude and longitude stored in the EXIF field of the image. When Photobucket removed those images, VPNFilter used a backup metho…

In this space (journalism) any previously unknown (by the journalist) method of obfuscation is, almost by definition "sophisticated"

Personally, I'd have said "clever" and "probably indicative of a trend, which is going to continue" and "don't assume wiping EXIF headers stops this, because a bunch of meta data is out there in ways you don't yet understand"

hiding things in meta data, is why IP over ICMP works.

Re: VPNFilter malware infecting 500K devices is worse than was thought

#34

Post by jlgaddis »

lubujackson wrote: post #5

Dumb question about this malware... with so many infected routers, why was this not noticed sooner? Just monitoring incoming/outgoing data should reveal that the routers are "calling home" at some point, yes?

IIRC, previous articles (a few weeks ago) stated that Cisco (at least, and possibly others) have known about and been “tracking” this for months but they finally announced it publicly because $someEvent was approaching and they were afraid this botnet would be used to disrupt it.

(I’m on my phone or else I’d look into this more and give you more specific info instead of vague recollections but, if you (or anyone else here) are interested, this should at least give you somewhere to start.)

Re: VPNFilter malware infecting 500K devices is worse than was thought

#35

Post by jlgaddis »

stealthmodeclan wrote: post #3

Any startup writing router firmware in Rust?

I don’t heard of anyone rewriting the Linux kernel and network drivers — which is 90% of what all this “router firmware” is, plus a (sometimes) slick web interface to manage it, along with uboot — in Rust yet so I’m gonna say no.

It’s almost like no one considers it worth the effort.

Re: VPNFilter malware infecting 500K devices is worse than was thought

#36

Post by jlgaddis »

Scoundreller wrote: post #7

Can we assume that dd-wrt and tomato are safe(r) from this?

According to the article, no.

> Williams said he has seen no evidence VPNFilter has infected devices running Tomato, Merlin WRT, and DD-WRT firmware, but that he can't rule out that possibility.

Re: VPNFilter malware infecting 500K devices is worse than was thought

#37

Post by srcmap »

In this URL, https://blog.talosintelligence.com/2018/05/VPNFilter.html?m=...

it mentions snort rules for detection and protection for VPNFilter and ClamAV Signatures.

But it didn't explain how to use them.

The way I understand SNORT after googling it, I need to able captures the traffic (wan port) and feed that to SNORT for analysis, is that correct?

Also for ClamAV, do I need to clone/mount the rootfs from the wifi router to Linux and use ClamAV to scan that rootfs for those signatures?

The URL mentions the infested device have /var/run/vpnfilterm, /var/run/vpnfilterw. I checked they are not in my wifi router's fs.

The URL also mentions it modified/insert entry the crontab, but I can't find what exe name, possible file locations I should search in my router. Do anyone else know such info?

Re: VPNFilter malware infecting 500K devices is worse than was thought

#39

Post by teilo »

joewee wrote: post #11

The details on this are very vague. No one knows or is sharing the initial attack vector. It could be a browser spear phishing attack that then attempts to use known default passwords for these routers and uploads a custom firmware image or backdoor script. The only thing that I don't get is why rebooting resolves the issue. This can't be accurate, if the compromise was via a user, its only a temporary resolution, an…

This is a multi-vector, multi-architecture attack, and while we know some of the vectors, we don't know them all.

Some were due to vulnerabilities in the router's web admin. Mikrotik routers were compromised in this way. In this case, it was not a default password issue (as their is no default password on Mikrotiks), but an attack that would work regardless of credentials. Anyone running firmware older than March 2018 who was not smart enough to block port 80 on their public interface likely got owned. Mikrotik is not a consumer router, but they are cheap and powerful, and thus attractive to end users, many of whom don't know what they are doing. Thankfully, the Mikrotiks are easily fixable. Upgrade the firmware, and stage 1 gets wiped out.

But most consumer routers, by default, do not expose the web admin in this way, and were compromised by some other vector, and we have yet to get to the bottom of all of them. Many of these routers, due to their architecture, cannot be fixed with a firmware upgrade.

Re: VPNFilter malware infecting 500K devices is worse than was thought

#40

Post by teilo »

lubujackson wrote: post #5

Dumb question about this malware... with so many infected routers, why was this not noticed sooner? Just monitoring incoming/outgoing data should reveal that the routers are "calling home" at some point, yes?

It was noticed by some vendors. They just didn't know what it was. Mikrotik, for example, posted a warning on their forums months ago, when their users noticed a sudden uptick in attempt to get at ports 80 and 8291. In this case the attack was scanning for the existence of port 8291 to identify these routers, and then attempting an exploit on port 80. It was only months later that we all learned the VPNFilter was the culprit.
Post reply on HN