1

Thinking about the recent news regarding SOHO routers vulnerable to the VPNFilter attack: https://arstechnica.com/information-technology/2018/05/fbi-tells-router-users-to-reboot-now-to-kill-malware-infecting-500k-devices/ .

Theoretically, could a Intrusion Prevention System (IPS) appliance (Snort, Suricata, Cisco, Juniper, Barracuda, etc.) placed in between an ISP/gateway and a vulnerable router/firewall have blocked the attack, assuming a matching signature was already installed in the appliance database?

More interestingly, is anyone aware of any evidence that an IPS did block such an attack?

Or–even if blocking such an attack were possible–would it have been too late if this was in fact a zero-day attack?

Usually, IPS is seen as a tool to protect end-users from malware, though, as more websites are encrypted, IPS is seen by some as moot since it cannot easily inspect such encrypted traffic. But could it still be useful to block attacks on the router/firewall itself?

1

Theoretically, could a Intrusion Prevention System (IPS) appliance ... placed in between an ISP/gateway and a vulnerable router/firewall have blocked the attack, assuming a matching signature was already installed in the appliance database?

There are several parts of the attack which could be used for signatures:

  • The initial infection, which was maybe done by accessing the remote management interface of the to-be-infected systems. While attempted access to such interface might be considered malicious in most cases there are still valid reasons for such an access so a relevant signature might result in false positives.
  • The C2 communication after a successful infection. According to the available information the communication was done using Tor or SSL. The use of Tor itself might be suspicious but is also legal, so the chance for false positives is here too. SSL is hard to analyze but one might only check SSL to specific destinations and then check for atypical client-side fingerprints (i.e. ClientHello). But again, the chance for false positives exist.

If you look at the report from Cisco you'll see at the end the coverage for this issue by Cisco products and you'll see that it seems to rely on detecting the C2 communication.

Or–even if blocking such an attack were possible–would it have been too late if this was in fact a zero-day attack?

While the initial infection might have been zero-day (or not, since systems with known issues were attacked) the later C2 communication was not. Thus the ISP might not have been able to protect systems against infection but might (with maybe considerable efforts) be able to detect infected system and limit what they could do by informing the customers and/or limiting traffic from these systems.

  • Thanks for the answer. It looks like you crossed Internet Service Provider with Intrusion Prevention System. In my question, one would likely be running an IPS appliance on premises between the WAN and the potentially vulnerable router. – medbot May 31 '18 at 19:28
  • @medbot: yes, I probably was seeing ISP where you've wrote IPS. I've reworked the answer. – Steffen Ullrich May 31 '18 at 19:56
-1

Yes an IPS could have blocked the attacks. In the most simple example, a rule can be created that would match any packet and drop it. In this case while not practical, it would block the attacks.

  • Was it really worth the time you used writing this shallow and pedantic answer? Do you not have better, more fulfilling things to do in life? – Adonalsium Jul 13 '18 at 13:31
  • lol, lil salty there buddy. Simple questions get simple answers. It seems like OP doesn't really understand IPS at a very basic level. – MikeSchem Jul 15 '18 at 15:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.