Railfan Technology > NYT: "FBI Urgent Request: Reboot Your Router to Stop Russia"

https://www.nytimes.com/2018/05/27/technology/router-fbi-reboot-malware.html

"Hoping to thwart a sophisticated malware system linked to Russia that has infected hundreds of thousands of internet routers, the F.B.I. has made an urgent request to anybody with one of the devices: Turn it off, and then turn it back on.

The malware is capable of blocking web traffic, collecting information that passes through home and office routers, and disabling the devices entirely, the bureau announced on Friday."

https://www.ic3.gov/media/2018/180525.aspx

In the past few days the general idea is they have cut off the obvious route for the Malware commands to be executed but now need everybody to empty the Malware out of their Routers.

Just a good idea to reboot occasionally anyways.

I just did mine. Waited 30 seconds before turning it back on, but all the led lights stayed red. I said "uh,oh".
Flicked it on and off again, and it was fine.

If you have instructed your ISP to have their router in bridge mode only and have your own firewall/router behind theirs, you are not subject to these type of problems.

By default, your own router (not the ISP's) is almost always set up to use the IP 192.168.1.1. The router then assigns sequential IP numbers above that to the other devices on your own network. So hackers attempting to get into your network will use 192.168.1.1 first. With that in mind, I configured my router to start at a different IP value, such as 192.168.1.36.



Edited 1 time(s). Last edit at 05/29/18 10:36 by norm1153.

norm1153 Wrote:
-------------------------------------------------------
> By default, your own router (not the ISP's) is
> almost always set up to use the IP 192.168.1.1.
> The router then assigns sequential IP numbers
> above that to the other devices on your own
> network. So hackers attempting to get into your
> network will use 192.168.1.1 first. With that in
> mind, I configured my router to start at a
> different IP value, such as 192.168.1.36.

FYI, IPs starting with 192.168.x.x are non-routable, meaning they are non-existent to the Internet. They are specifically reserved for private network use only.

The only way a hacker knowing the internal private IP address could help them is IF they had access to the router/firewall that was doing the private IP address translation, commonly known as NAT.

Oh well, I wish I hadn't posted that. To get more technical, the home system can be referred to as the inTRAnet, as opposed to inTERnet. All of these devices we use can indeed be configured for a firm IP address, or allow the upstream (your) router to assign one. I was "trying" to give a simple tip to help in avoiding a hacking situation. My router is instructed to assign IP addresses to clients (PC's, macs, TV's, NAS's, etc.) beginning with a certain value; i.e., 192.168.1.123, as an example.
The potential hacker would start with 192.168.1.1 and try to hack the router. Yes, I also know 192.168.1.* is not known to the outside world.
There's more, but now I will be silent, and not reply on this topic, and let someone else have the last word.
Good Grief Charlie Brown!



Edited 1 time(s). Last edit at 05/29/18 15:52 by norm1153.