Protect Yourself from "VPNFilter" Malware

The subject line above sounds like a dire warning! It is one!

There are some Bad players out there on the internet and below is a brief synopsis of activities…..Over the past few weeks there has been news and discussions on the Internet and in Security Groups about a Malware called “VPNFilter”. VPNFilter is a Malware originating in Russia that has infected more than 500,000 routers in 54 countries. On May 25th, the FBI advised that all small and home offices should reboot and update their routers to the latest version of firmware available.

What does this Malware do? "VPNFilter is able to render small office and home office routers inoperable," the FBI warns. "The malware can potentially also collect information passing through the router. Detection and analysis of the malware’s network activity is complicated by its use of encryption."

Rebooting the devices will temporarily disrupt the malware and aid the potential identification of infected devices.

Per a new report released on June 7th, by CISCO, the VPNFilter Malware is far more dangerous than was thought to be. Cisco has discovered that the Malware can perform Man-In-The-Middle attacks.

In a Man In The Middle Attack, malicious actor intercepts the communications between 2 systems and impersonates both sides in the exchange, often to steal information such as passwords or account numbers.

For example, you use your smart phone to access a banking app. In that process, the client (your phone representing you), sends the required information to the server (your bank). If the information is correct the bank sends back a verification of successful login and allows you to access your account. The malicious actor intercepts this communication and establishes a relay between the client (your phone) and the bank and now has the ability to modify the communication between the two. Instead of the information going directly from your phone to the bank, it 1st goes to the Man In the middle, who can alter the information and send to the server and vice versa.

Because at Kerr Consulting we feel it is our duty to inform and assist you in protecting your business’s and your employee’s information and data. We care at Kerr.