FYI Heads-Up VPNfilter malware on Routers
 

Folks,

I just ran across this article about VPNfilter malware being inserted onto routers, to include ones which may be in our homes.

https://www.reuters.com/article/us-usa-cyber-routers/fbi-says-foreign-hackers-have-compromised-home-router-devices-idUSKCN1IQ2DY

You may want to do a search for your particular home router to see what the manufacturer recommends for handling the matter.

Really good article

https://arstechnica.com/information-technology/2018/05/hackers-infect-500000-consumer-routers-all-over-the-world-with-malware/

Linksys E1200
Linksys E2500
Linksys WRVS4400N
Mikrotik RouterOS for Cloud Core Routers: Versions 1016, 1036, and 1072
Netgear DGN2200
Netgear R6400
Netgear R7000
Netgear R8000
Netgear WNR1000
Netgear WNR2000
QNAP TS251
QNAP TS439 Pro
Other QNAP NAS devices running QTS software
TP-Link R600VPN

Best thing: Do a factory reset, then update the router to the latest firmware

Netgear is advising customers that, in addition to applying the latest firmware updates and changing default passwords, users should ensure that remote management is turned off on their router. Remote management is turned off by default and can only be turned on using the router's advanced settings. To turn it off, they should go to www.routerlogin.net in their browser and log in using their admin credentials. From there, they should click "Advanced" followed by "Remote Management". If the check box for "Turn Remote Management On" is selected, clear it and click "Apply" to save changes.

??? huh? You are not connected to your Router’s WiFi network. To access routerlogin.net, your device must be connected to your Router’s WiFi network. Check your current connection and try again.

Mine is on the list. If I do the reset what must I do to get back to regular function? This stuff is greek-ish to me.

You'll need to log in to the router and redo all settings. Make sure to disable remote management and to setup a new admin password.

1. Reboot Router
2. Login to router and write down/screen print all settings
3. Factory Reset
4. Update Firmware
5. Redo all settings using stuff from line 2

Thanks!


edit: OK so I go in and changed the quest password and disabled other devices from access but it wasn't called "remote access". I'll reboot once I read more.

YO! I went thru all the steps and now I can't connect to my wireless network. I had to go back to ethernet cable. WTF?

likely you need to resetup the network from step one
as you wiped the settings