Can this happen here? Ubiquiti routers fixed by DOJ?
-
Ars Technica article from today (02/16/2024) DOJ quietly removed Russian malware from routers in US homes and businesses.
How likely is it that there is a botnet army out there running on pfSense hardware?
-
@DominikHoffmann according to the article the devices were using the default admin password. With that open door anything is possible.
"it affected routers running Ubiquiti's EdgeOS, but only those that had not changed their default administrative password"
-
@ahking19 In that vein, I just noted that Netgate /pfSense will force admin password change from default on 34.03 when it is released. In my view, this is in keeping with a larger international effort called "Secure by Design".
Ted
-
The two things that were required to make this a problem were
- users failing to change the default password (and software that failed to make them do so);
- management functionality accessible from the WAN by default
Ubiquiti has some excuse for the latter, in that remote management is something they push pretty hard; but I sure hope pfSense doesn't do that.
-
@tgl I would argue that having remote WAN access enabled by default combined with a generic default password is completely incompetent and literally begging to be exploited.
-
@KOM The other troubling part is how DOJ supposedly, "quietly fixed it for U.S homes and businesses."
-
@DominikHoffmann second time this month I think unless it’s a story about the last one. Generally the router has to be accessible as mentioned either from WAN unless they get control of a PC on LAN.
On the one I’m thinking of it sounded like they essentially used a hosts file entry to disable it, blocked the exploit, and will have ISPs notify users.
-
Usually they take down the C&C infrastructure so that exploited devices no longer receive any instructions.
-
@stephenw10 this is the timing but I couldn’t find the article I read, which had more detail.
https://www.malwarebytes.com/blog/news/2024/02/fbi-removes-malware-from-hundreds-of-routers-across-the-us -
@SteveITS Thanks for the link. I saw similar references in the ICS CERT RSS feed. Interesting world we have.
Ted
