FYI - Massive Russian Malware network - "VPNfilter"

[Tony Su]

This morning,
Is the Security news of the day...
You can get more breaking news using the search term "vpnfilter" and
omit "vpn filter" results.

Summary
Est >500,000 devices already compromised
Current main attack focus is Ukraine
Almost no attack vector info, except that
- IoT devices with known unpatchable vulnerabilities
- Primarily SOHO Internet routers and Microtik and QNAS NAS appliances
- 2 stage, the first stage survives reboots, the second stage does not
- Uses image files(no explanation I've seen so far, does this mean
steganography? Text files stored on image sites like Photobucket?)

Article from main Security team working with the US federal government
https://blog.talosintelligence.com/2018/05/VPNFilter.html

Additional info from Cisco/Talos
https://blogs.cisco.com/security/talos/vpnfilter

One posting how to identify whether you've been hacked (IMO YMMV)
https://a2alert.com/vpnfilter-malware-indicators-compromise/

Although the available information is very sketchy at the moment,
A few important bits of info are
- Review the security of your edge devices (Those exposed to the
Internet), particularly focusing on passwords.
- Change all default passwords on edge devices
- Don't use any easily guessed or commonly used passwords on edge devices.
- Don't forget devices where traffic is forwarded through your
Internet Router to devices like NAS within your network. Those should
be considered exposed as Internet devices as well.

Tony

[Kevin Keane Subscription]

Ars Technica explained the image file issue. Yes, it is a form of steganography. Specifically, the image file is a perfectly normal JPEG, except for the GPS location information in the EXIF data. The GPS location field is used to store six integers that the malware interprets as the IP address of the C&C server.

 
The malware looks for the image in two locations. First, in photobucket. If that fails, it looks for the image on the domain toknowall.com, which the FBI seized today. If that, too, fails, the device listens for inbound connections.

 
The second stage performs the actual spying. It also has the capability to overwrite the device’s firmware and then reboot, basically bricking the device.

 
https://arstechnica.com/information-technology/2018/05/hackers-infect-500000-consumer-routers-all-over-the-world-with-malware/

 
Sent from Mail for Windows 10

 
From: Tony Su <mailto:***@su-networking.com>
Sent: Thursday, May 24, 2018 9:25 AM
To: Main Discussion List for KPLUG <mailto:kplug-***@kernel-panic.org>
Subject: FYI - Massive Russian Malware network - "VPNfilter"

 


This morning,
Is the Security news of the day...
You can get more breaking news using the search term "vpnfilter" and
omit "vpn filter" results.

Summary
Est >500,000 devices already compromised
Current main attack focus is Ukraine
Almost no attack vector info, except that
- IoT devices with known unpatchable vulnerabilities
- Primarily SOHO Internet routers and Microtik and QNAS NAS appliances
- 2 stage, the first stage survives reboots, the second stage does not
- Uses image files(no explanation I've seen so far, does this mean
steganography? Text files stored on image sites like Photobucket?)

Article from main Security team working with the US federal government
https://blog.talosintelligence.com/2018/05/VPNFilter.html

Additional info from Cisco/Talos
https://blogs.cisco.com/security/talos/vpnfilter

One posting how to identify whether you've been hacked (IMO YMMV)
https://a2alert.com/vpnfilter-malware-indicators-compromise/

Although the available information is very sketchy at the moment,
A few important bits of info are
- Review the security of your edge devices (Those exposed to the
Internet), particularly focusing on passwords.
- Change all default passwords on edge devices
- Don't use any easily guessed or commonly used passwords on edge devices.
- Don't forget devices where traffic is forwarded through your
Internet Router to devices like NAS within your network. Those should
be considered exposed as Internet devices as well.

Tony


--
KPLUG-***@kernel-panic.org
http://www.kernel-panic.org/cgi-bin/mailman/listinfo/kplug-list