FBI tells router users to reboot now to kill malware infecting 500k devices

Re:FBI tells router users to reboot now to kill malware infe... by mikec3010 on Saturday May 26, 2018 @12:38PM (#17162904)

Not true. Product liability lawsuits have been around for ages. It's just that the tech industry has been able to escape them, by and large. I think one of the greater injustices in business was Microsoft's avoidance of a lawsuit from their spate of windows malware from roughly 2003-2010. They just sat on their hands and let for-profit A/V companies and nonprofit volunteers secure their platform, while consumers lost millions of hours and billions of dollars to simply be able to use their computers again after being rooted by 4 lines of JavaScript

[ Parent | on HN ]

Re:FBI tells router users to reboot now to kill malware infe... by vntok on Saturday May 26, 2018 @12:51PM (#17162979)

> after being rooted by 4 lines of JavaScript

Could you provide any sort of source for this extraordinary claim of yours?

[ Parent | on HN ]

Re:FBI tells router users to reboot now to kill malware infe... by jwalton on Saturday May 26, 2018 @01:13PM (#17163095)

That's probably an exaggeration, but I agree with the sentiment of what they are saying. It's not crazy hard to write quality software. Most corporations don't bother because they know they don't have to, since they can escape liability laws. It's gotten to the point where most software developers somehow view this situation as "normal".

Do you have a QA department? What do they do? If you're like most software companies, they do testing. This is not QA, though, it's QV. The role of QA is to assure that the quality of your product is high. By the time you're testing it, the product is "done" - all of the defects are already there in the product. There is now nothing you can do to affect the quality of the product - all you can do is test and measure the overall quality of the product.

I mean, your tests will find problems, and you can fix those problems. But, if you keep track of how many problems you find, and how much test effort was involved to find those problems, you can plot a weibull regression and make a prediction about how many defects you haven't found yet. On any project I've been on where we ran this analysis, it was obvious that testing was finding almost none of the problems - barely skimming the surface. And, when you ran this analysis you could predict how many defects you will find if you spend X days testing, and on any project where I've seen this analysis run, those predictions have been highly accurate.

Really good automated tests can help with this, because they can do huge amounts of test effort "for free", but really QA should be about the process you follow when you write software - making sure you have a repeatable process, and then figuring out how to improve it. Almost no one does this.

[ Parent | on HN ]

Re:FBI tells router users to reboot now to kill malware infe... by freeone3000 on Sunday May 27, 2018 @03:16AM (#17165887)

This sounds like it's really expensive, and hard to prove the benefits of to most purchasers. I doubt we'll get the sort of industry change this would require without since strong formalization of the discipline.

[ Parent | on HN ]

Re:FBI tells router users to reboot now to kill malware infe... by bsamuels on Saturday May 26, 2018 @06:25PM (#17164560)

I won't provide a source but i'll provide a modified real life example, since i'm pretty sure this vuln is still in the wild.

I was doing a pen test on a router whose manufacturer decided it would be an OK idea to use GET requests to launch their ping diagnostic tool on their router's unauthenticated QA web interface.

this ping diagnostic tool was triggered by doing GET http://192.168.1.1/diagnostic/trace&ip=X.X.X.X

The IP address in the URL parameter would get plugged directly into a "ping" command line command, so you could obtain command injection by going GET http://192.168.1.1/diagnostic/trace&ip=X.X.X.X&&telnetd

You could exploit this from literally any website on the internet, and since it's a GET request and we don't care about what it returns, CORS won't save your router. I think that counts as a javascript one-liner, but you get the idea how fucking awful some of these routers are.

[ Parent | on HN ]

Re:FBI tells router users to reboot now to kill malware infe... by namibj on Saturday May 26, 2018 @10:46PM (#17165213)

It might even be an evil pixel... E.g., worse than javascript-requiring exploits.

[ Parent | on HN ]

Re:FBI tells router users to reboot now to kill malware infe... by Nomentatus on Saturday May 26, 2018 @01:22PM (#17163143)

I'm not sure whether you think a line of JS calling out to load a remote procedure would have been extraordinary, a root via a browser would have been extraordinary, any remote rootkit load would have been extraordinary, or whether the fact that it used to be possible to root Windows seems extraordinary. I'm no expert but none of this seems extraordinary to me. Things was loose in those days.

[ Parent | on HN ]

Re:FBI tells router users to reboot now to kill malware infe... by nimih on Saturday May 26, 2018 @04:11PM (#17164029)

I'm not sure what the OP was referring to, but off the top of my head there was a security vulnerability in Windows disclosed last year which seems to fit that description[1][2].

[1] https://twitter.com/natashenka/status/861748397409058816

[2] https://bugs.chromium.org/p/project-zero/issues/detail?id=12...

[ Parent | on HN ]

Re:FBI tells router users to reboot now to kill malware infe... by RyanZAG on Saturday May 26, 2018 @02:18PM (#17163495)

Here's a fairly recent one, I guess. The 3 lines of javascript do most of the work.

https://nakedsecurity.sophos.com/2013/10/11/anatomy-of-an-ex...

[ Parent | on HN ]

Re:FBI tells router users to reboot now to kill malware infe... by mikec3010 on Saturday May 26, 2018 @01:29PM (#17163196)

Source: The extraordinarily large amount of PCs I fixed for people during that era.

[ Parent | on HN ]