- cross-posted to:
- technology@lemmy.world
- cross-posted to:
- technology@lemmy.world
You must log in or register to comment.
And the NSA quietly installed their own.
Honest question: Assuming nation states have the all-powerful ability to install software on your networking gear, which country would you rather have? USA or Russia?
is switching to Cups and String an option?
I hear pigeons aren’t too hard to breed.
Those are all compromised too!
That’s already been hacked by the NSA
Closest thing we have is end to end encryption mixed with services like tor to obfuscate our positions. Privacy is no longer opt out and is increasingly harder to achieve.
Zimbabwe. I feel like they’d have a harder time doing any real damage to me
Useless redirection.
If you have one then you’ll have both.
The country you live in.
If you’re in the USA it seems clearly better to have Russian since they can do much less to affect your life and vice versa.
If the US government wants to spy on you, they have boots on the ground. Russia has been involved with ransomeware campaigns.
malware is what gave the DOJ the ability to do this, so yeah,
I like to imagine that one arm of the American surveillance state started the exploit and the DOJ wrapped it up only after Fancy Bear noticed exploitable routers. I mean, there wasn’t any evidence that this originated from Russia in the article, just the assertion that it was so. Who’s checking?
Why is the default setting to enable remote administration?
Because these routers went out to everybody. Tech heads and idiots alike. It is far easier for ISPs to simply remote in than rely on the consumer who may be an idiot.
This is why I run my own router. I’m sure my cable modem has a way in but then you’d have to get past my router.
Ditto. I went one step further and put OpenWRT on mine.
Messed up thing is, some ISPs make it an absolute bitch to make this work.
Because without it, the DOJ would have no control over you, duh
20+ years ago I managed the installation of a high performance compute cluster purchased from IBM. Their techs did all the initial installation and setup, right down to using their well known default password of “PASSW0RD” (with a zero for the ‘o’) for all root/admin accounts…. It took less than 20 minutes for it to be compromised by an IP address in China.
At least other vendors like HP use random root/admin passwords printed on cards physically attached to new equipment…
When I used to rack and stack servers, many moons ago, we would always connect them to a switch with LAN only so we could use SSH/SCP to harden them before they got exposed. This was for .gov stuff that would get attacked instantly.
Because it was infected with malware from hostile countries.
During the court-sanctioned intrusion, the DOJ “enabled temporary collection of non-content routing information” that would “expose GRU attempts to thwart the operation.” This did not “impact the routers’ normal functionality or collect legitimate user content information,” the DOJ claims.
I bet.
This is the best summary I could come up with:
More than 1,000 Ubiquiti routers in homes and small businesses were infected with malware used by Russian-backed agents to coordinate them into a botnet for crime and spy operations, according to the Justice Department.
That malware, which worked as a botnet for the Russian hacking group Fancy Bear, was removed in January 2024 under a secret court order as part of “Operation Dying Ember,” according to the FBI’s director.
Unlike previous attacks by Fancy Bear—that the DOJ ties to GRU Military Unit 26165, which is also known as APT 28, Sofacy Group, and Sednit, among other monikers—the Ubiquiti intrusion relied on a known malware, Moobot.
“For the second time in two months, we’ve disrupted state-sponsored hackers from launching cyber-attacks behind the cover of compromised US routers,” said Deputy Attorney General Lisa Monaco in a press release.
Christopher A. Wray, director of the FBI, expanded on the Fancy Bear operation and international hacking threats generally at the ongoing Munich Security Conference.
Malware said by the DOJ to be tied to the Chinese government was removed from SOHO routers by the FBI last month in similar fashion to the most recently revealed operation, targeting Cisco and Netgear devices that had mostly reached their end of life and were no longer receiving security patches.
The original article contains 550 words, the summary contains 211 words. Saved 62%. I’m a bot and I’m open source!
Important detail left out of the TL;DR: The method of infection required that the device still had the default admin password. As long as you changed the admin password when you setup the device this wouldn’t have impacted you.
It’s incredible how many people leave their router with the default password
I’m smart, I never leave the default password.
I always change it to 1 2 3 4 5, the same as my luggage.
Thanks for this important information. That is the 1st thing we do after getting a new Router. (change its username and password)
