Remember that Russian router malware warning from last week? The situation is even worse than we originally thought, and a whole lot more router owners are going to have to factory-reset their devices and install firmware updates. Discover all of today's best VPN picks Not only are many more Linksys, MicroTik, Netgear and TP-Link routers vulnerable to the VPNFilter malware, according a report today (June 6) from Cisco Talos labs, but several Asus and D-Link models are now also thought to be vulnerable, as well as a couple of Ubiquiti routers and individual Huawei, Upvel and ZTE devices. In all, nearly 70 devices are impacted, including QNAP network-attached-storage drives. The malware itself has a previously unnoticed capability: It can stage a man-in-the-middle attack on your web traffic, altering what you see online and possibly hiding other nefarious deeds. "They can manipulate everything going through the compromised device," a Cisco Talos researcher told Ars Technica. "They can modify your bank-account balance so that it looks normal while at the same time they're siphoning off money." How to Protect Yourself To really be protected from VPNFilter, you need to first fully update your router's firmware, then write down all your Wi-Fi network names and passwords, and finally factory-reset your router. Once you've done all that, change the router's administrative username and password, then recreate the original network names and access passwords so that your Wi-Fi-enabled devices can reconnect without trouble. Router update and reset methods vary widely from brand to brand, but we've added links to instructions where we could. The full list of models known to be affected is below. MORE: Your Router's Security Stinks: Here's How to Fix It To be safe, ALL routers ought to be updated and factory-reset because of the VPNFilter malware, despite that being an arduous process, because we don't know where this is going to end. (If you're wondering why we're so insistent, it's because the malware has a scorched-earth module that will brick your router on command.) The malware seems to infect only devices that are known to have had security flaws, all of which have fixes available. If you've kept up on your router patches, or your router patches itself automatically, you probably haven't been infected. Unfortunately, there's no way of knowing for sure. Only a factory reset will remove the malware, which contains a beachhead module that survives regular reboots; only firmware patches will prevent you from being infected again. Ten days ago, the FBI took down a server from which the beachhead module got instructions to download additional malware components, but it appears that a fallback mechanism lets the beachhead module use other sources. Affected Routers and Support Pages Here's the list of affected devices. Not all devices are sold in North America: Asus RT-AC66U Asus RT-N10 Asus RT-N10E Asus RT-N10U Asus RT-N56U Asus RT-N66U Asus support page D-Link DES-1210-08P D-Link DIR-300 D-Link DIR-300A D-Link DSR-250N D-Link DSR-500N D-Link DSR-1000 D-Link DSR-1000N D-Link support page specifically for VPNFilter Huawei HG8245 Unofficial reset instructions; we couldn't find the firmware Linksys E1200 Linksys E2500 Linksys E3000 Linksys E3200 Linksys E4200 Linksys RV082 Linksys WRVS4400N Linksys support page MikroTik CCR1009 MikroTik CCR1016 MikroTik CCR1036 MikroTik CCR1072 MikroTik CRS109 MikroTik CRS112 MikroTik CRS125 MikroTik RB411 MikroTik RB450 MikroTik RB750 MikroTik RB911 MikroTik RB921 MikroTik RB941 MikroTik RB951 MikroTik RB952 MikroTik RB960 MikroTik RB962 MikroTik RB1100 MikroTik RB1200 MikroTik RB2011 MikroTik RB3011 MikroTik RB Groove MikroTik RB Omnitik MikroTik STX5 MicroTik support page, which is pretty confusing Netgear DG834 Netgear DGN1000 Netgear DGN2200 Netgear DGN3500 Netgear FVS318N Netgear MBRN3000 Netgear R6400 Netgear R7000 Netgear R8000 Netgear WNR1000 Netgear WNR2000 Netgear WNR2200 Netgear WNR4000 Netgear WNDR3700 Netgear WNDR4000 Netgear WNDR4300 Netgear WNDR4300-TN Netgear UTM50 Netgear support page QNAP TS251 QNAP TS439 Pro Other QNAP NAS devices running QTS software QNAP firmware download page TP-Link R600VPN TP-Link TL-WR741ND TP-Link TL-WR841N TP-Link support page Ubiquiti NSM2 Ubiquiti PBE M5 Ubiquiti firmware and documentation Upvel -- unknown models Upvel firmware downloads (in Russian) ZTE Devices ZXHN H108N ZTE support page<doc-sep>The FBI is urging anyone who has a wireless router at home or in a small business to protect against a crippling virus linked to Russian hackers after more than half a million devices were compromised. TODAY investigative correspondent Jeff Rossen gave a simple fix on Wednesday for anyone who has wireless internet to protect against the malware, which is called VPNFilter. Anyone with a home router should reboot it immediately by unplugging it from the wall, waiting 30 seconds and plugging it back in. The FBI and security experts believe that simple maneuver can disrupt the virus and protect against the threat. The FBI and security experts are urging anyone with a wireless router to protect against a virus linked to Russian hackers. Getty Images Get Jeff Rossen's new book, "Rossen to the Rescue," here The FBI, which issued an urgent bulletin on May 25 about the attack, is also recommending that everyone should reset their Wi-Fi network password, especially if you haven't changed it or updated the firmware since buying the router. The virus allows hackers to potentially collect personal information and data from your online activities, as well as block your web traffic and possibly make your router inoperable, the FBI said. Devices manufactured by Linksys, MikroTik, Netgear and TP-Link were among those found to have been affected, according to a report by the security arm of Cisco. "If you have an older router, the odds are greater it may have shipped with a standard password which is the same across all types of the device. Change the router password, make sure the firmware is update and in some cases, even replace the router," Shuman Ghosemajumder, chief technology officer at Shape Security, told NBC News.