(Credit: TP-Link)
UPDATE 5/1: Spectrum is notifying US customers about Russian spies exploiting vulnerable TP-Link routers to conduct hacking activities. The only problem is that addressing the problem might require people to throw away their TP-Link routers altogether. “If your router is over 5 years old, consider replacing it,” Spectrum says in an email.
Original Story:
A Russian state-sponsored hacking group has been targeting vulnerable consumer Wi-Fi routers, including 23 TP-Link models, some of which have reached "end of life" status.
The threat involves Fancy Bear, also known as APT 28, a notorious hacking group affiliated with Russian military intelligence. On Tuesday, Microsoft and the UK’s National Cyber Security Centre (NCSC) said the group has been hacking vulnerable routers to manipulate internet traffic and harvest login information.
“Microsoft Threat Intelligence has identified over 200 organizations and 5,000 consumer devices" that have been under attack since at least August, the company warned.
Microsoft did not identify the affected device models, but the NCSC published a list and said the Russians are targeting numerous TP-Link products, many of which were originally released over a decade ago. TP-Link lists over half of them as "end of life," meaning they are no longer on sale and do not receive new software updates, including security patches.
(Credit: TP-Link)
(Credit: NCSC)The NCSC urges the public to “apply security updates promptly” and “use modern systems and software,” suggesting that affected owners should replace outdated hardware. Although TP-Link offers automatic firmware updates, the feature appears to apply only to newer Archer models; everyone else needs to download and install firmware updates manually.
The US Justice Department is also calling on users to "Replace End-of-Life and End-of-Support routers." Federal agents executed a court order to neutralize the US-compromised routers by sending a series of commands to boot the Russian hackers out and prevent re-hijackings. That said, consumers can still reverse the change by performing a factory reset or manually restoring the default settings.
"We urge all router owners to take the remediation steps outlined today, because defending our networks requires all of us," said Assistant Director Brett Leatherman of the FBI’s Cyber Division.
(Credit: DOJ)Germany's intelligence office added that the Russian hackers were targeting outdated routers, which were replaced to stop the threat. "In total, APT28 attacked several thousand of these publicly accessible TP-Link devices. Approximately 30 vulnerable devices have been identified in Germany," the office said.
The Russian hackers are likely hijacking routers using publicly known vulnerabilities, including CVE-2023-50224, which was disclosed two years ago. The flaw has been known to affect TP-Link TL-WR841N routers, a product that’s been around for nearly two decades and is still on the market as version v14; the v1 version was discontinued.
UK authorities also detected Russian hackers targeting “a small number of MikroTik routers, often located in Ukraine, that were likely of intelligence value to the actor.”
Fancy Bear hijacks routers to overwrite Domain Name System settings, redirecting internet traffic intended for legitimate sites to hacker-controlled DNS servers, which can then ferry users to malicious web pages. Because the malicious web pages look like legitimate services, users can be fooled into entering their passwords and two-factor codes, which the hackers steal.
(Credit: NCSC)“Lookups for domain names containing key terms associated with particular services, often email applications or login pages, would then be resolved by the malicious DNS servers to further actor-owned IP addresses,” the NCSC added. Although the spying can target a large number of users, the goal is to profile “victims of likely intelligence value,” the agency said.
TP-Link didn’t immediately respond to a request for comment. The hacking was disclosed after the US Federal Communications Commission enacted a controversial ban on new foreign-made Wi-Fi router models, citing the threat of supply chain vulnerabilities. All consumer router manufacturers are expected to be affected, as electronics manufacturing largely happens in Asia.
Editor's Note: This story has been updated with information from the Justice Department.