Thinking about the recent news regarding SOHO routers vulnerable to the VPNFilter attack: https://arstechnica.com/information-technology/2018/05/fbi-tells-router-users-to-reboot-now-to-kill-malware-infecting-500k-devices/ .
Theoretically, could a Intrusion Prevention System (IPS) appliance (Snort, Suricata, Cisco, Juniper, Barracuda, etc.) placed in between an ISP/gateway and a vulnerable router/firewall have blocked the attack, assuming a matching signature was already installed in the appliance database?
More interestingly, is anyone aware of any evidence that an IPS did block such an attack?
Or–even if blocking such an attack were possible–would it have been too late if this was in fact a zero-day attack?
Usually, IPS is seen as a tool to protect end-users from malware, though, as more websites are encrypted, IPS is seen by some as moot since it cannot easily inspect such encrypted traffic. But could it still be useful to block attacks on the router/firewall itself?