Just in the case you have not heard the news of the past week, There is a warning issued by the FBI about a potential malware threat to routers. https://www.washingtonpost.com/news/powerpost/paloma/the-cybersecurity-202/2... While I did try to dig deeper on this over the weekend, I could not obtain the grimy details. But it looks like a sleeper so you might want to do due diligence and reset your router to clear the ram. When I say sleeper, I mean it has yet to perform new duties so it might not affect anything now. I'm clearing all of mine once a day till I find out more. Just a FYI. ...mike/kb8jnm
More information here: https://blog.talosintelligence.com/2018/05/VPNFilter.html On Thu, May 31, 2018 at 9:20 AM, Mike <mm@midnighteng.com> wrote:
Just in the case you have not heard the news of the past week,
There is a warning issued by the FBI about a potential malware threat to routers.
https://www.washingtonpost.com/news/powerpost/paloma/the-cyb ersecurity-202/2018/05/24/the-cybersecurity-202-the-fbi-is- trying-to-thwart-a-massive-russia-linked-hacking-campaign/5b 058e921b326b492dd07e55/?utm_term=.3ecb87d65a41
While I did try to dig deeper on this over the weekend, I could not obtain the grimy details.
But it looks like a sleeper so you might want to do due diligence and reset your router to clear the ram.
When I say sleeper, I mean it has yet to perform new duties so it might not affect anything now.
I'm clearing all of mine once a day till I find out more. Just a FYI.
...mike/kb8jnm
_______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users
To unsubscribe from this list please visit http://lists.allstarlink.org/c gi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.
It is a threat to anyone who doesn't maintain a strong login credential set and/or who doesn't update firmware. If you do both these, you are very unlikely to have been infected. No harm in a reboot (for many reasons) however daily may not be needed. Remember, firmware updates patch known vulnerability issues that these malware infections exploit. On Thu, May 31, 2018, 08:20 Mike <mm@midnighteng.com> wrote:
Just in the case you have not heard the news of the past week,
There is a warning issued by the FBI about a potential malware threat to routers.
https://www.washingtonpost.com/news/powerpost/paloma/the-cybersecurity-202/2...
While I did try to dig deeper on this over the weekend, I could not obtain the grimy details.
But it looks like a sleeper so you might want to do due diligence and reset your router to clear the ram.
When I say sleeper, I mean it has yet to perform new duties so it might not affect anything now.
I'm clearing all of mine once a day till I find out more. Just a FYI.
...mike/kb8jnm
_______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users
To unsubscribe from this list please visit http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.
Not entirely correct see inline.... On Thu, May 31, 2018 at 10:43 AM, Bryan St Clair <bryan@k6cbr.us> wrote:
It is a threat to anyone who doesn't maintain a strong login credential set and/or who doesn't update firmware. If you do both these, you are very unlikely to have been infected.
Not entirely accurate, there were 0days involved in this.. that means that the threat existed and was being exploited before a patch / firmware update was released.
No harm in a reboot (for many reasons) however daily may not be needed.
Agreed, and a reboot only clears the non-persistent mechanisms. And rest assured mechanisms exist for persistence...
Remember, firmware updates patch known vulnerability issues that these malware infections exploit.
Correct "known" being the keyword, see comment #1
On Thu, May 31, 2018, 08:20 Mike <mm@midnighteng.com> wrote:
Just in the case you have not heard the news of the past week,
There is a warning issued by the FBI about a potential malware threat to routers.
https://www.washingtonpost.com/news/powerpost/paloma/the- cybersecurity-202/2018/05/24/the-cybersecurity-202-the-fbi- is-trying-to-thwart-a-massive-russia-linked-hacking-campaign/ 5b058e921b326b492dd07e55/?utm_term=.3ecb87d65a41
While I did try to dig deeper on this over the weekend, I could not obtain the grimy details.
But it looks like a sleeper so you might want to do due diligence and reset your router to clear the ram.
When I say sleeper, I mean it has yet to perform new duties so it might not affect anything now.
I'm clearing all of mine once a day till I find out more. Just a FYI.
...mike/kb8jnm
_______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users
To unsubscribe from this list please visit http://lists.allstarlink.org/ cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.
_______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users
To unsubscribe from this list please visit http://lists.allstarlink.org/ cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.
They don't make patches for something that hasn't been exploited yet. That's why a day 0 exists. This started in 2016... The affected models are older and I would bet, behind in updates. Updates don't protect everything, just what was known in the past. 2016 is the past. A good reason why it's tageted the Linksys, MikroTik, NETGEAR and TP-Link devices is their low update rate. Not the manufacturer, but the consumer. On Thu, May 31, 2018, 10:06 JJC <cummingsj@gmail.com> wrote:
Not entirely correct see inline....
On Thu, May 31, 2018 at 10:43 AM, Bryan St Clair <bryan@k6cbr.us> wrote:
It is a threat to anyone who doesn't maintain a strong login credential set and/or who doesn't update firmware. If you do both these, you are very unlikely to have been infected.
Not entirely accurate, there were 0days involved in this.. that means that the threat existed and was being exploited before a patch / firmware update was released.
No harm in a reboot (for many reasons) however daily may not be needed.
Agreed, and a reboot only clears the non-persistent mechanisms. And rest assured mechanisms exist for persistence...
Remember, firmware updates patch known vulnerability issues that these malware infections exploit.
