Could an IPS have blocked an attack on a vulnerable router/firewall?

Question

Thinking about the recent news regarding SOHO routers vulnerable to the VPNFilter attack: https://arstechnica.com/information-technology/2018/05/fbi-tells-router-users-to-reboot-now-to-kill-malware-infecting-500k-devices/ .

Theoretically, could a Intrusion Prevention System (IPS) appliance (Snort, Suricata, Cisco, Juniper, Barracuda, etc.) placed in between an ISP/gateway and a vulnerable router/firewall have blocked the attack, assuming a matching signature was already installed in the appliance database?

More interestingly, is anyone aware of any evidence that an IPS did block such an attack?

Or–even if blocking such an attack were possible–would it have been too late if this was in fact a zero-day attack?

Usually, IPS is seen as a tool to protect end-users from malware, though, as more websites are encrypted, IPS is seen by some as moot since it cannot easily inspect such encrypted traffic. But could it still be useful to block attacks on the router/firewall itself?

Answer 1

Theoretically, could a Intrusion Prevention System (IPS) appliance ... placed in between an ISP/gateway and a vulnerable router/firewall have blocked the attack, assuming a matching signature was already installed in the appliance database?

There are several parts of the attack which could be used for signatures:

• The initial infection, which was maybe done by accessing the remote management interface of the to-be-infected systems. While attempted access to such interface might be considered malicious in most cases there are still valid reasons for such an access so a relevant signature might result in false positives.
• The C2 communication after a successful infection. According to the available information the communication was done using Tor or SSL. The use of Tor itself might be suspicious but is also legal, so the chance for false positives is here too. SSL is hard to analyze but one might only check SSL to specific destinations and then check for atypical client-side fingerprints (i.e. ClientHello). But again, the chance for false positives exist.

If you look at the report from Cisco you'll see at the end the coverage for this issue by Cisco products and you'll see that it seems to rely on detecting the C2 communication.

Or–even if blocking such an attack were possible–would it have been too late if this was in fact a zero-day attack?

While the initial infection might have been zero-day (or not, since systems with known issues were attacked) the later C2 communication was not. Thus the ISP might not have been able to protect systems against infection but might (with maybe considerable efforts) be able to detect infected system and limit what they could do by informing the customers and/or limiting traffic from these systems.

Answer 2

Yes an IPS could have blocked the attacks. In the most simple example, a rule can be created that would match any packet and drop it. In this case while not practical, it would block the attacks.