Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Security

VPNFilter Can Also Infect ASUS, D-Link, Huawei, Ubiquiti, UPVEL, and ZTE Devices (bleepingcomputer.com) 188

Posted by msmash from the security-woes dept.
Catalin Cimpanu, writing for BleepingComputer: The VPNFilter malware that infected over 500,000 routers and NAS devices across 54 countries during the past few months is much worse than previously thought. According to new research technical details published today by the Cisco Talos security team, the malware -- which was initially thought to be able to infect devices from Linksys, MikroTik, Netgear, TP-Link, and QNAP -- can also infect routers made by ASUS, D-Link, Huawei, Ubiquiti, UPVEL, and ZTE. The list of devices vulnerable to VPNFilter has seen a sharp jump from Cisco's original report, going from 16 device models to 71 -- and possibly more.
This discussion has been archived. No new comments can be posted.

VPNFilter Can Also Infect ASUS, D-Link, Huawei, Ubiquiti, UPVEL, and ZTE Devices More

VPNFilter Can Also Infect ASUS, D-Link, Huawei, Ubiquiti, UPVEL, and ZTE Devices

Comments Filter:
  • PFSense and Routerboard then huh? ;-P

    • There is a whole slew of Routerboard products listed:

      RB411 (new)
      RB450 (new)
      RB750 (new)
      RB911 (new)
      RB921 (new)
      RB941 (new)
      RB951 (new)
      RB952 (new)
      RB960 (new)
      RB962 (new)
      RB1100 (new)
      RB1200 (new)
      RB2011 (new)
      RB3011 (new)
      RB Groove (new)
      RB Omnitik (new)

      That said, are you running pfSense ON the RB hardware? If so, do you have any docs on that? I'm interested.

  • Alt Firmware? (Score:1)

    by Anonymous Coward

    Does anyone know if this enters through the stock firmware, or is it a lower level attack? What if we're running DD-WRT or Tomato on one of these routers?

    • Re:Alt Firmware? (Score:5, Informative)

      by GrumpySteen ( 1250194 ) on Wednesday June 06, 2018 @02:37PM (#56738196)

      From a different article [thehackernews.com]

      Since the research is still ongoing, Talos researchers "do not have definitive proof on how the threat actor is exploiting the affected devices," but they strongly believe that VPNFilter does not exploit any zero-day vulnerability to infect its victims.

      Instead, the malware targets devices still exposed to well-known, public vulnerabilities or have default credentials, making compromise relatively straightforward.

      • Re: (Score:1, Interesting)

        by Anonymous Coward

        It's a vuln in the http server. Mikrotik patched it a year ago.

  • Wishlist ... (Score:3)

    by lastman71 ( 1314797 ) on Wednesday June 06, 2018 @02:18PM (#56738070)

    It would be nice to have modem adsl with openwrt ...

  • hardware is pretty much all the same, and apparently the core software is also a reference design, with the brand tricks all of the include.something variety.

    • The "core software" is Linux. Pretty much all routers (most standalone devices really) run Linux under the hood. There are a few oddball routers which use a RTOS like QNX or VxWorks (these are the ones you want to avoid if you're hoping to flash a third party firmware). But the vast majority run Linux because it's free. This malware probably wormed its way in via a universal Linux exploit which was patched in the production releases of Linux distros, but not in the much-slower-to-update router firmware
    • It wont stop until companies are held accountable for security.

  • I don't see it on the list, and I'm pretty sure that they write their own Firmware. Never heard of an exploit of an Apple Router. Ever.

    Apple, PLEASE come back to the Router Business!!!!

    And, while you're at it, please add AirPlay 2 support to the AirPort Express 2 Router/DAC!!!

    • Re: (Score:2)

      by 605dave ( 722736 )

      I assume you are joking, but there is some truth in there. If you knew how to use it the Airport made a great home router

      • Re: (Score:2)

        by Gr8Apes ( 679165 )
        The Airport Extreme is hands down the most reliable consumer grade router out there. In fact, it's better than a handful of business class routers I have used. For years I refused to buy one because I thought "why, it's just a router and it's expensive!" Well, years of fighting with various routers configs, reboots, updates, custom firmware, etc, and noting that the routers I was buying had started going up in price, I finally caved and bought one. My main reason was a friend stated he'd not rebooted his in

        • Re: (Score:3)

          by 605dave ( 722736 )

          Bingo. Everyone dismissed it while it simply worked incredibly well. They say it had a "simple" interface not knowing how configurable it was under the hood. I had custom port forwards, IP assignment, DMZ, everything you'd think you'd want on a home router. Then they EOL'd it.

          • Re: (Score:1)

            by Gr8Apes ( 679165 )
            FYI - I do have to agree that the interface on the airport utility 6.x is too simple, for about 0.01% of the target audience. It's adequate for 99% of the things people would ever need to do. However, not having an admin interface that exposes the functionality that was available in the 5.6 utility such as signal strength, logs, etc is something I highly desired enough to install 5.6 alongside the new 6.x utility. I don't know if 5.6 works with the latest AEs though.

      • I assume you are joking, but there is some truth in there. If you knew how to use it the Airport made a great home router

        No. I was being dead serious.

        My Airport Extreme 5th Gen Router NEVER needs a Reboot, has most of the bells and whistles expected in a modern router (separate 2.4 and 5 G Networks, Guest Network, Flexible Port Forwarding, etc.) Plus, I can even securely config. the thing over WiFi from my iPad if I so choose.

        Plus it is hands-down the easiest Router I have ever had to set up in Bridge Mode. And it even supports some type of Mesh networking that I have never understood, since I don't have two of them.

        Yeah, now

  • My Asus router has to run an older firmware version because the LTE USB modem I use for internet doesn't work with the latest firmwares. And yes I run one of the third-party firmwares which incidentally just announced they were no longer going to update this router anyway. No matter what, this Asus is a dead end even though it works just great.

    My backup router is a Netgear which also happens to be on the hit list, yay, but it doesn't work with the LTE modem so it can't be a frontline device anyway.

    The LTE

  • I have an Asus RT-N66U running Advanced Tomato.. Would it be affected with this issue???

Slashdot Top Deals

Real Programmers don't eat quiche. They eat Twinkies and Szechwan food.

Close