Bottom line: Remember VPNFilter, the multi-step router malware that was discovered last month? Cisco researchers said they have infected more than 50,000 devices in more than 50 countries, prompting the FBI to recommend that all users restart their routers. As bad as it sounds, it seems that VPNFilter is even worse than people thought.
We already knew that malicious software, which is supposed to come from Russia, can collect data, infect other devices, steal identification information and even destroy a device by overwriting a critical part of it. its firmware. Cisco Talos has now discovered a new Step 3 module that can bypass SSL encryption by intercepting outgoing Web requests and turning them into unencrypted HTTP, which helps to steal sensitive data.
In addition, the new module can use man-in-the-middle attacks to inject malicious content into web traffic. Another newly discovered feature is the ability of malware to infect other devices, including PCs on the same local network.
It seems that more routers are affected than what we previously thought. A handful of devices from Linksys, MikroTik, Netgear, QNAP, and TP-Link were originally said to be the only vulnerable, but it seems more models of these brands, with routers of Asus, D-Link, Huawei, Ubiquiti, Upvel and ZTE, are also at risk. You can see the complete list at the bottom of this page.
Although VPNFilter primarily targets routers in Ukraine, suggesting political motivation, it is strongly recommended that all owners of affected routers update their firmware or perform a factory reset.
[ad_2]
Source link