The Anti-virus Times

Tuesday, September 25, 2018

New entries for Linux.VPNFilter Trojans appear daily in the Dr.Web virus database.

Just what kind of beast are we talking about?

VPNFilter malware infects networking devices, such as routers and network-attached storages (NAS), rather than desktops and laptops.

Why are hackers specifically interested in networking devices? The answer is simple: while personal computers may receive updates every now and then, few people make an effort to download updates for their household networking devices regularly. As a result, attackers don't have to look for new unknown vulnerabilities. Instead, they can pick a loophole the manufacturer already knows about and has even patched (e.g., in a new firmware release), but criminals can still exploit it.

Furthermore, situations when updates are never applied provide perpetrators with another advantage. Vulnerability patch release notes often contain information about the very vulnerability being addressed. But even if they don't, an update release gives attackers an opportunity to analyse the patch and find another weak point.

Following the discovery of the VPNFilter botnet, the FBI seized control over the criminal-managed toknowall.com domain. The bureau set up a sinkhole to gain control over the network's command and control server—we talked about that in the issue Fishing for bots. Later, the instructions were published to help router owners get rid of the VPNFilter infection. The malware's authorship was attributed to Russian Fancy Bear hackers, who were also allegedly responsible for the attack on the Democratic National Committee's infrastructure during the US presidential elections in 2016.

As a matter of fact, we didn't write our issue about that just because the agency managed to hijack the server. However, time has shown that we should have gone through with the publication. How badly does a server hijacking cripple a criminal-run business? And how many people would have read our post and taken the appropriate steps to remove the infection? Predictably, the botnet survived, and the cyber crooks behind it keep enrolling other nodes in it.

What do criminals gain from VPNFilter? It lets them monitor data transmitted via the routers and storages. They can fish out passwords from the traffic, inject scripts and ads into webpages being loaded by users, and trigger malware downloads. Or threaten users with a forced network disconnection and demand a ransom.

And rebooting devices—a popular troubleshooting technique among users—doesn't help. VPNFilter survives a system restart.

And it's not only going after home devices…

Who can be affected?

But new items can appear on the list at any moment.

If you think about it, this is a horrendous threat. You’ve installed an anti-virus and keep it updated. And then you decide to read the news, for example. But chances are that you will only see whatever it is the perpetrators want you to read. And you won't be able to do anything about it since the sites containing instructions on how to deal with the problem suddenly become inaccessible.

#Linux #vulnerability #botnet #router #Parental_Control #malware