Correct "known" being the keyword, see comment #1
On Thu, May 31, 2018, 08:20 Mike <mm@midnighteng.com> wrote:
Just in the case you have not heard the news of the past week,
There is a warning issued by the FBI about a potential malware threat to routers.
https://www.washingtonpost.com/news/powerpost/paloma/the-cybersecurity-202/2...
While I did try to dig deeper on this over the weekend, I could not obtain the grimy details.
But it looks like a sleeper so you might want to do due diligence and reset your router to clear the ram.
When I say sleeper, I mean it has yet to perform new duties so it might not affect anything now.
I'm clearing all of mine once a day till I find out more. Just a FYI.
...mike/kb8jnm
_______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users
To unsubscribe from this list please visit http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.
_______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users
To unsubscribe from this list please visit http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.
_______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users
To unsubscribe from this list please visit http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.
Wrong, I had to reread this.. what they don't make patches for are things that have not been discovered as being exploited yet... The fact that it's being exploited does not mean that it's known or disclosed. I am quite aware of when this started - the rest of your statement I pretty much agree with though ;-) On Thu, May 31, 2018 at 11:13 AM, Bryan St Clair <bryan@k6cbr.us> wrote:
They don't make patches for something that hasn't been exploited yet. That's why a day 0 exists.
This started in 2016...
The affected models are older and I would bet, behind in updates.
Updates don't protect everything, just what was known in the past. 2016 is the past.
A good reason why it's tageted the Linksys, MikroTik, NETGEAR and TP-Link devices is their low update rate. Not the manufacturer, but the consumer.
On Thu, May 31, 2018, 10:06 JJC <cummingsj@gmail.com> wrote:
Not entirely correct see inline....
On Thu, May 31, 2018 at 10:43 AM, Bryan St Clair <bryan@k6cbr.us> wrote:
It is a threat to anyone who doesn't maintain a strong login credential set and/or who doesn't update firmware. If you do both these, you are very unlikely to have been infected.
Not entirely accurate, there were 0days involved in this.. that means that the threat existed and was being exploited before a patch / firmware update was released.
No harm in a reboot (for many reasons) however daily may not be needed.
Agreed, and a reboot only clears the non-persistent mechanisms. And rest assured mechanisms exist for persistence...
Remember, firmware updates patch known vulnerability issues that these malware infections exploit.
Correct "known" being the keyword, see comment #1
On Thu, May 31, 2018, 08:20 Mike <mm@midnighteng.com> wrote:
Just in the case you have not heard the news of the past week,
There is a warning issued by the FBI about a potential malware threat to routers.
https://www.washingtonpost.com/news/powerpost/paloma/the- cybersecurity-202/2018/05/24/the-cybersecurity-202-the-fbi- is-trying-to-thwart-a-massive-russia-linked-hacking-campaign/ 5b058e921b326b492dd07e55/?utm_term=.3ecb87d65a41
While I did try to dig deeper on this over the weekend, I could not obtain the grimy details.
But it looks like a sleeper so you might want to do due diligence and reset your router to clear the ram.
When I say sleeper, I mean it has yet to perform new duties so it might not affect anything now.
I'm clearing all of mine once a day till I find out more. Just a FYI.
...mike/kb8jnm
_______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users
To unsubscribe from this list please visit http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.
_______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users
To unsubscribe from this list please visit http://lists.allstarlink.org/ cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.
_______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users
To unsubscribe from this list please visit http://lists.allstarlink.org/ cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.
_______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users
To unsubscribe from this list please visit http://lists.allstarlink.org/ cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.
I am pretty sure this is aimed at people that either leave them blank or set to ADMIN for the user and PASSWORD for the password.... Some "DON'TS".... Use your pets name for a password.... Use your callsign for a user name..... Some Common Sense and all is well.... On Thu, May 31, 2018 at 9:43 AM, Bryan St Clair <bryan@k6cbr.us> wrote:
It is a threat to anyone who doesn't maintain a strong login credential set and/or who doesn't update firmware. If you do both these, you are very unlikely to have been infected.
No harm in a reboot (for many reasons) however daily may not be needed.
Remember, firmware updates patch known vulnerability issues that these malware infections exploit.
On Thu, May 31, 2018, 08:20 Mike <mm@midnighteng.com> wrote:
Just in the case you have not heard the news of the past week,
There is a warning issued by the FBI about a potential malware threat to routers.
https://www.washingtonpost.com/news/powerpost/paloma/the- cybersecurity-202/2018/05/24/the-cybersecurity-202-the-fbi- is-trying-to-thwart-a-massive-russia-linked-hacking-campaign/ 5b058e921b326b492dd07e55/?utm_term=.3ecb87d65a41
While I did try to dig deeper on this over the weekend, I could not obtain the grimy details.
But it looks like a sleeper so you might want to do due diligence and reset your router to clear the ram.
When I say sleeper, I mean it has yet to perform new duties so it might not affect anything now.
I'm clearing all of mine once a day till I find out more. Just a FYI.
...mike/kb8jnm
_______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users
To unsubscribe from this list please visit http://lists.allstarlink.org/ cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.
_______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users
To unsubscribe from this list please visit http://lists.allstarlink.org/ cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.
participants (4)
-
Bryan St Clair -
JJC -
Kirk Just Kirk -
Mike