FBI Disrupts Russian Hacking Operation Targeting Home Routers

The FBI and the Justice Department have disrupted a Russian military intelligence cyberespionage campaign that exploited vulnerabilities in small office and home office (SOHO) routers. The operation, attributed to a hacking group known as APT28, Fancy Bear, and Forest Blizzard, used compromised routers to reroute internet traffic, monitor targets, and steal sensitive information.

The hackers altered router settings to direct internet requests through servers they controlled. This allowed them to intercept data, including login credentials and authentication tokens. The Justice Department announced the disruption of the U.S. portion of this network in April. However, officials emphasize that individual users must take steps to secure their own devices, as law enforcement cannot remotely update routers or change user passwords.

How the Attack Worked

The exploited routers, typically used by small businesses, remote workers, and some households, had their Domain Name System (DNS) settings altered. DNS acts as the internet's address book, translating website names into IP addresses. By controlling DNS settings, the attackers could redirect users to malicious servers, enabling them to steal data without obvious signs of compromise to the user. The victim's devices might appear to function normally while their traffic is secretly routed through compromised infrastructure.

Vulnerabilities in Older Routers

Many routers become vulnerable when manufacturers cease providing support and security updates. Users often keep these devices for extended periods, leaving known security flaws unpatched. A significant weak point is the failure to change the router's administrative password, which is distinct from the Wi-Fi password. If this default password remains unchanged, it provides an easier entry point for attackers, even if other devices on the network use strong passwords.

Targeted Router Models

The FBI specifically identified the TP-Link WR841N model as being targeted. The UK National Cyber Security Centre also listed other TP-Link models affected by APT28. While the list may not be exhaustive, some of the named TP-Link routers include:

• TP-Link LTE Wireless N Router MR6400
• TP-Link Wireless Dual Band Gigabit Router Archer C5
• TP-Link Wireless Dual Band Gigabit Router Archer C7
• TP-Link Wireless Dual Band Gigabit Router WDR3600
• TP-Link Wireless Dual Band Gigabit Router WDR4300
• TP-Link Wireless Dual Band Router WDR3500
• TP-Link Wireless Lite N Router WR740N
• TP-Link Wireless Lite N Router WR740N/WR741ND
• TP-Link Wireless Lite N Router WR749N
• TP-Link Wireless N 3G/4G Router MR3420
• TP-Link Wireless N Access Point WA801ND
• TP-Link Wireless N Access Point WA901ND
• TP-Link Wireless N Gigabit Router WR1043ND
• TP-Link Wireless N Gigabit Router WR1045ND
• TP-Link Wireless N Router WR840N
• TP-Link Wireless N Router WR841HP
• TP-Link Wireless N Router WR841N
• TP-Link Wireless N Router WR841N/WR841ND
• TP-Link Wireless N Router WR842N
• TP-Link Wireless N Router WR842ND
• TP-Link Wireless N Router WR845N
• TP-Link Wireless N Router WR941ND
• TP-Link Wireless N Router WR945N

TP-Link acknowledged awareness of the reports concerning legacy consumer routers, stating that many of the listed models have reached their End of Service and Life status. The company noted that while these products are outside their standard maintenance lifecycle, security updates have been developed for select legacy models where technically feasible. TP-Link advises customers using outdated devices to upgrade to currently supported hardware and implement immediate precautions such as updating firmware, disabling remote management, and restricting access to trusted internal networks.

Protecting Your Router

Users can take several steps to enhance their router's security and mitigate risks:

1. Check Router Model: Identify the router model and check the manufacturer's support page for firmware updates. Replace unsupported or end-of-life devices.
2. Update Firmware: Regularly check for and install firmware updates, which often address security vulnerabilities. Enable automatic updates if available.
3. Change Admin Password: Replace the default administrative username and password with a strong, unique password. This is separate from the Wi-Fi password.
4. Disable Remote Management: Turn off remote management features unless they are essential, as they can provide an external access point for attackers.
5. Reboot Router: Regularly restarting the router can help clear temporary malicious activity.
6. Monitor Browser Warnings: Pay attention to browser certificate warnings, which may indicate interference with secure connections.
7. Use a VPN: For sensitive work or data, utilize a company-approved Virtual Private Network (VPN).
8. Install Antivirus Software: Robust antivirus software can protect devices from malware and phishing attempts.
9. Consider Identity Theft Protection: Services can monitor for misuse of personal information if credentials are stolen.
10. Data Removal Services: Reducing personal information available online can make it harder for attackers to build profiles.
11. Replace Outdated Routers: If a router no longer receives security updates, replacing it is crucial for network security.

By taking these measures, individuals and small businesses can significantly reduce their vulnerability to such cyber threats.