US-CERT Issues Warnings
A related alert from the U.S. Computer Emergency Readiness Team (US-CERT) states:"NCCIC is aware of a sophisticated modular malware system known as VPNFilter. Devices known to be affected by VPNFilter include Linksys, MikroTik, NETGEAR, and TP-Link networking equipment, as well as QNAP network-attached storage (NAS) devices. Devices compromised by VPNFilter may be vulnerable to the collection of network traffic (including website credentials), as well as the monitoring of Modbus supervisory control and data acquisition (SCADA) protocols.
VPNFilter has a destructive capability that can make the affected device unusable. Because the malware can be triggered to affect devices individually or multiple devices at once, VPNFilter has the potential to cut off internet access for hundreds of thousands of users."
How to Protect Devices From VPNFilter Malware
Still, Cisco offered these four recommendations to combat the VPNFilter malware threat:VPNFilter Malware: Security Industry Advice
Multiple security vendors are warning partners and customers about the risks. As a member of the Cyber Threat Alliance (CTA), Sophos has featured the warning about the malware in a Naked Security blog post.Paul Ducklin, a senior technologist at Sophos, recommends conducting a router health check, even if you believe the router is already up-to-date and don’t think devices are infected. Ducklin noted:"Home devices like routers are popular targets for cybercrooks these days, yet they're often neglected from a cybersecurity point of view. Start with the basics. Check for a firmware update with your router vendor - do it today! And pick proper passwords - the crooks know every default password that ever left the factory, so why make it easy for them?"
