Internet Crime - FBI Warning on May 25, 2018- Any reason to worry? - Page 1
Forum section: electronics / general

author: ez24
author_rank: Super Contributor
timestamp: May 30, 2018, 07:02:51 pm
content: Sorry if this is posted already. I searched on "FBI", too many hits (could not sort on date ? ) - searched on "internet crime" no results so here goes:https://www.ic3.gov/media/2018/180525.aspxWould it be a good idea to reboot often - say once a week?

author: DimitriP
author_rank: Super Contributor
timestamp: May 30, 2018, 07:11:50 pm
content: more importantly... "Owners are advised to consider disabling remote management settings on devices and secure with strong passwords and encryption when enabled. Network devices should be upgraded to the latest available versions of firmware."No matter what your IT guy "neeeeeeds" in order to "manage" your network.

author: rdl
author_rank: Super Contributor
timestamp: May 30, 2018, 11:07:02 pm
content: VPNFilter.When the FBI posts a warning like that, I think it's probably a good idea to follow the recommendations. I've been rebooting every day. There have been a few articles posted on Ars Technica. Some sources believe certain brands may be more at risk. I did buy a new router, but not really because of VPNFilter.I think these links are in order, oldest to newest:https://arstechnica.com/information-technology/2018/05/hackers-infect-500000-consumer-routers-all-over-the-world-with-malware/https://arstechnica.com/information-technology/2018/05/fbi-seizes-server-russia-allegedly-used-to-infect-500000-consumer-routers/https://arstechnica.com/information-technology/2018/05/fbi-tells-router-users-to-reboot-now-to-kill-malware-infecting-500k-devices/

author: orion242
author_rank: Unknown
timestamp: May 31, 2018, 02:25:26 am
content: Or get rid of the soho networking garbage. Your trusting everything you do online to your router and networking gear. Do you really want the lowest cost commodity BS in this role? These companies all seem to use a common code base, all stop supporting the hardware in short order, and have horrible security records as icing on the cake.

author: JohnnyMalaria
author_rank: Super Contributor
timestamp: May 31, 2018, 02:31:11 am
content: I suspect the rationale behind the advisory is that the hackers require the IP address of the router for a certain period of time. Most people have "dynamic" IP addresses which means pretty much every time you connect to your ISP you get a new IP address. If you have a "static" IP address then simply rebooting wouldn't help.

author: orion242
author_rank: Unknown
timestamp: May 31, 2018, 02:41:34 am
content: From the bit I have read, half the malware was ram resident with a small portion that checked the CnC servers in persistent memory. They took over the domains which hosted the CnC servers that the persistent portion checks for further instructions. So if you reboot, the ram portion will be gone, the persistent portion will now ping the FBIs server ideally get no further commands and allow them to track down who is infected. There was also something about the malware opening a listening port in case all else was lost, which may still be an open vector the bad guys could exploit.Not sure what warms the heart more. The fact the FBI may be trying to help or the opportunity they can pick on installing their own code on the device. $hit can garbage spend a few bucks to get something better.

author: orion242
author_rank: Unknown
timestamp: May 31, 2018, 02:52:21 am
content: Also forgot, apparently this malware was also looking for modbus traffic. Someone is looking for SCADA systems which I find really interesting.

author: VintageTekFan
author_rank: Regular Contributor
timestamp: May 31, 2018, 03:34:35 am
content: SCADA, and especially power monitoring equipment use MODBUS extensively. This would tie into the reports in the news about hackers targeting US electric infrastructure specifically.

author: orion242
author_rank: Unknown
timestamp: May 31, 2018, 03:37:20 am
content: Modbus is very common in control systems of all sorts. Sniffing with 500K devices for control systems is someone up to no good.

author: Halcyon
author_rank: Unknown
timestamp: May 31, 2018, 05:30:48 am
content: Quote from: DimitriP on May 30, 2018, 07:11:50 pmThis. No internet facing router or firewall should have admin or remote management open to the internet, but it's so common with SOHO devices to make it "easier" for your ISP to trace faults. If your IT guys need access to it from the outside, make them VPN in first.Quote from: orion242 on May 31, 2018, 02:25:26 amAlso this++