The Russian connectionRussian spy software in U.S. home and office routers
The Russian government hackers known as APT 28 or Fancy Bear – the operatives who were behind information attacks against the Democratic National Committee and the Hillary Clinton Campaign, among others – have infiltrated hundreds of thousands of home and office routers worldwide. The presence of Russian malware on the routers could enable the Kremlin to steal individuals’ data or enlist their devices in a massive attack intended to disrupt global economic activity or target institutions.
A broad and serious national security threat emerged last spring as U.S. officials warned Russian military intelligence hackers had infiltrated hundreds of thousands of home and office routers worldwide.
The presence of Russian malware on the routers … could enable the Kremlin to steal individuals’ data or enlist their devices in a massive attack intended to disrupt global economic activity or target institutions.
(…)
On May 27, Justice Department officials asked Americans to reboot their routers to stop the attack.
But Rob Joyce, “senior advisor to the director of the National Security Agency and the former White House cybersecurity coordinator,” says the malware still is in the system.
The U.S. intelligence community believes the culprits are the hackers known as APT 28 or Fancy Bear, Russian military operatives who were behind information attacks against the Democratic National Committee, State Department, and others. The new malware, if activated, could allow the Russian military to peer into the online activities of hundreds of thousands of people.
(…)
The malware executes in three stages … The first stage is akin to a tick burrowing into a victim’s skin, to “dig in” with its teeth by changing the infected devices’ non-volatile persistent memory, the portion of the memory that persists even after the machine is turned off. During this phase, the malware also establishes links to any servers it finds.
Stages two and three are about receiving and executing the orders. These could include: stealing traffic data from the victim (via port 80), launching “man in the middle” attacks, using the router as a platform to attack other computers as part of a botnet, or overwriting the memory on the router to render it unusable.
The U.S. government effort to stop the attack “was effective at knocking down their command and control. But — and this is a ‘but’ we haven’t seen talked about that much — there was a persistent ‘stage one’ on all of those routers,” said Joyce. “If it was at a stage-two or stage-three implant, it knocked it back to one, which was power- and reboot-persistent. At that point, we couldn’t call back out via those two methods to re-establish command and control,” Joyce told the crowd [at DEFCON in Las Vegas].
Bottom line: “It’s still on those routers and if you know the wake-up knock you can go in, control those routers, and put a stage two or three back on them… What do you think the odds are that the actors in Russia who put those down have the addresses of the places where the put the malware? I think it’s pretty high,” he said.
What’s needed now, Joyce said, is for government, industry, and cybersecurity professionals to find a way to straightforwardly tell individuals how to detect the presence of the malware on their routers and then to restore the device to its trustworthy state. The government won’t be able to do that for them “because, again, these are consumer devices…That’s the sort of thing we’re up against.”
