A malware framework that’s already infected hundreds of thousands of routers across the globe appears to be even more dangerous than originally thought, according to new findings by Cisco’s internal cybersecurity unit Talos. The latest results show that the malware, “VPNFilter,” affects a wider array of devices, including more than 11 different hardware vendors, and carries several previously unknown infection capabilities, such as the potential to manipulate internet traffic on the end device in novel ways.
“They’re not trying to gather as much traffic as they can. They’re after certain very small things like credentials and passwords“, Craig Williams
Current U.S. officials and other experts have linked VPNFilter to a hacking group known as APT28, also called “Fancy Bear.” This entity is widely associated with Russia’s Main Intelligence Directorate (GRU) and has been blamed for breaching the Democratic National Committee in 2016.
Court documents suggested last week that Russia had been involved in VPNFilter.
Simply put, VPNFilter is dangerous because it offers the attacker the ability to both destroy data, rendering the device unusable, and covertly spy on specific targets. With Wednesday’s findings, perhaps the most unsettling new capability discovered by Talos is that VPNFilter can also execute a man-in-the-middle attack on incoming Web traffic that passes through infected routers; giving APT28 an avenue to inject malware into legitimate web applications.
“Initially when we saw this we thought it was primarily made for offensive capabilities like routing attacks around the Internet,” Craig Williams, a senior technology leader and global outreach manager at Talos, told Ars Technica reporter Dan Goodin. “But it appears [attackers] have completely evolved past that, and now not only does it allow them to do that, but they can manipulate everything going through the compromised device. They can modify your bank account balance so that it looks normal while at the same time they’re siphoning off money and potentially PGP keys and things like that. They can manipulate everything going in and out of the device.”
“They’re looking for very specific things,” Williams said. "They’re not trying to gather as much traffic as they can. They’re after certain very small things like credentials and passwords. We don’t have a lot of intel on that other than it seems incredibly targeted and incredibly sophisticated. We’re still trying to figure out who they were using that on.”
To bypass TLS encryption that’s designed to prevent such attacks, ssler actively tries to downgrade HTTPS connections to plaintext HTTP traffic. It then changes request headers to signal that the end point isn’t capable of using encrypted connections.
