An important detail to mention is the every router involved were very old Ubiquiti Edgerouters which of EOL’d like a year or two ago and they had remote administration enabled and were still using the default admin user and password.
DOJ quietly removed Russian malware from routers in US homes and businesses
Submitted 8 months ago by issue0315@lemmy.world to technology@lemmy.world
Comments
EncryptKeeper@lemmy.world 8 months ago
Copernican@lemmy.world 8 months ago
I was running an edge router x until a few months ago. It was the cheapest set up to deploy a unifi wireless access point for my apartment. I was worried until I read:
It affected routers running Ubiquiti’s EdgeOS, but only those that had not changed their default administrative password. Access to the routers allowed the hacking group to “conceal and otherwise enable a variety of crimes,” the DOJ claims, including spearphishing and credential harvesting in the US and abroad.
Change you default passwords friends. Given that the edge router is not the most noob friendly device to set up, I’m curious how the user base of these devices is not changing the PW.
purplemonkeymad@programming.dev 8 months ago
Aka people who just plugged it in and left it as long as it works. These are not the kind of people who would have done anything if informed that they had an issue. On one hand I don’t like the idea of governments fixing private property, but they were never going to be fixed by the owner.
EncryptKeeper@lemmy.world 8 months ago
Well the government wasn’t “fixing private property”, as much as they were “expelling hostile foreign nationals from private property that were being utilized for malicious purposes”. They only acted in the case that one of these devices was an active participant in a botnet.
I know the government touching your stuff is an icky thought, I agree. But the only alternative in this case is you being held personally liable for your devices being used to commit cyber crime by a hostile government entity, which is a much worse thought.
Like if you own a gun and it’s stolen and you don’t report it, and a crime is committed with it, you can be charged with a crime in many states. It wouldn’t be the biggest leap for something like that to apply here, if not now then in the future. I think the government fixing the problem for us and leaving us alone about it is just about the best outcome we could ask for.
Nougat@kbin.social 8 months ago
Why is the default setting to enable remote administration?
520@kbin.social 8 months ago
Because these routers went out to everybody. Tech heads and idiots alike. It is far easier for ISPs to simply remote in than rely on the consumer who may be an idiot.
rdyoung@lemmy.world 8 months ago
This is why I run my own router. I’m sure my cable modem has a way in but then you’d have to get past my router.
EncryptKeeper@lemmy.world 8 months ago
I can’t think of a single ISP that was using old Ubiquity EdgeOS routers as consumer routers.
IphtashuFitz@lemmy.world 8 months ago
20+ years ago I managed the installation of a high performance compute cluster purchased from IBM. Their techs did all the initial installation and setup, right down to using their well known default password of “PASSW0RD” (with a zero for the ‘I’) for all root/admin accounts…. It took less than 29 minutes for it to be compromised by an IP address in China.
At least other vendors like HP use random root/admin passwords printed on cards physically attached to new equipment…
AtmaJnana@lemmy.world 8 months ago
When I used to rack and stack servers, many moons ago, we would always connect them to a switch with LAN only so we could use SSH/SCP to harden them before they got exposed. This was for .gov stuff that would get attacked instantly.
Timwi@kbin.social 8 months ago
Because without it, the DOJ would have no control over you, duh
EncryptKeeper@lemmy.world 8 months ago
It wasn’t. Remote administration was enabled manually on these devices.
Kbin_space_program@kbin.social 8 months ago
Because it was infected with malware from hostile countries.
umbrella@lemmy.ml 8 months ago
DOJ should quietly remove us malware too
AnneBonny@lemmy.dbzer0.com 8 months ago
During the court-sanctioned intrusion, the DOJ “enabled temporary collection of non-content routing information” that would “expose GRU attempts to thwart the operation.” This did not “impact the routers’ normal functionality or collect legitimate user content information,” the DOJ claims.
I bet.
blanketswithsmallpox@lemmy.world 8 months ago
If they wanted to, absolutely they could. They didn’t though. Unless they thought you were a spy…
lemonuri@lemmy.ml 8 months ago
I think it’s best to only buy routers supporting openwrt in the first place and switch firmware to openwrt asap. Openwrt or Opnsense or anything open source and well maintained will guarantee security updates years and years beyond the original manufactures firmware.
jelloeater85@lemmy.world 8 months ago
Have you ever used a EdgeRouter?
lemonuri@lemmy.ml 8 months ago
No, but openwrt seems to be available for some of their models if that is your question.
autotldr@lemmings.world [bot] 8 months ago
This is the best summary I could come up with:
More than 1,000 Ubiquiti routers in homes and small businesses were infected with malware used by Russian-backed agents to coordinate them into a botnet for crime and spy operations, according to the Justice Department.
That malware, which worked as a botnet for the Russian hacking group Fancy Bear, was removed in January 2024 under a secret court order as part of “Operation Dying Ember,” according to the FBI’s director.
Unlike previous attacks by Fancy Bear—that the DOJ ties to GRU Military Unit 26165, which is also known as APT 28, Sofacy Group, and Sednit, among other monikers—the Ubiquiti intrusion relied on a known malware, Moobot.
“For the second time in two months, we’ve disrupted state-sponsored hackers from launching cyber-attacks behind the cover of compromised US routers,” said Deputy Attorney General Lisa Monaco in a press release.
Christopher A. Wray, director of the FBI, expanded on the Fancy Bear operation and international hacking threats generally at the ongoing Munich Security Conference.
Malware said by the DOJ to be tied to the Chinese government was removed from SOHO routers by the FBI last month in similar fashion to the most recently revealed operation, targeting Cisco and Netgear devices that had mostly reached their end of life and were no longer receiving security patches.
The original article contains 550 words, the summary contains 211 words. Saved 62%. I’m a bot and I’m open source!
orclev@lemmy.world 8 months ago
Important detail left out of the TL;DR: The method of infection required that the device still had the default admin password. As long as you changed the admin password when you setup the device this wouldn’t have impacted you.
ruckblack@sh.itjust.works 8 months ago
It’s incredible how many people leave their router with the default password
Cyberbatman@lemmings.world 8 months ago
Thanks for this important information. Thank goodness I always do after we get a new Router. (change your username and password)
SquiffSquiff@lemmy.world 8 months ago
roguetrick@kbin.social 8 months ago
And the NSA quietly installed their own.
Baahb@lemmy.world 8 months ago
The NSAs malware is what would potentially give the DOJ the ability to do this. Weird how it doesn’t mention how this stuff was removed.
AMillionMonkeys@lemmy.world 8 months ago
Honest question: Assuming nation states have the all-powerful ability to install software on your networking gear, which country would you rather have? USA or Russia?
A_Random_Idiot@lemmy.world 8 months ago
is switching to Cups and String an option?
bionicjoey@lemmy.ca 8 months ago
Zimbabwe. I feel like they’d have a harder time doing any real damage to me
trebuchet@lemmy.ml 8 months ago
If you’re in the USA it seems clearly better to have Russian since they can do much less to affect your life and vice versa.
MonsiuerPatEBrown@reddthat.com 8 months ago
Useless redirection.
If you have one then you’ll have both.
phillaholic@lemm.ee 8 months ago
The country you live in.
GnuLinuxDude@lemmy.ml 8 months ago
I like to imagine that one arm of the American surveillance state started the exploit and the DOJ wrapped it up only after Fancy Bear noticed exploitable routers. I mean, there wasn’t any evidence that this originated from Russia in the article, just the assertion that it was so. Who’s checking?
yggstyle@lemmy.world 8 months ago
The greatest malware ever installed was the idea that we shouldn’t fear our governments and should trust them implicitly.