The FBI is strongly recommending to the public to reboot their Wi-Fi routers in a move to counter the “VPNFilter” malware. The malware, created by “foreign cyber actors,” can potentially render routers inoperable, and may be collecting personal information.
The FBI recommends any owner of small office and home office routers power cycle (reboot) the devices. Foreign cyber actors have compromised hundreds of thousands of home and office routers and other networked devices worldwide. The actors used VPNFilter malware to target small office and home office routers. The malware is able to perform multiple functions, including possible information collection, device exploitation, and blocking network traffic.
TECHNICAL DETAILS
The size and scope of the infrastructure impacted by VPNFilter malware is significant. The malware targets routers produced by several manufacturers and network-attached storage devices by at least one manufacturer. The initial infection vector for this malware is currently unknown.
THREAT
VPNFilter is able to render small office and home office routers inoperable. The malware can potentially also collect information passing through the router. Detection and analysis of the malware’s network activity is complicated by its use of encryption and misattributable networks.
DEFENSE
The FBI recommends any owner of small office and home office routers reboot the devices to temporarily disrupt the malware and aid the potential identification of infected devices. Owners are advised to consider disabling remote management settings on devices and secure with strong passwords and encryption when enabled. Network devices should be upgraded to the latest available versions of firmware.
Rebooting affected routers won’t kill or remove the malware, but it will temporarily disrupt it, and could help in identifying affected hardware. Users should also consider disabling remote management settings on their routers and secure with strong passwords and encryption when enabled. Routers should also be upgraded to the latest available versions of firmware when available.
Security firm Symantec says the following routers and Network-Attached Storage (NAS) devices are known to include the following:
- Linksys E1200
- Linksys E2500
- Linksys WRVS4400N
- Mikrotik RouterOS for Cloud Core Routers: Versions 1016, 1036, and 1072
- Netgear DGN2200
- Netgear R6400
- Netgear R7000
- Netgear R8000
- Netgear WNR1000
- Netgear WNR2000
- QNAP TS251
- QNAP TS439 Pro
- Other QNAP NAS devices running QTS software
- TP-Link R600VPN
Apple’s family of AirPort routers and networked storage devices do not appear to be affected by the malware.
(Via AppleInsider)