<doc-sep>The FBI made a bombshell announcement on Friday that is only starting to gain a bit of traction over the weekend. Russian hackers have developed a sophisticated malware system that has already infected hundreds of thousands of routers. The good news is that the recommendation on how to combat the infection is easy enough—turn it off and then turn it back on again. Anyone who has a home or small office router should go ahead and do that just to be safe. Advertisement “Foreign cyber actors have compromised hundreds of thousands of home and office routers and other networked devices worldwide,” the FBI said in its Friday public service announcement. “The malware is able to perform multiple functions, including possible information collection, device exploitation, and blocking network traffic.” On Wednesday, the FBI received a court order allowing it to seize a website that was allegedly going to be used to direct the hacked routers. While that move “cut off malicious communications, it still left the routers infected, and Friday’s warning was aimed at cleaning up those machines,” explains Reuters. To obtain the court order, the Justice Department said the hackers were part of a group called Sofacy, which also goes by the name A.P.T. 28 and Fancy Bear and is believed to be directed by Russia’s military intelligence agency. It is the same group that hacked the Democratic National Committee shortly before the 2016 presidential election, notes the New York Times. Advertisement Advertisement Advertisement Cisco’s Talos security team first revealed the existence of the malware on Wednesay and said more than 500,000 devices in at least 54 countries had been infected by the malware, known as VPNFilter. Devices made by Linksys, MikroTik, NETGEAR, TP-Link, and QNAP network-attached storage (NAS) devices are just a few of the manufacturers known to have been infected. Symantec published a list of devices that are known to be vulnerable to VPNFilter: Linksys E1200 Linksys E2500 Linksys WRVS4400N Mikrotik RouterOS for Cloud Core Routers: Versions 1016, 1036, and 1072 Netgear DGN2200 Netgear R6400 Netgear R7000 Netgear R8000 Netgear WNR1000 Netgear WNR2000 QNAP TS251 QNAP TS439 Pro Other QNAP NAS devices running QTS software TP-Link R600VPN Advertisement In addition to rebooting routers, the FBI is also recommending users to disable remote management settings, upgrade the firmware of their devices, and update their passwords. Although the FBI’s advice is good enough, if you want to be extra careful you should follow Cisco’s suggestion to perform a factory reset in order to fully remove the malware from your router. “This generally involves using a paper clip or thumb tack to hold down a button on the back of the device for 5 seconds,” explains Ars Technica. “The reset will remove any configuration settings stored on the device, so users will have to restore those settings once the device initially reboots.”<doc-sep>
As millions of Americans unplugged for Memorial Day Weekend, the FBI issued an urgent bulletin for anyone with a home or small office internet router to immediately turn it off and then turn it on again as a way to temporarily thwart the spread of foreign malware linked to Russia. The malware, called VPNFilter, targets small home and office routers. Once a router is infected, the hackers would potentially be able to use the device as a jumping-off point to launch further attacks. The cybercriminals could also collect personal information, block network traffic — or just turn your router into an expensive brick. “More than half a million routers have been identified already as being compromised, so I think there are a significant number of devices that have been affected and it is difficult to estimate how many devices could be affected in the coming days or week,” Shuman Ghosemajumder, chief technology officer at Shape Security told NBC News. The 500,000 affected devices Ghosemajumder mentioned come from an analysis performed by Talos, the security arm of Cisco. The company also found the attack present in at least 54 countries. Devices manufactured by Linksys, MikroTik, Netgear and TP-Link were among those found to have been affected, according to the Talos report. While the initial point of infection is unknown for VPNFilter, it has been quietly spreading since at least 2016, according to researchers. Many of the infected devices have known public exploits and use default credentials, meaning that customers who set up their home router out of the box and never changed the password or updated the firmware could be at a higher risk. “If you have an older router, the odds are greater it may have shipped with a standard password which is the same across all types of the device. Change the router password, make sure the firmware is update and in some cases, even replace the router,” Ghosemajumder said. But here’s the catch: There’s no easy way to know if a device has been infected. The Department of Justice — which has already linked the malware to a hacking group going by various names, including the Sofacy Group, apt28, fancy bear, and sandworm — last week announced the seizure of a domain name used as a central part of VPNFilter’s “command-and-control infrastructure.” The court-ordered seizure will allow authorities to begin to identify targeted devices while also disrupting “the ability of these hackers to steal personal and other sensitive information and carry out disruptive cyberattacks,” said Scott Brady, U.S. attorney for the Western District of Pennsylvania. The threat is in the process of being disrupted, but people who own the vulnerable routers, or want to take some precautions, can also help minimize the spread of the malware, according to security experts who spoke with NBC News. “Resetting will minimize some of the risk, because some portion of the attack may be deleted after rebooting,” Oren Aspir, chief technology officer at Cyberbit, told NBC News. A quick power switch is a necessary step, experts said, but they warned that it is not a foolproof fix. Talos recommends resetting the router to factory settings, a process that can be started on most routers by finding a small button on the device — sometimes only accessible with a thin, sharp object — that can be used to hold down the button and reset the router to factory settings. From there, users can go through the administrative process of setting up the router again and, most important, changing the factory default password. Authorities and security researchers have both said there are many unknown questions when it comes to VPNFilter, including the intentions of the Russia-linked group believed to be perpetrating the attack. While it can be a nuisance and a privacy threat to individuals, the scope of the malware could be used for a larger attack, said Guy Caspi, CEO and founder of security company Deep Instinct. “If this is addressed broadly, it will cause the malware campaign to lose a lot of its access and reduce the broader risk on a macro level,” he said.