Malicious Malware Threatening Unsuspecting Router Owners

Realizing that your device has been infected by malware is a terrible experience akin to contracting an actual disease. But what if we told you that a virus on your computer or even smartphone is still one of the better possibilities considering all the tools available to purge it from the system that are at your disposal. With that in mind, what would you do after learning that malware has taken nest in your router? It’s not quite as possible to run antivirus software on it, and most people don’t even know how to interact with a router other than flipping the power switch. Even worse, when a router is infected it compromises all the other devicesthat it comes in contact with, forwarding the virus or intercepting personal information and login credentials that go through it.

VPNFilter, the worst nightmare of your router

Our cautionary story about router security starts with VPNFilter. Don’t let the name fool you: this horrendous piece of software has nothing to do with virtual private networks, the title is only meant to pull the wool over the eyes of those who are inspecting the system’s activity log. The main purpose of VPNFilter is to smuggle harmful modules into the system that interact with the data stream in numerous ways.

The first component manipulates the information stream by tampering with the format. This not only prevents the message from being encrypted but also messes with data compression, effectively increasing the traffic load. A recently discovered module has an even more sinister agenda though, as it scans the incoming data packages for certain keywords to sniff out login credentials and sensitive information that are ripe for stealing like a digital hunting dog. The final part to all this is a kill switch that renders the router unusable by deleting important files.

The possibility of your router turning against you and exposing your secrets to an unscrupulous individual is no doubt a grim thought, especially if we look at the numbers. According to the researchers at Cisco more than 500,000 commercially used routers have already fallen preyto VPNFilter. This is topped by the shocking realization that the virus isn’t even restricted to a single model. Popular manufacturers such as ASUS, D-Link, NetGear, ZTE, and Huawei are among the possible victims, but the full list is much longer.

How to get rid of It?

The reason why security experts are worried about malware targeting routers is because it’s very difficult to spot the infection, let alone purge it. It requires manually accessing the event log of your router and digging through walls of data or extracting the firmware from the unit to compare its behavior with an authorized one – both options that are out of the question for most internet users. The only telltale sign of a compromised router is your connection speed being drastically reduced for no apparent reason.

Getting rid of the malware is just as tricky because rebooting the device won’t solve the issue this time. The most sensible actions are to either ask for the help of a tech pro at your local PC store or turn directly to the manufacturer. Alternatively, restoring the system to factory settings might help or you could just buy a new router.

Can VPNs help?

Considering the gravity of the issue and the difficulties surrounding the removal of malware, preventing the breach seems to be the most prudent course of action. Unfortunately, very little is known about how the process should go. The plan of action for infecting routers differs with each firmware since the malware exploits device-specific flaws to embed itself on board the route.

In this sense part of the blame is on the manufacturers, who are fairly laid-back when it comes to patches and firmware updates. Another virus that surfaced alongside VPNFilter is called Satoriand it turns the computers in the household into Bitcoin mining slave machines via infected D-Link routers. The major problem with Satori is that it sneaks-in via a security loophole that hasn’t been updated since 2016.

When it comes to defending your router from intrusive software it’s important to use preventive measures. First and foremost, change the default password and disable remote administration, otherwise the cybercriminal’s job is far too easy. Secondly, run the router from behind a reliable firewall. The third option is to install a VPN onto the device. Doing so adds another layer of security as the encrypted data stream means that attackers cannot track and interfere with your ‘real’ traffic. If you plan to purchase a new router, then it’s also a good idea to opt for one that comes pre-installed with VPN software.