Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[Rods2]

The Russian PM Medvedev yesterday warned the US against further sanctions due to the chemical warfare attack on the UK. The US due to their international obligations are legally bound to punish any state that breaks international law by using chemical weapons. US Congress in now debating a new law with more punitive sanctions against Russia. The Russian PM has said they will consider this an economic attack on Russia and will retaliate using any means they see fit to use including unconventional ones. You can take this to mean from their attacks multiple times on Ukraine which is a Russian cyberwar testing ground, this will involve placed malware, including power distribution control systems, Internet routers including domestic broadband ones. I was in Ukraine in June 2017 during such an attack that took down their countries airline booking systems and their banks financial systems including their ATM systems. The first thing I knew about it was when I couldn't withdraw any money ready for my trip the following day back to Kyiv's Borispol airport or check in and get my flight boarding pass. These are real attacks affecting many people. Several weeks a go the CIA and FBI detected Russian malware being placed on US routers and requested that SMEs and domestic Internet users to power down all their routers and reboot them to remove the malware they had detected.

We know this from Facebook, probable illegal, sharing of data with Cambridge Analytica and at least one Israeli company they have links to the Russian and Chinese (through Hong Kong front companies) intelligence. Both countries have heavily invested in US tech companies through anonymous front companies for espionage and influence reasons. Again we know from Cambridge Analytica that one of their favourite data collection sources for profiling 'subjects' are quizzes and even better online surveys. If you do either you are not only profiled by the US tech company advertising affiliates, but also by Russian and Chinese intelligence for use in targeted active measures propaganda profiled political adverts but also their useful fool front websites whose SEO ranking is boosted through botnets linked to social media and these routes will be used in cyber warfare attacks in the future. Through advertising profiling we know Facebook makes on average $50 a month for each UK user and $80 in the US. Other US tech companies will be earning similar amounts.

Two things: If something is free you are the product and being forewarned is being forearmed in an area that is likely to turn very nasty over the next six months or so.

[biggriffin]

o booger,, that means the link I posted earlier, for the quiz is probabaly owned or moniterd by mossad, kgb, or someother nations nasty people,    Time to go off grid, pay by cash, that's a start.

Thanks for the warning.

[Sir Tigger KC]

Did they ever get to the bottom of what caused that massive systems crash at the NHS a few months ago?   

[STEMO]

Did they ever get to the bottom of what caused that massive systems crash at the NHS a few months ago?   

Wannacry? 

[deviator]

Did they ever get to the bottom of what caused that massive systems crash at the NHS a few months ago?   

Lack of funding?

[Sir Tigger KC]

Did they ever get to the bottom of what caused that massive systems crash at the NHS a few months ago?   

Lack of funding?

Ah yes the Tories... 

[Rods2]

This is a US NSA follow up in a Defense One magazine article. Not surprised to stage 1 hacking being persistent & rebooting only deleted stages 2 & 3 which can be added again where the Russians 'own' the device. This is worrying due to a lack of government / industry response to tools to get rid of the stage 1 malware.

If anybody is aware of any tools to test & remove this stage 1 infection then please let me know?

https://www.defenseone.com/technology/2018/08/russian-military-spy-software-hundreds-thousands-home-routers/150474/

[aaronjb]

"What’s needed now, Joyce said, is for government, industry, and cybersecurity professionals to find a way to straightforwardly tell individuals how to detect the presence of the malware on their routers and then to restore the device to its trustworthy state."

That's virtually impossible, because we are dealing with consumer devices here - the kind of thing where there is no usable management console access and all you get is the (woeful) web UI. Heck, stuff bundled with your connection doesn't even usually come with the ability to manually re-flash the firmware, because ISPs don't make the firmware available for download.. in other words, because we've dumbed down technology to a level where non-IT folks can use it, we've also rendered it completely insecure.

Remember, the S in "IoT" stands for Security.

[Kevin Wood]

Indeed. I'd say unless there is an "out of band" way to flash the device with its original firmware image there's no way, so it's back to the factory, or bin it. If you do clean it, what's to say it doesn't get owned again as soon as it connects back to the internet?

Even if there's a way for the consumer to load firmware, what's to say that hasn't been "got at" too?

There isn't really an answer to securing cheap consumer embedded systems such as this, IMHO, other than don't connect them to the internet. Less than useful for a router. 

Probably the only solution is for ISPs to detect suspicious activity and boot them off the network. Then again, it's not their problem and that will just cause their support centres to get swamped with calls from unwashed plebs who can't get on @rsebook.

I wonder if I should update my ancient Draytek router some time. Then again, it might now be so ancient that nobody's going to bother hacking it?

[aaronjb]

I wonder if I should update my ancient Draytek router some time. Then again, it might now be so ancient that nobody's going to bother hacking it?

Probably the latter, yep. Best router I ever owned (right up until it died in a thunderstorm).

Personally I can be pretty confident that my router hasn't been owned (pfsense on a little Intel box), but the Virgin router that I'm stuck with (in modem mode)? Unless I crack it open and find some JTAG headers, I don't believe it even has a console ... beyond probably a "hidden" one for Virgin to connect in to, that likely has the same credentials on every unit. Y'know, handy for the Russkies.

Do I worry about it all? No, not really. Given sufficient resources (i.e. government) someone can own my traffic no matter how hard I try and protect myself, so you're fighting a losing battle if you're worried about nation-state attacks.

[Kevin Wood]

Indeed - where "My traffic" is stuff going to and from the internet anyway, so, if it's something you care about, and isn't already robustly encrypted...