Welcome to DU! The truly grassroots left-of-center political community where regular people, not algorithms, drive the discussions and set the standards. Join the community: Create a free account Support DU (and get rid of ads!): Become a Star Member Latest Breaking News General Discussion The DU Lounge All Forums Issue Forums Culture Forums Alliance Forums Region Forums Support Forums Help & Search

inanna

(3,547 posts)
Wed May 30, 2018, 04:54 PM May 2018

Why the FBI says rebooting your router can weaken a global malware attack

Source: Washington Post

May 30 at 2:56 PM

The Federal Bureau of Investigation is asking everyone with a home router to do one small thing: Turn your router off and then back on again.

The agency issued a warning on Friday asking home Internet users and small business owners to reboot their routers to ward off a pernicious piece of malware called VPN Filter. The malware infects routers during the first stage of an attack that eventually gives hackers great control over the devices connected to the Internet. The malware has been linked to a group believed to be connected to the Russian military.

Research from Cisco's Talos security group, published last week, estimates that 500,000 devices around the world may be affected by the malware, including routers made by major manufacturers such as TP-Link, Netgear and Linksys. While the FBI recently seized a critical part of the network that runs this attack, the agency still recommends that everyone reset their router, regardless of manufacturer, to cast a wider net.

Simply unplugging your router may not seem as if it could do much for your security. But resetting the router sets this complicated malware back to Stage One, said Ashley Stephenson of Corero Network Security. In its first stage, VPN Filter establishes a presence in a router, but it needs to talk to another part of the network to download the second stage of the attack.

Read more: https://www.washingtonpost.com/news/the-switch/wp/2018/05/30/the-fbi-would-like-you-to-reboot-your-wifi-router/?noredirect=on&utm_term=.e44d35f58c5f



I have complied with this request.
31 replies = new reply since forum marked as read
Highlight: NoneDon't highlight anything 5 newestHighlight 5 most recent replies
Why the FBI says rebooting your router can weaken a global malware attack (Original Post) inanna May 2018 OP
K&R! n/t RKP5637 May 2018 #1
Amazing. Thank you, inanna. n/t Judi Lynn May 2018 #2
I got the message yesterday, and rebooted yesterday. Honeycombe8 May 2018 #3
Mine seems to be working better now as well. inanna May 2018 #4
Well, I'm a nobody. So I'm not sure what good spying on me would do. nt Honeycombe8 May 2018 #7
Yup... and updated the firmware (something I ABSOLUTELY HATE to do) hlthe2b May 2018 #5
Interesting thing on my LinkSys wrt1900AC LiberalArkie May 2018 #10
Yeah... I've noticed the the netgear app doesn't always identify a new version for my router hlthe2b May 2018 #13
I think the major problems was that there were backdoors not needing a password LiberalArkie May 2018 #21
We were up late Friday night, so my husband got the news then, told me to turn off my iPad's wifi... Hekate May 2018 #6
My Netgear Orbi mesh system is being used as an access point (not a router)... mbusby May 2018 #8
Turn off the router - then UNPLUG it from the power source - for one minute FakeNoose May 2018 #9
Shut off the modem too? I wondered about this too? NT SWBTATTReg May 2018 #12
Not sure, because I don't use a modem FakeNoose May 2018 #24
Thanks...I usually end up booting everything anyways, since I do frequently and ... SWBTATTReg May 2018 #27
Shut off the modem/router and then unplug or pull the power adapter out... IthinkThereforeIAM May 2018 #29
Thanks so much...as it usually turns out, we either get a power outage or ... SWBTATTReg May 2018 #31
Reset to factory defaults? many a good man May 2018 #11
Reset both of my routers. defacto7 May 2018 #14
How often do we have to do it? catbyte May 2018 #15
Done - and will be done every day before I leave for work. jpak May 2018 #16
So have I Fritz Walter May 2018 #17
I have to do that once a day RhodeIslandOne May 2018 #18
Same in STL benld74 May 2018 #19
Done AllyCat May 2018 #20
I forwarded this to my friends. JohnnyRingo May 2018 #22
I know this is a stupid question but do I just unplug it for a minute and plug it back in mucifer May 2018 #23
Turn off the computer, turn off the router and unplug it from the power source FakeNoose May 2018 #25
My area gets so many power outages my router is always getting rebooted... SunSeeker May 2018 #26
Ha! Was thinking the same thing. Just had one a couple of days ago. nt fleabiscuit May 2018 #28
Yes... I'm thinking mine rebooted at least a half dozen times over the past several weeks hlthe2b May 2018 #30

Honeycombe8

(37,648 posts)
3. I got the message yesterday, and rebooted yesterday.
Wed May 30, 2018, 04:59 PM
May 2018

I periodically reboot, anyway The router seems to get congested or something...it works better after rebooting.

inanna

(3,547 posts)
4. Mine seems to be working better now as well.
Wed May 30, 2018, 05:01 PM
May 2018

I really, really hope I was not already infected?

