VPNFilter router virus more dangerous and widespread than initially thought

Ongoing analysis of the sophisticated VPNFilter router malware, revealed by networking firm Cisco two weeks ago and thought to have infected up to 500,000 devices, has found the virus is potentially more dangerous to users than previously thought, and affects a much broader range of devices.

The modular virus targets networking equipment such as home and small-business routers, NAS boxes and network switches, and has now been discovered on devices from ASUS, D-Link, Huawei, Ubiquiti, UPVEL, and ZTE.

Originally, researchers had found VPNFilter residing on devices from Linksys, Netgear, QNAP and TP-Link. Huawei's name in the list is likely to get the most attention as the vendor is a popular original device manufacturer for big internet service providers such as UK-based TalkTalk.

The initial infection was deemed dangerous enough that, shortly after Cisco revealed its existence, the FBI took action to seize a domain that the virus was using as a command-and-control server.

The US law agency also issued a global warning to owners of potentially-infected devices, asking them to reboot their equipment — a step that would erase the more dangerous parts of the malware and help prevent it from being able to cause any further damage.

Related: New internet of things security code aims to stamp out Mirai and other threats

New capabilities uncovered

Initially thought to be a fairly standard botnet, which would use infected gear to wage cyber attacks on other targets, Cisco’s Talos Intelligence Group has since uncovered new capabilities in the malware – ones which could put owners of infected routers at greater risk.

In particular, a module called ‘ssler’ seems specifically designed to compromise internet traffic being sent to and from an infected router. The module uses a ‘man in the middle’ style attack that attempts to downgrade secure HTTPS web traffic so that data is sent over HTTP as unencrypted plaintext, which makes sensitive information such as logins and passwords much easier to intercept and capture.

Cisco has not revealed a total number for how many additional devices it now believes could be infected, but has said that despite earlier warnings that users should reboot at-threat devices, the malware still persists in the wild and that the threat "continues to grow”.

Cisco provided an updated list of devices that could be affected, so if you own one of the below, you’re strongly advised to reboot it: