DOJ should quietly remove US malware too
this post was submitted on 17 Feb 2024
432 points (98.0% liked)
Technology
59405 readers
2561 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
An important detail to mention is that every router involved were very old Ubiquiti EdgeRouters which were EOL’d like a year or two ago and they had remote administration enabled and were still using the default admin user and password.
Aka people who just plugged it in and left it as long as it works. These are not the kind of people who would have done anything if informed that they had an issue. On one hand I don't like the idea of governments fixing private property, but they were never going to be fixed by the owner.
Well the government wasn’t “fixing private property”, as much as they were “expelling hostile foreign nationals from private property that were being utilized for malicious purposes”. They only acted in the case that one of these devices was an active participant in a botnet.
I know the government touching your stuff is an icky thought, I agree. But the only alternative in this case is you being held personally liable for your devices being used to commit cyber crime by a hostile government entity, which is a much worse thought.
Like if you own a gun and it’s stolen and you don’t report it, and a crime is committed with it, you can be charged with a crime in many states. It wouldn't be the biggest leap for something like that to apply here, if not now then in the future. I think the government fixing the problem for us and leaving us alone about it is just about the best outcome we could ask for.
I was running an edge router x until a few months ago. It was the cheapest set up to deploy a unifi wireless access point for my apartment. I was worried until I read:
It affected routers running Ubiquiti's EdgeOS, but only those that had not changed their default administrative password. Access to the routers allowed the hacking group to "conceal and otherwise enable a variety of crimes," the DOJ claims, including spearphishing and credential harvesting in the US and abroad.
Change you default passwords friends. Given that the edge router is not the most noob friendly device to set up, I'm curious how the user base of these devices is not changing the PW.
I think it's best to only buy routers supporting openwrt in the first place and switch firmware to openwrt asap. Openwrt or Opnsense or anything open source and well maintained will guarantee security updates years and years beyond the original manufactures firmware.
Have you ever used a EdgeRouter?
No, but openwrt seems to be available for some of their models if that is your question.
And the NSA quietly installed their own.
The greatest malware ever installed was the idea that we shouldn't fear our governments and should trust them implicitly.
malware is what gave the DOJ the ability to do this, so yeah,
I like to imagine that one arm of the American surveillance state started the exploit and the DOJ wrapped it up only after Fancy Bear noticed exploitable routers. I mean, there wasn't any evidence that this originated from Russia in the article, just the assertion that it was so. Who's checking?
Honest question: Assuming nation states have the all-powerful ability to install software on your networking gear, which country would you rather have? USA or Russia?
The country you live in.
Zimbabwe. I feel like they'd have a harder time doing any real damage to me
If you're in the USA it seems clearly better to have Russian since they can do much less to affect your life and vice versa.
Same, rather get spied on from someone across the ocean you know? At least they won't arrest me.
If the US government wants to spy on you, they have boots on the ground. Russia has been involved with ransomeware campaigns.
Useless redirection.
If you have one then you'll have both.
is switching to Cups and String an option?
Cup with string attach to ball is number one game on Siberian winternet.
Closest thing we have is end to end encryption mixed with services like tor to obfuscate our positions. Privacy is no longer opt out and is increasingly harder to achieve.
That's already been hacked by the NSA
I hear pigeons aren't too hard to breed.
They taste good BBQ'd too.
During the court-sanctioned intrusion, the DOJ "enabled temporary collection of non-content routing information" that would "expose GRU attempts to thwart the operation." This did not "impact the routers' normal functionality or collect legitimate user content information," the DOJ claims.
I bet.
If they wanted to, absolutely they could. They didn't though. Unless they thought you were a spy...
Why is the default setting to enable remote administration?
It wasn’t. Remote administration was enabled manually on these devices, and the admin passwords left default.
20+ years ago I managed the installation of a high performance compute cluster purchased from IBM. Their techs did all the initial installation and setup, right down to using their well known default password of “PASSW0RD” (with a zero for the ‘o’) for all root/admin accounts…. It took less than 20 minutes for it to be compromised by an IP address in China.
At least other vendors like HP use random root/admin passwords printed on cards physically attached to new equipment…
When I used to rack and stack servers, many moons ago, we would always connect them to a switch with LAN only so we could use SSH/SCP to harden them before they got exposed. This was for .gov stuff that would get attacked instantly.
Because these routers went out to everybody. Tech heads and idiots alike. It is far easier for ISPs to simply remote in than rely on the consumer who may be an idiot.
I can’t think of a single ISP that was using old Ubiquiti EdgeOS routers as consumer routers.
So if we're not talking about ISPs sending this out, then the reason that remote access gets turned on by default is incase the company sysadmin couldn't physically get to the device, and they assumed the company had a firewall.
Companies almost always prioritise OOTB setup and operationality over security when it comes to defaults.
They likely weren’t enabled by default at all. Because that’s generally not how company IT departments even remote manage these things. And the affected devices are the firewalls.
Remote administration was turned on manually, by the owners of these devices, because they didn’t know what they were doing.
Because it was infected with malware from hostile countries.
Because without it, the DOJ would have no control over you, duh