I'm no "techie", so I wouldn't really know.

hlthe2b

(102,236 posts)
5. Yup... and updated the firmware (something I ABSOLUTELY HATE to do)
Wed May 30, 2018, 05:04 PM
May 2018

I hold my breath that the upgrade goes right and I don't lose internet access... So far, I've been lucky, but have heard some horror stories from friends whose netgear routers didn't seem to "like" the new firmware.
So far, I've been lucky.

LiberalArkie

(15,715 posts)
10. Interesting thing on my LinkSys wrt1900AC
Wed May 30, 2018, 05:53 PM
May 2018

I rebooted like I do all the time. I went to check for an upgrade in the router. The router said it was up to date and I wrote down the version number.

I went to Linksys and the version for my model was quite a bit higher than what was in it. So I did screen captures of all the settings and variables and downloaded the new version and installed it.

I put in all the DHCP settings logins, etc. I did not want to. restore a backup just incase there was something weird in it.

hlthe2b

(102,236 posts)
13. Yeah... I've noticed the the netgear app doesn't always identify a new version for my router
Wed May 30, 2018, 06:31 PM
May 2018

This time it did, but then I'd already known one was available (just hesitant to install it). I'll be honest, though--I'd not updated to the past two firmware versions even though I am religious about keeping my two laptops (and iphone/ipad) up to date. So, I knew I HAD to do this one....In my defense, I use very strong passwords and change them regularly...

LiberalArkie

(15,715 posts)
21. I think the major problems was that there were backdoors not needing a password
Wed May 30, 2018, 07:57 PM
May 2018

that allowed someone to put a version for the Linksys in, but it did not poll the correct IP for an update. SO the passwords meant nothing. For most people all the needed to do was reboot. Since the FBI had taken over the server that the first layer called was not responding nothing dangerous could be loaded.

I fixed it by going to Linksys.com and finding what I needed. I think it was a month or 2 old, so the router should have spotted if it was going to the correct place. But all is good, (I hope).

Also since the FBI has the server that the initial program calls, the FBI can now find out what routers and where are affected as they will be in the servers log.

Hekate

(90,667 posts)
6. We were up late Friday night, so my husband got the news then, told me to turn off my iPad's wifi...
Wed May 30, 2018, 05:07 PM
May 2018

...so he could disconnect and reboot the router for our home office.

Our friends the Russians

mbusby

(823 posts)
8. My Netgear Orbi mesh system is being used as an access point (not a router)...
Wed May 30, 2018, 05:12 PM
May 2018

...and my router and mail server is a Dell workstation server running ClearOS (Linux Redhat enterprise server). I rebooted the server, although I don't think it is affected.

FakeNoose

(32,634 posts)
9. Turn off the router - then UNPLUG it from the power source - for one minute
Wed May 30, 2018, 05:52 PM
May 2018

The router resets when the power is off and disconnected from the electric outlet.
If the plug stays in the outlet it might hold the previous settings, and then it hasn't reset itself.

Once you put the plug back in, turn the router back on, wait for about one minute until the blinky lights come on. You're good to go, and you can turn your computer back on. I have my computer and router on a multiple outlet surge protector so it's easy to shut the power off and on together.

FakeNoose

(32,634 posts)
24. Not sure, because I don't use a modem
Wed May 30, 2018, 09:49 PM
May 2018

However I'd say go ahead, to be on the safe side.

I know that routers have electric plugs that retain the charge for a short time even when the power shuts off (like in an electrical storm outage.) So after about 1 minute it loses that original charge and resets everything. It's possible that modems act the same way but I really don't know.

This message from the FBI is telling us to reset our routers, however it may not affect the modems because they may not be attacked by the same virus. Does anyone else know?

