06/13/2018
It's still in the news. The VPNFilter malware thought to have ties to the Russian government appears to have affected a lot more devices than originally reported. At first it was reported to have affected tens of thousands and maybe hundreds of thousands of devices. The FBI is now reporting up to one million and counting affecting almost one hundred types of home and small office routers (the devices you and I use).
https://www.scmagazineuk.com/vpnfilter-malware-far-more-extensive-than-first-thought/article/772802/
Routers known to be vulnerable
This long list contains the consumer routers known to be susceptible to VPNFilter. If your model appears on this list it is suggested you follow the procedures in the next section of this article. Devices in the list marked as "new" are routers that were only recently found to be vulnerable.
Asus Devices:
RT-AC66U (new)
RT-N10 (new)
RT-N10E (new)
RT-N10U (new)
RT-N56U (new)
D-Link Devices:
DES-1210-08P (new)
DIR-300 (new)
DIR-300A (new)
DSR-250N (new)
DSR-500N (new)
DSR-1000 (new)
DSR-1000N (new)
Huawei Devices:
HG8245 (new)
Linksys Devices:
E1200
E2500
E3000 (new)
E3200 (new)
E4200 (new)
RV082 (new)
WRVS4400N
Mikrotik Devices:
CCR1009 (new)
CCR1016
CCR1036
CCR1072
CRS109 (new)
CRS112 (new)
CRS125 (new)
RB411 (new)
RB450 (new)
RB750 (new)
RB911 (new)
RB921 (new)
RB941 (new)
RB951 (new)
RB952 (new)
RB960 (new)
RB962 (new)
RB1100 (new)
RB1200 (new)
RB2011 (new)
RB3011 (new)
RB Groove (new)
RB Omnitik (new)
STX5 (new)
Netgear Devices:
DG834 (new)
DGN1000 (new)
DGN2200
DGN3500 (new)
FVS318N (new)
MBRN3000 (new)
R6400
R7000
R8000
WNR1000
WNR2000
WNR2200 (new)
WNR4000 (new)
WNDR3700 (new)
WNDR4000 (new)
WNDR4300 (new)
WNDR4300-TN (new)
UTM50 (new)
QNAP Devices:
TS251
TS439 Pro
Other QNAP NAS devices running QTS software
TP-Link Devices:
R600VPN
TL-WR741ND (new)
TL-WR841N (new)
Ubiquiti Devices:
NSM2 (new)
PBE M5 (new)
ZTE Devices:
ZXHN H108N (new)
**INSTRUCTIONS BELOW SHOULD ONLY BE PERFORMED BY A TECHNICIAN**
**FOLLOW THESE INSTRUCTIONS AT YOUR OWN RISK**
**PERFORMING THE FOLLWING INSTRUCTIONS MAY DISABLE YOUR INTERNET, TV, AND PHONE SERVICES**
**I enjoy sharing technical solutions for those that wish to do their own repairs but I can't stress the importance of having a technician do the work for you if you don't want the risk of frustration and the cost of lost time in trying to do this yourself. Sometimes it's just easier and faster to have someone else do it for you. However, if you decide to try this on your own please understand it may not work for you as expected and may be even more difficult for you to fix on your own. If it does work for you, you've been able to save yourself a few bucks!**
**PERFORM AT YOUR OWN RISK**
Right now, as soon as you're able, you should reboot your router. To do this simply unplug it from the power supply for 30 seconds then plug it back in. Many models of router flush installed apps when they are power cycled.
The next step is to factory reset your router. You'll find information about how to do this in the manual that came in the box or from the manufacturer's website. This usually involves inserting a pin into a recessed hole to press a microswitch. When you get your router back up and running, you need to ensure it is on the very latest version of its firmware. Again, consult the documentation that came with your router for details on how to update.
Next, perform a quick security audit of how you're using your router.
-Never use the default user name and password to administer it. All routers of the same model will use that default name and password and that makes for an easy way to alter settings or install malware.
-Never expose any internal devices to the internet without a strong firewall in place. This includes things like FTP servers, NAS servers, Plex Servers or any smart device. If you must expose any connected device outside your internal network you can likely use port filtering and forwarding software. If not, invest in a strong hardware or software firewall.
-Never leave remote administration enabled. It may be convenient if you're often away from your network but it's a potential attack point that every hacker knows to look for.
-Always stay up to date. This means check for new firmware regularly, and more importantly, be sure to install it if it is available.
Finally, if you're unable to update the firmware to prevent VPNFilter from becoming installed (your manufacturer's website will have details) just buy a new one. I know that spending money to replace a perfectly good and working router is a bit extreme, but you will have no idea if your router is infected unless you're a person who doesn't need to read these sort of tips.
***The information provided above came from this article:
https://www.androidcentral.com/vpnfilter-malware
While the information in this article is extremely helpful, it's pretty clear they're pushing a specific product as a replacement. I don't want you to think that I am suggesting this as the preferred router replacement. While it's a good replacement, there are many other good replacements as well.
If you have any questions, need help with your router, or simply need to schedule a service with us we can help you remotely or come out to your home or office. We can be reached 7 days a week at 888.931.0942.
Giant IoT botnet malware targeting routers keeps getting worse, with an ever-expanding list of devices vulnerable to attack.
