FBI warns public to reboot Wi-Fi routers to counter 'VPNFilter' malware
The FBI is recommending power cycling Wi-Fi routers as a step to counter "foreign cyber actors" seeding malware known as "VPNFilter."
The malicious code can "perform multiple functions, including possible information collection, device exploitation, and blocking network traffic," according to the FBI's Internet Crime Complaint Center. It can potentially render routers inoperable, and is hard to detect due to use of encryption and "misattributable networks."
Rebooting a router won't kill the malware, but will temporarily disrupt it and may help identify affected hardware, the IC3 said. As a further precaution people may want to disable remote management, use original secure passwords, and make sure they've updated to the latest firmware.
Security firm Symantec indicates that activity suggests the target was originally Ukraine, and specifically industrial control systems. The malware "does not appear to be scanning and indiscriminately attempting to infect every vulnerable device globally," Symantec said.
Affected routers and NAS (network-attached storage) devices are known to include:
At present, it does not appear that the AirPort family is affected.
Apple only recently got out of the router market, having let its AirPort line grow stagnant for several years. The company is instead promoting third-party products, particularly the Linksys Velop mesh system.
The malicious code can "perform multiple functions, including possible information collection, device exploitation, and blocking network traffic," according to the FBI's Internet Crime Complaint Center. It can potentially render routers inoperable, and is hard to detect due to use of encryption and "misattributable networks."
Rebooting a router won't kill the malware, but will temporarily disrupt it and may help identify affected hardware, the IC3 said. As a further precaution people may want to disable remote management, use original secure passwords, and make sure they've updated to the latest firmware.
Security firm Symantec indicates that activity suggests the target was originally Ukraine, and specifically industrial control systems. The malware "does not appear to be scanning and indiscriminately attempting to infect every vulnerable device globally," Symantec said.
Affected routers and NAS (network-attached storage) devices are known to include:
- Linksys E1200
- Linksys E2500
- Linksys WRVS4400N
- Mikrotik RouterOS for Cloud Core Routers: Versions 1016, 1036, and 1072
- Netgear DGN2200
- Netgear R6400
- Netgear R7000
- Netgear R8000
- Netgear WNR1000
- Netgear WNR2000
- QNAP TS251
- QNAP TS439 Pro
- Other QNAP NAS devices running QTS software
- TP-Link R600VPN
At present, it does not appear that the AirPort family is affected.
Apple only recently got out of the router market, having let its AirPort line grow stagnant for several years. The company is instead promoting third-party products, particularly the Linksys Velop mesh system.
Comments
It's really hard for me to trust all this router hardware that comes out of China; who knows what kind of backdoors might be installed.
There is a world-wide malware threat to WiFi routers so the FBI puts out a warning and some easily understood, easily actioned advice to US citizens. Isn't that their job? Isn't that a good thing?
If you follow the Symantec link in the article, you'll find that the FBI's advice is effective; not 100% effective but nonetheless helpful. Part of the issue here is that people never changed their routers' passwords, with that audience the FBI needed to keep it simple. The bigger fix involves firmware updates and basic security hygiene and the FBI notice goes on to describe this; it may be simple to the audience here but not so much to the world at large.
You can be as paranoid as you want but truth be told you’re one person in 3 billion on this planet and say one person in 1.5 billion on the internet. The probability of you being the target of someone like this is pretty remote unless of course you’ve done something to annoy these people...
You can thank those tosser corporations with in-house crap apps for that stupid decision.