VPNFilter Malware

[AntonK]

This seems unpleasant!

https://blogs.cisco.com/security/talos/vpnfilter

https://www.us-cert.gov/ncas/current-activity/2018/05/23/VPNFilter-Destructive-Malware

Anton

 

[coxhaus]

You beat me to it. Everybody needs to patch your routers with the latest firmware.

"The U.S. Department of Homeland Security said it was investigating the malware, which targets devices from Linksys, MikroTik, Netgear Inc, TP-Link and QNAP, advising users to install security updates. "


https://www.msn.com/en-us/news/tech...ned-russian-attack/ar-AAxHeFg?ocid=spartanntp

 

[RMerlin]

You beat me to it. Everybody needs to patch your routers with the latest firmware.

"The U.S. Department of Homeland Security said it was investigating the malware, which targets devices from Linksys, MikroTik, Netgear Inc, TP-Link and QNAP, advising users to install security updates. "


https://www.msn.com/en-us/news/tech...ned-russian-attack/ar-AAxHeFg?ocid=spartanntp

Nobody can provide any attack vector yet. The only common things I could see between these devices are PPTP support, or end-user using weak credentials.

 

[umarmung]

Uses no zero-days, as far as the security researchers can tell.

Mikrotik SOHO devices are externally secure by default (no WAN ports or services running on the WAN, other than ICMP ping).

In general for all wired routers, unless you have enabled remote WAN or have UPnP or other protocols or services on the WAN, you should be safe from remote exploits due to NAT + firewall.

You cannot take this for granted though, e.g. if you use the Asus mobile app to manage your Asus router, it may silently change your router configuration ...

So, everyone should be keeping up to date with router updates, especially on wireless routers.

 

[Marko Polo]

"The U.S. Department of Homeland Security said it was investigating the malware, which targets devices from Linksys, MikroTik, Netgear Inc, TP-Link and QNAP, advising users to install security updates. "

The only thing that calms me down is that this list lacks ASUS

Nobody can provide any attack vector yet. The only common things I could see between these devices are PPTP support, or end-user using weak credentials.

How do you think, Merlin, is Merlin firmware can be affected? Could we make any prevention steps?

 

[umarmung]

The only thing that calms me down is that this list lacks ASUS

So, you didn't read the original report? Quoting selectively:

We have not completed our research, but recent events have convinced us that the correct way forward is to now share our findings so that affected parties can take the appropriate action to defend themselves.

...

Publishing early means that we don't yet have all the answers — we may not even have all the questions — so this blog represents our findings as of today, and we will update our findings as we continue our investigation.

Both the scale and the capability of this operation are concerning. Working with our partners, we estimate the number of infected devices to be at least 500,000 in at least 54 countries.

....

The following devices are known to be affected by this threat. Based on the scale of this research, much of our observations are remote and not on the device, so it is difficult to determine specific version numbers and models in many cases. It should be noted that all of these devices have publicly known vulnerabilities associated with them.

Given our observations with this threat, we assess with high confidence that this list is incomplete and other devices could be affected.

This is not a normal small attack, nor limited to one device or even manufacturer, nor created and run by a single hacker from their bedroom. This is state-level malware and research into it is nowhere near complete. What we don't know is every bit as important as what we do know, maybe more.

 

[Marko Polo]

So, you didn't read the original report?

Not yet, thanks for the link. The info about the attack in media is so discrete and fuzzy, that I wasn't able to figure out the whole picture. Only some pieces and bits of info.

Infection method is still not clear.

 

[RMerlin]

In general for all wired routers, unless you have enabled remote WAN or have UPnP or other protocols or services on the WAN, you should be safe from remote exploits due to NAT + firewall.

Running a PPTP server would do just that - expose itself to the WAN.

 

[RMerlin]

How do you think, Merlin, is Merlin firmware can be affected? Could we make any prevention steps?

As pointed out, nobody knows what attack vector is being used, so how am I supposed to know... At this point, all people can do is apply the usual best practices in terms of security: don't expose your web interface to the WAN, don't use obsolete and broken VPN protocols such as PPTP, etc...

 

[Marko Polo]

Running a PPTP server would do just that - expose itself to the WAN.

Yep. As I understand it, PPTP just exposes 1723th port to Internet.

 

[RMerlin]

Yep. As I understand it, PPTP just exposes 1723th port to Internet.

And since PPTP is old code, and is a weak/vulnerable protocol in itself, it could be a good potential attack vector.

People should ditch PPTP as soon as possible, and move to more modern technologies.

But based on the initial report, it's possible that they are using multiple attack vectors to infect devices, depending on the specific device's vulnerability. So at this point, all people can do is stick to the usual best security practices.

 

[sfx2000]

Nobody can provide any attack vector yet. The only common things I could see between these devices are PPTP support, or end-user using weak credentials.

Saw something about WebGUI's being exposed as a vector for some of the affected vendors...

I agree - PPTP is a legacy thing, it's no longer being maintained for security issues...

 

[smetlydc2]

Upgrading firmware is not a fix. Reset to factory defaults and then upgrade firmware is the fix.

Is this confirmed?

 

[thiggins]

QNAP says they fixed this in mid 2017.
https://www.qnap.com/en/news/2018/r...ions-security-concerns-were-addressed-in-2017

 

[thiggins]

FBI is trying to seize the botnet C&C domain.
https://www.justice.gov/opa/pr/just...advanced-persistent-threat-28-botnet-infected

 

[GK59]

And since PPTP is old code, and is a weak/vulnerable protocol in itself, it could be a good potential attack vector.

People should ditch PPTP as soon as possible, and move to more modern technologies.

But based on the initial report, it's possible that they are using multiple attack vectors to infect devices, depending on the specific device's vulnerability. So at this point, all people can do is stick to the usual best security practices.

With that said, I'm curious if we should disable all those Passthroughs on the "WAN - NAT Passthrough" tab under "WAN"? Also, is there a setting that allows for the router to be ping-able from the WAN, is this the "Respond ICMP Echo (ping) Request from WAN" that's under "Firewall" tab, "General" section?

 

[coxhaus]

Upgrading firmware is not a fix. Reset to factory defaults and then upgrade firmware is the fix.

Is this confirmed?

When ever I upgrade firmware I always set the router to factory defaults and reconfigure by hand. I never use saved configs. You are correct if there is not a new firmware you want to set it back to factory defaults. The problem is if they got there once there is nothing stopping them from getting there again without a fix.

 

[juniorsweet]

https://arstechnica.com/information...t-now-to-kill-malware-infecting-500k-devices/

Sounds like the FBI is encouraging owners of consumer routers and NAS devices to reboot as part of their efforts to mitigate these attacks. Still no definitive word on attack vector.

 

[RMerlin]

With that said, I'm curious if we should disable all those Passthroughs on the "WAN - NAT Passthrough" tab under "WAN"?

Those shouldn't be an issue, as they only affect outbound traffic, they do not open any inbound port on their own.

Also, is there a setting that allows for the router to be ping-able from the WAN?

Yes, on the Firewall -> General page. By default Asuswrt will not respond to pings received on the WAN side.

 

[GK59]

Those shouldn't be an issue, as they only affect outbound traffic, they do not open any inbound port on their own.



Yes, on the Firewall -> General page. By default Asuswrt will not respond to pings received on the WAN side.

Noted, thanks Eric.