VPNFilter explained

VPNFilter is malware designed to infect routers and certain network attached storage devices. As of 24 May 2018, it is estimated to have infected approximately 500,000 routers worldwide, though the number of at-risk devices is larger.[1] It can steal data, contains a "kill switch" designed to disable the infected router on command, and is able to persist should the user reboot the router.[2] The FBI believes that it was created by the Russian Fancy Bear group. In February 2022, the CISA announced that a new malware called Cyclops Blink produced by Sandworm had replaced VPNFilter.[3]

Operation

VPNFilter is malware infecting a number of different kinds of network routers and storage devices. It seems to be designed in part to target serial networking devices using the Modbus protocol to talk to and control industrial hardware, as in factories and warehouses. The malware has special, dedicated code to target control systems using SCADA.[4]

The initial infection vector is still unknown. The Cisco Talos security group hypothesizes the malware exploits known router security vulnerabilities to infect devices.[5]

This software installs itself in multiple stages:

  1. Stage 1 involves a worm which adds code to the device's crontab (the list of tasks run at regular intervals by the cron scheduler on Linux). This allows it to remain on the device after a reboot, and to re-infect it with the subsequent stages if they are removed. Stage 1 uses known URLs to find and install Stage 2 malware. If those known URLs are disabled, Stage 1 sets up a socket listener on the device and waits to be contacted by command and control systems.[6]
  2. Stage 2 is the body of the malware, including the basic code that carries out all normal functions and executes any instructions requested by special, optional Stage 3 modules.
  3. Stage 3 can be any of various "modules" that tell the malware to do specific things, like sniffing network data, gathering credentials, serving as a relay point to hide the origin of subsequent attacks, or collecting data on industrial control devices (Modbus SCADA). Any exfiltrated data can then be encrypted via the Tor network.[4]

Mitigation

Both Cisco and Symantec suggest that people who own affected devices do a factory reset. That is typically accomplished by using a small, pointed object, such as a straightened out paperclip, to push the small reset button on the back on the unit for 10 to 30 seconds (time varies by model). This will remove the malware, but also restores the router to all original settings. If the router has remote management enabled, a factory reset will often disable this (the default setting of many routers). Remote management is thought to be one possible vector for the initial attack.

Before connecting the factory-reset router to the internet again, the device's default passwords should be changed to prevent reinfection.[7]

Devices at risk

The initial worm that installs VPNFilter can only attack devices running embedded firmware based on Busybox on Linux compiled only for specific processors. This does not include non-embedded Linux devices such as workstations and servers.

Manufacturer-provided firmware on the following router models is known to be at risk:[8] [6]

Asus
  • RT-AX92U
  • RT-AC66U
  • RT-N10
  • RT-N10E
  • RT-N10U
  • RT-N56U
  • RT-N66U
    D-Link
  • DES-1210-08P
  • DIR-300
  • DIR-300A
  • DSR-250N
  • DSR-500N
  • DSR-1000
  • DSR-1000N
    Huawei
  • HG8245
    Linksys
  • E1200
  • E2500
  • E3000
  • E3200
  • E4200
  • RV082
  • WRVS4400N
    Mikrotik
  • CCR1009
  • CCR1016
  • CCR1036
  • CCR1072
  • CRS109
  • CRS112
  • CRS125
  • RB411
  • RB450
  • RB750
  • RB911
  • RB921
  • RB941
  • RB951
  • RB952
  • RB960
  • RB962
  • RB1100
  • RB1200
  • RB2011
  • RB3011
  • RB Groove
  • RB Omnitik
  • STX5
  • Mikrotik RouterOS versions up to 6.38.5 on current or 6.37.5 on bugfix release chains[9]
    Netgear
  • DG834
  • DGN1000
  • DGN2200
  • DGN3500
  • FVS318N
  • MBRN3000
  • R6400
  • R7000
  • R8000
  • WNR1000
  • WNR2000
  • WNR2200
  • WNR4000
  • WNDR3700
  • WNDR4000
  • WNDR4300
  • WNDR4300-TN
  • UTM50
    QNAP
  • TS251
  • TS439 Pro
  • Other QNAP NAS devices running QTS software
    TP-Link
  • R600VPN
  • TL-WR741ND
  • TL-WR841N
    Ubiquiti
  • NSM2
  • PBE M5
    Upvel
  • Unknown Models [10]
    ZTE
  • ZXHN H108N

    Epidemiology

    VPNFilter is described by Cisco Talos as having infected as many as 500,000 devices worldwide,[11] in perhaps 54 different countries, though proportionately the focus has been on Ukraine.

