An unknown threat actor with equally unknown motives forces ISP to replace routers.
  • subtext@lemmy.worldEnglish
    0·
    6 months ago

    One day last October, subscribers to an ISP known as Windstream

    In case anyone only reads the headline

  • KaRunChiy@kbin.run
    0·
    6 months ago

    Oh shit, I use Windstream, this explains a lot about why they were so busy replacing everyones routers down here. I had assumed it was just a defective design since they used all the same units for every network, but it was actually malware, wild

  • zelifcam@lemmy.worldEnglish
    0·
    6 months ago

    Mystery malware destroys 600,000 routers

    “Mystery”

    The actor took deliberate steps to cover their tracks by using commodity malware known as Chalubo, rather than a custom-developed toolkit. A feature built into Chalubo allowed the actor to execute custom Luascripts on the infected devices. The researchers believe the malware downloaded and ran code that permanently overwrote the router firmware.

    So… not a “mystery.”

      • redcalcium@lemmy.instituteEnglish
        0·
        6 months ago

        I imagine the malware binary includes a lua interpreter for executing scripts fetched from its command and control server.

      • Max-P@lemmy.max-p.meEnglish
        0·
        6 months ago

        OpenWRT uses Lua for its web UI. The interpreter can be really small which works well for tiny embedded devices with mere megabytes of storage, and it’s much safer than writing a web GUI entirely in C.

        • StarDreamer@lemmy.blahaj.zoneEnglish
          0·
          6 months ago

          Yeah I completely forgot about the consumer side of things. I was expecting there being Cisco iOS/FRR router configs, not a full web dashboard.

    • subtext@lemmy.worldEnglish
      0·
      6 months ago

      It’s possible the “mystery” they refer to could be related to the identity of the hacker(s), how it got onto the routers in the first place, or the purpose for the attack

          • zelifcam@lemmy.worldEnglish
            0·
            6 months ago

            The second unique aspect is that this campaign was confined to a particular ASN. Most previous campaigns we’ve seen target a specific router model or common vulnerability and have effects across multiple providers’ networks. In this instance, we observed that both Sagemcom and ActionTec devices were impacted at the same time, both within the same provider’s network.This led us to assess it was not the result of a faulty firmware update by a single manufacturer, which would normally be confined to one device model or models from a given company.

            Our analysis of the Censys data shows the impact was only for the two in question. This combination of factors led us to conclude the event was likely a deliberate action taken by an unattributed malicious cyber actor, even if we were not able to recover the destructive module.

            “Mystery” is a term I’d use if there was no explanation for how something could have happened. They are pretty sure they know what and how. They just don’t have proof. Either way , I’ve already spent more time on this thread than it deserves. Take care.

  • tjr@mbin.xi.ht
    0·
    6 months ago

    the sad thing is this is just routers, think about all of the IoT devices that are compromised due to vendors not caring about patching security issues, just worrying about selling IoT.