[mwchang]

VPNFilter Update - VPNFilter exploits endpoints, targets new devices
Full story: https://blog.talosintelligence.com/2018/06/vpnfilter-update.html

Introduction

Cisco Talos, while working with our various intelligence partners, has discovered additional details regarding "VPNFilter." In the days since we first published our findings on the campaign, we have seen that VPNFilter is targeting more makes/models of devices than initially thought, and has additional capabilities, including the ability to deliver exploits to endpoints. Talos recently published a blog about a broad campaign that delivered VPNFilter to small home-office network devices, as well as network-attached storage devices. As we stated in that post, our research into this threat was, and is, ongoing. In the wake of that post, we have had a number of partners step forward with additional information that has assisted us in our work. This post is an update of our findings over the past week.

.... more ....

Technical details

.... more ....



.... more ....


Known Affected Devices

The following devices are known to be affected by this threat. Based on the scale of this research, much of our observations are remote and not on the device, so it is difficult to determine specific version numbers and models in many cases.

Given our observations with this threat, we assess that this list may still be incomplete and other devices may be affected.

Asus Devices:

RT-AC66U (new)
RT-N10 (new)
RT-N10E (new)
RT-N10U (new)
RT-N56U (new)
RT-N66U (new)

D-Link Devices:

.... more ... **LONG LIST***

[jwh7]

This might be of interest, fwiw:

[Sam1789]

FIRST THIS OLD NEWS = Talos article is dated June 6th

SECOND Talos does NOT even touch on the attack modes. So we know next to nothing about how this "wonderful" 3 stage malware gets in to begin with.

Nothing seems to have been done to deal with the real issue which is how does the attack work. I've replied in dd-wt forums to previous posts like this one, noting the same glaring Talos etc omission. There have been good guesses by experts here. But nothing from Talos etc.

And note that the issue would seem to indicate that there is a multi-mode attack scenario. But that there has been NO information to allow us to conclude that dd-wrt Open-wrt etc are specifically vulnerable to an outside attack which can get around even the most rudimentary 3rd party FW security.

At the best we can guess that the actual attack is using vulnerabilities some probably known and some maybe here-to-fore unknown. And that infected devices (PC's etc) may also accomplish a LANside attack on routers, even if the router WAN side attack was unsuccessful. So the attack modes must also include attacking the PC devices directly. So is this just another "Phishing-click here-open this document" thing? Which then has a "wonderful" 3 stage malware package? Or is it something really more dangerous?

Talos NEEDS TO STEP UP and start working on the actual attack modes. Btw I'd suspect that at the least for some routers, their infection occurs from the devices connected to it's LAN side. And that would mean the attack has modes to both try to attack the routers WAN, and if that's not successful if it can infect a PC etc, then it will attack the router
from the LAN side.

It is kind of reassuring that there seem not to have been any infections of systems protected by routers with dd-wrt.

hth
SAm

[Alozaros]

[jwh7]