SWBTATTReg

(22,114 posts)
27. Thanks...I usually end up booting everything anyways, since I do frequently and ...
Wed May 30, 2018, 10:28 PM
May 2018

just being cautious...thanks again!

Also, there are combined modem/router units (in a single box) so I'm hazarding a guess that yes, do the modem too (since in some cases they are merged anyways.

IthinkThereforeIAM

(3,076 posts)
29. Shut off the modem/router and then unplug or pull the power adapter out...
Thu May 31, 2018, 12:08 AM
May 2018

... of the socket in back, then you don't have to go crawling and hope to find the right plug in on your surge protector plug in bar.

And wait at least 15 seconds, the longer the better, so the memory gets dumped, as mentioned in a post above mine, too.

With older Motorola wifi, especially the DSL ones (some folks still using them), it was SOP to reboot it once a week, or you had problems and lags.

It is just a good idea to do this procedure once a week, it dumps the RAM on the router (gets rid of old garbage bits and pieces in the memory) and resets so all should be faster.

It really isn't that much different of a concept than shutting off your cellphone, that sure seems to fix any apps that are hanging, right?

SWBTATTReg

(22,114 posts)
31. Thanks so much...as it usually turns out, we either get a power outage or ...
Thu May 31, 2018, 10:34 AM
May 2018

the like every 3 months or so (when I was rehabbing, it was far more frequent). I know people are wondering why take the plug out etc. too when the router is powered down, but if you have a relatively new VCR and the power goes out, and it goes out for a longer period of time, then your entries on when / what / etc. to record get wiped out (and you'll have to re-enter).

If the power goes out for a shorter duration of time, then the VCR doesn't lose any entries. I noticed this when out of two of three VCRs I have set up, 1 will always lose its entries, 1 will not, unless power is out longer, and the other VCR doesn't really work very well so I don't use very much.

Again, thanks so much, good points, especially about getting into a routine automatically to shut down/reboot.

many a good man

(5,997 posts)
11. Reset to factory defaults?
Wed May 30, 2018, 06:11 PM
May 2018

The WaPo article says to simply reboot but the technical article says to reset to factory defaults before rebooting. That's a big difference if it means you have reconfigure the router and all your devices.

Does this pertain to all routers or just some? Is there a list somewhere?

defacto7

(13,485 posts)
14. Reset both of my routers.
Wed May 30, 2018, 06:32 PM
May 2018

Mine are likely more vulnerable since they are set as bridges to the ip. I was thinking that I should reset them again on election days. Just a thought.

Fritz Walter

(4,291 posts)
17. So have I
Wed May 30, 2018, 07:08 PM
May 2018

On Memorial Day, I rebooted my cable modem as well as internal routers (Apple Time Machine and Airport). A minuscule way to honor those who fought against totalitarianism, but well worth the effort.

And, oh-by-the-way, an opportunity to say "Fuck you, Putin and all your bots!"

JohnnyRingo

(18,628 posts)
22. I forwarded this to my friends.
Wed May 30, 2018, 08:14 PM
May 2018

a couple will likely not do it because they think the Russians are just doing what's best for us again. hahaha They'll never trust the Feds anyway.

Thanx for posting. I like when doing something to protect my devices is so easy and free.

mucifer

(23,539 posts)
23. I know this is a stupid question but do I just unplug it for a minute and plug it back in
Wed May 30, 2018, 08:52 PM
May 2018

Is that all I have to do to reboot?

FakeNoose

(32,634 posts)
25. Turn off the computer, turn off the router and unplug it from the power source
Wed May 30, 2018, 09:55 PM
May 2018

Wait about a minute, plug it back in. Turn it on and wait for the little twinkly yellow/green lights to come back on.
It will reset itself and get a new IP address from your ISP.

When all the twinkly lights are on, you can turn your computer back on.
You'll have everything all the same on your computer, but the router has been reset.


SunSeeker

(51,550 posts)
26. My area gets so many power outages my router is always getting rebooted...
Wed May 30, 2018, 10:14 PM
May 2018

...whether I'm doing it or not.

hlthe2b

(102,236 posts)
30. Yes... I'm thinking mine rebooted at least a half dozen times over the past several weeks
Thu May 31, 2018, 06:33 AM
May 2018

So, maybe there is a silver lining...

Latest Discussions»Latest Breaking News»Why the FBI says rebootin...