<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>What a horrendous mess this is. Is it true (or not) that the
infection had to start by getting into the router using default
user name and password? In other words, if the default user name
and password had been changed prior to the attempted infection,
the router could not be infected?</p>
<p>Another question: Isn't this recommendation from the end of Part
2 of the SophosLabs analysis a bit backwards since it leaves the
router in factory default condition:</p>
<ul style="box-sizing: inherit; padding-left: 0px; margin: 0px 0px
1em 1.333em; list-style: disc; color: rgb(0, 25, 59); font-family:
SophosSansRegular, "Helvetica Neue", Helvetica, Arial,
sans-serif; font-size: 18px; font-style: normal;
font-variant-ligatures: normal; font-variant-caps: normal;
font-weight: 400; letter-spacing: normal; orphans: 2; text-align:
start; text-indent: 0px; text-transform: none; white-space:
normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width:
0px; background-color: rgb(248, 248, 248); text-decoration-style:
initial; text-decoration-color: initial;">
<li style="box-sizing: inherit;">Regardless of whether you think
your device has been hacked, power cycle the device, flash the
latest firmware over the top of whatever’s on there, and perform
a factory reset on the firmware (this shouldn’t result in file
loss on NAS devices, just a reset of all configured settings,
which you’ll have to redo)</li>
</ul>
<p>I think this is the correct sequence to ensure safety:</p>
<p>1. Reboot the router</p>
<p>2. Connect your PC to the router via an Ethernet cable. Login
and disable remote administration<br>
</p>
<p>3. Download the latest firmware from the vendor and save it on
your PC. Disconnect router from the Internet.<br>
</p>
<p>4. Save router configuration information to your PC<br>
</p>
<p>5. Perform factory reset</p>
6. Change admin user name and password. Flash latest firmware
(already saved) and restore router configuration (already saved)<br>
<br>
PS: The Morse code on the audio file on the nakedsecurity.sophos.com
site was a nice touch.<br>
<p>73, Walt, AJ6T<br>
</p>
<br>
<div class="moz-cite-prefix">On 6/11/2018 7:13 PM, RICHARD BARTH
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:74204331.142255.1528762390511@connect.xfinity.com">
<meta charset="UTF-8">
<p style="font-size: 14pt; font-family: helvetica, arial,
sans-serif; color: rgb(51, 51, 51);"><a class="moz-txt-link-freetext" href="https://nakedsecurity.sophos.com/2018/06/11/check-your-router-list-of-routers-affected-by-vpnfilter-just-got-bigger/">https://nakedsecurity.sophos.com/2018/06/11/check-your-router-list-of-routers-affected-by-vpnfilter-just-got-bigger/</a></p>
<!--'"--><br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Tacos mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Tacos@amrad.org">Tacos@amrad.org</a>
<a class="moz-txt-link-freetext" href="https://lists.amrad.org/mailman/listinfo/tacos">https://lists.amrad.org/mailman/listinfo/tacos</a>
</pre>
</blockquote>
<br>
</body>
</html>