4

Articles in the past few days have mentioned the FBI recommending folks restarting their routers to avoid “Russian” malware from affecting some 500,000 routers.

This made me curious; what could restarting the router do to stop malware? Is this because Internet routers typically have software that checks for updates every time you restart them, and the ISPs and/or router manufacturers have issued patches to address a vulnerability, or is there something more interesting going on?

6

Short answer: It erases the volatile memory, which is where the plug-ins are stored that you're referring to. This was what was doing the heavy-lifting of the malware.

To fully get rid of malware, you are correct that the router's firmware will need to be upgraded or wiped and re-installed, but the malware referenced here used various plug-ins that lived in and used the volatile parts of memory, similar to the RAM. This means a simple reboot killed whatever plugin was in use, but did not totally disinfect the router.

Check here for a more in-depth explanation. Some important excerpts from the link include:

Once in place, the malware reports back to a command-and-control infrastructure that can install purpose-built plug-ins, according to the researchers. One plug-in lets the hackers eavesdrop on the victim’s Internet traffic to steal website credentials; another targets a protocol used in industrial control networks, such as those in the electric grid. A third lets the attacker cripple any or all of the infected devices at will.

And:

That allowed the bureau to identify a key weakness in the malware. If a victim reboots an infected router, the malicious plugins all disappear, and only the core malware code survives.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.