sb-eu logo
Story image

Advice: FBI urges people to reboot their routers following Russia attack

01 Jun 2018

The FBI recently issued a plea for people around the world to turn their routers off and back on again.

According to the statement, this is to help put a stop to the spread of a dangerous piece of Russian malware that has already infected more than 500,000 routers in at least 54 countries.

“The actors used VPNFilter malware to target small office and home office routers. The malware is able to perform multiple functions, including possible information collection, device exploitation, and blocking network traffic,” the statement read.

By rebooting your router – in addition to updating the devices and ensuring passwords are safe – the problem could not only be fixed but also allow authorities to track down where the attack actually came from.

The Justice Department obtained a court order last week that allowed the FBI to take control of a website that the hackers had allegedly planned to use to give instructions to the infected routers – in doing so, the authorities also revealed the hackers involved were in a group called Sofacy (also known as APT28 and Fancy Bear) that answered to the Russian government.

Vectra EMEA director Matt Walmsley says with all the stories constantly emerging of routers being compromised by foreign nation states, we see yet again that consumer-grade devices are being targeted, compromised and potentially weaponised.

“Consumers are often ill-equipped to manage their local cyber security, they should at the very least power cycle their devices and ensure they have updated to the latest firmware. Enterprises also need to ensure they don’t leave the door wide open and should take another look at how they’re securing their network infrastructure,” says Walmsley.

“No software is perfect so make sure you’re up-to-date with software updates and patches for your network infrastructure. Then make sure you’re not exposing your equipment’s management interfaces and ensure you have changed the default admin credentials. For perimeter devices with internet connectivity this is doubly important. This may seem like ‘cybersecurity 101’ advice but recently default settings in some Cisco switches allowed over 168,000 devices exposed to the internet to be identified as vulnerable to illicit remote command execution via an admin protocol.”

Walmsley says that ‘firmware may not be that firm’ as advanced attackers will seek to compromise the underlying firmware of their target platform.

“Even if you have robust OS level security controls, threats such as Sub-OS rootkits will remain undetected. However, with recent advances in AI-based behaviour threat detection, we can now spot in real-time the very subtle signals attackers use to perform command & control (C2) orchestration to devices that have compromised firmware by looking for the attacker’s “knocking” signals hidden within legitimate communications,” says Walmsley.

“With that actionable insight, platforms can be completely reset and their firmware, OS images, and configs reloaded from known good sources.”

Story image
80% of security breaches involve exposure of customer data - IBM
The new report from IBM indicates that 80% of surveyed organisations reported having exposed customers’ personally identifiable information (PII) as a result of a breach.More
Story image
Adobe, IBM and Red Hat partner up to accelerate DX and real-time data security
"As companies undergo their digital transformations and move core workloads to the cloud, the entire C-suite is facing a re-framing of their roles to meet customer demands – all while keeping security front and centre."More
Story image
Why greater network visibility is needed to reduce the threat posed by IoT in the enterprise
At home and abroad, organisations have joined the rush to embrace Internet of Things (IoT) technology, but a new survey shows they’re only just beginning to wake up to the enormous risk those devices pose, writes ExtraHop A/NZ Regional Sales Manager Glen Maloney.More
Story image
Interview: ThreatQuotient champions threat intelligence through virtual 'situation rooms'
To understand what it involves and some of the collaboration challenges that come with distributing threat intelligence amongst specialised security teams, we spoke to ThreatQuotient APJC regional director Anthony Stitt.More
Story image
Attivo Networks improves EDN solution with advanced features
“By detecting unauthorised ingress and egress connections both at the source and at the destination, security defenders gain real-time visibility along with conclusive detection alerts.”More
Story image
Fortinet unveils firewall offering for hyperscale & 5G environments
The company continues to push the boundaries of hardware-accelerated performance for security and networking convergence.More