Any idea which routers were vulnerable to this? Article didn’t seem to specify.
this post was submitted on 15 Feb 2024
140 points (96.7% liked)
World News
40403 readers
4115 users here now
A community for discussing events around the World
Rules:
-
Rule 1: posts have the following requirements:
- Post news articles only
- Video links are NOT articles and will be removed.
- Title must match the article headline
- Not United States Internal News
- Recent (Past 30 Days)
- Screenshots/links to other social media sites (Twitter/X/Facebook/Youtube/reddit, etc.) are explicitly forbidden, as are link shorteners.
-
Rule 2: Do not copy the entire article into your post. The key points in 1-2 paragraphs is allowed (even encouraged!), but large segments of articles posted in the body will result in the post being removed. If you have to stop and think "Is this fair use?", it probably isn't. Archive links, especially the ones created on link submission, are absolutely allowed but those that avoid paywalls are not.
-
Rule 3: Opinions articles, or Articles based on misinformation/propaganda may be removed. Sources that have a Low or Very Low factual reporting rating or MBFC Credibility Rating may be removed.
-
Rule 4: Posts or comments that are homophobic, transphobic, racist, sexist, anti-religious, or ableist will be removed. “Ironic” prejudice is just prejudiced.
-
Posts and comments must abide by the lemmy.world terms of service UPDATED AS OF 10/19
-
Rule 5: Keep it civil. It's OK to say the subject of an article is behaving like a (pejorative, pejorative). It's NOT OK to say another USER is (pejorative). Strong language is fine, just not directed at other members. Engage in good-faith and with respect! This includes accusing another user of being a bot or paid actor. Trolling is uncivil and is grounds for removal and/or a community ban.
Similarly, if you see posts along these lines, do not engage. Report them, block them, and live a happier life than they do. We see too many slapfights that boil down to "Mom! He's bugging me!" and "I'm not touching you!" Going forward, slapfights will result in removed comments and temp bans to cool off.
-
Rule 6: Memes, spam, other low effort posting, reposts, misinformation, advocating violence, off-topic, trolling, offensive, regarding the moderators or meta in content may be removed at any time.
-
Rule 7: We didn't USED to need a rule about how many posts one could make in a day, then someone posted NINETEEN articles in a single day. Not comments, FULL ARTICLES. If you're posting more than say, 10 or so, consider going outside and touching grass. We reserve the right to limit over-posting so a single user does not dominate the front page.
We ask that the users report any comment or post that violate the rules, to use critical thinking when reading, posting or commenting. Users that post off-topic spam, advocate violence, have multiple comments or posts removed, weaponize reports or violate the code of conduct will be banned.
All posts and comments will be reviewed on a case-by-case basis. This means that some content that violates the rules may be allowed, while other content that does not violate the rules may be removed. The moderators retain the right to remove any content and ban users.
Lemmy World Partners
News [email protected]
Politics [email protected]
World Politics [email protected]
Recommendations
For Firefox users, there is media bias / propaganda / fact check plugin.
https://addons.mozilla.org/en-US/firefox/addon/media-bias-fact-check/
- Consider including the article’s mediabiasfactcheck.com/ link
founded 2 years ago
MODERATORS
I answered this in my top-level comment. (And agreed: the article originally posted is useless. OP has since changed the link to the one I found.)
Right on, thank you!
Check for a DOJ press release it'll probably have more details.
This article gives no details, but here's a relevant bit from another article:
Cybercriminals not linked with the GRU (Russian Military Intelligence) first infiltrated Ubiquiti Edge OS routers and deployed the Moobot malware, targeting Internet-exposed devices with widely known default administrator passwords.
Subsequently, the GRU hackers leveraged the Moobot malware to deploy their own custom malicious tools, effectively repurposing the botnet into a cyber espionage tool with global reach.
[...]
"Additionally, in order to neutralize the GRU's access to the routers until victims can mitigate the compromise and reassert full control, the operation reversibly modified the routers' firewall rules to block remote management access to the devices, and during the course of the operation, enabled temporary collection of non-content routing information that would expose GRU attempts to thwart the operation," the Justice Department said.
And here is the press release:
Based on this article it sounds like as long as you don’t have open ports for remote administration open and/or if you’ve changed the default admin password you SHOULD be ok? I’m curious to see what recommendations Ubiquiti has regarding this.
That's what the released information information suggests, yes. (Edit: Assuming you took those precautions before the original attack, of course.)
Thank you. I've updated the post to your link.
Makes me glad I replaced the firmware on my Unifi devices with OpenWrt
OpenWrt has an admin password and UI as well. I hope you changed the former and blocked the latter on external ports, before connecting it to the internet.
Indeed. Pretty sure the latter is blocked by default.
Yes of course I changed the root password, I think it would actually be quite difficult not to do that on OpenWrt as it warns you if the password isn't set.
Was the exploit not related to unifi's remote / cloud administration features? That's how I read it, unless they mean remote admin that was installed by the malware.
UniFi and Edge are different product lines. UniFi uses a controller (local or cloud-based) and edge products are the more traditional interface on the device itself.
The article clearly states that edgerouter is the affected product, which means the default password and remote admin interface were the attack vectors.
Thanks, I find the names of Ubiquiti's product lines pretty confusing particularly as they are often used together.
I have an Edgerouter X, an Edgerouter PoE-5, two UAP-AC-LR ("Ubiquiti UniFi-AC-LR") access points, and one UAP-AC-MESH ("Ubiquiti UniFi-AC-MESH") access point.
The access points came with UniFi firmware, whereas the routers were running EdgeOS. I'm no longer using the PoE-5 and I've replaced the firmware on all of the other devices with OpenWrt.
The articles refer to EdgeOS, not UniFi, which is a separate thing.