    FBI investigation

    The FBI has taken a high-profile role in addressing this malware, conducting an investigation that resulted in the seizure of the domain name toknowall.com as ostensibly having been used to redirect queries from stage 1 of the malware, allowing it to locate and install copies of stages 2 and 3.[12] The US Justice Department also compelled the site Photobucket to disable known URLs used to distribute malware Stage 2.[5] [13]

    FBI recommendation on removing the infection

    On 25 May 2018, the FBI recommended that users reboot their at-risk devices.[14] This would temporarily remove the stages 2 and 3 of the malware. Stage 1 would remain, leading the router to try re-downloading the payload and infecting the router again. However, prior to the recommendation the US Justice Department seized web endpoints the malware uses for Stage 2 installation.

    Without these URLs, the malware must rely on the fallback socket listener for Stage 2 installation. This method requires threat actor command and control systems to contact each system to install Stage 2, increasing the threat actor's risk of being identified.[5] The FBI further recommended users disable remote management on their devices and update the firmware. A firmware update removes all stages of the malware, though it is possible the device could be reinfected.[14]

    The FBI said that this would help them to find the servers distributing the payload.[15] [16] [17]

    See also

    Notes and References

    1. News: VPNFilter Update and Our First Summit Recap. 2018-06-21. Cisco Talos Intelligence . 2018-06-26. en-US.
    2. News: VPNFilter state-affiliated malware pose lethal threat to routers. 2018-05-24. SlashGear. 2018-05-31. en-US.
    3. Web site: New Sandworm Malware Cyclops Blink Replaces VPNFilter CISA . 2022-06-27 . www.cisa.gov.
    4. https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/vpnfilter-iot-malware VPNFilter: New Router Malware with Destructive Capabilities
    5. News: VPNFilter, the Unfiltered Story. 2018-05-29. Talos. 2018-06-26. en-US.
    6. Web site: VPNFilter Update - VPNFilter exploits endpoints, targets new devices . 6 June 2018 . William Largent . en.
    7. News: Security Advisory for VPNFilter Malware on Some NETGEAR Devices. 2018-06-06. Netgear. 2018-06-26. en-US.
    8. News: VPNFilter: New Router Malware with Destructive Capabilities. 2018-05-31. en.
    9. Web site: VPNfilter official statement - MikroTik. forum.mikrotik.com. en-gb. 2018-05-31.
    10. Malware targeting Upvel as a vendor has been discovered, but we are unable to determine which specific device it is targeting.
    11. News: Hackers infect 500,000 consumer routers all over the world with malware. Ars Technica. 2018-05-31. en-us.
    12. https://www.zdnet.com/article/fbi-to-all-router-users-reboot-now-to-neuter-russias-vpnfilter-malware/ FBI to all router users: Reboot now to neuter Russia's VPNFilter malware
    13. Web site: AFFIDAVIT IN SUPPORT OF AN APPLICATION FOR A SEIZURE WARRANT. 22 May 2018.
    14. Web site: FOREIGN CYBER ACTORS TARGET HOME AND OFFICE ROUTERS AND NETWORKED DEVICES WORLDWIDE. 25 May 2018.
    15. Web site: FBI tells router users to reboot now to kill malware infecting 500k devices . 25 May 2018 . Ars Technica . Dan Goodin.
    16. Web site: Hackers infect 500,000 consumer routers all over the world with malware . Dan Goodin . Ars Technica . 24 May 2018.
    17. Web site: Exclusive: FBI Seizes Control of Russian Botnet . Daily Beast . Kevin Poulsen . 23 May 2018.

    This article is licensed under the GNU Free Documentation License. It uses material from the Wikipedia article "VPNFilter".

    Except where otherwise indicated, Everything.Explained.Today is © Copyright 2009-2024, A B Cryer, All Rights Reserved. Cookie policy.