Good morning and happy Friday my friend!
I was on a call with the FBI yesterday and they were really worried about what China was up to, specifically the Chinese state-backed hacking group Volt Typhoon. I know, it sounds made up, but they're very real and have figured out how to attack our electrical grid, water plants, telecommunications networks and even our military using what you might least expect - our old networking stuff.
Not sure about you, but when a pair of shoes or underwear get too old, I give them the old salute and put it in the trash without a second thought. Not so with old networking gear. In a Bleeping Computer article referenced in the FBI call, threat actors such as Volt Typhoon are having a field day by taking over outdated SOHO (small office, home office) routers and then using them to launch coordinated attacks against US critical infrastructure.
The Takeaway
The number of hijacked devices is staggering and could easily be in the millions. It's not just limited to internet connected routers but smart devices such as light bulbs, plugs, TV's, sprinkler controllers, IP security cameras, weather stations or any gadget falling into the category of "internet of things" connected devices.
While CISA is urging manufacturers to build security measures into these products, they are mass produced, overseas and try to stay price competitive. Let's face it - there are already millions of them already out there, all connected to the internet. They're ripe for the picking.
I asked our FBI contact if there was some sort of list or database available of these known vulnerable or infected devices and they didn't have one. Not because they didn't want to hand one out, but because there's just too many vulnerable devices out there. So what can you do? Follow the A-B-C method:
(A) Aware. Are you aware if the router or devices you're using is end-of life? A quick Google search of the make and model on the bottom will tell you. You don't necessarily need to replace it, but there's likely new firmware (the embedded software on the unit) that could be out of date and vulnerable. See if you can update it and if not, it's time to give it the old salute.
(B) Break it up. Are your "smart" devices like bulbs, plugs and cameras connected to your guest wi-fi or the same one you use for your laptop where you do your banking and emails? You can probably see the problem here. It's time to break things up and move those gadgets onto a guest wireless network where they won't be able to monitor and intercept your private internet traffic.
(C) Call for help. Not sure where to start? Ask a friend or call for help. In fact, if you're worried about your router being out of date, especially at a business, give us a call or email me a picture of the tag and we'll check it out.
Let's do our part to keep America safe. Good cyber hygiene can go a long way in keeping our lights on, water safe to drink and military mission ready.
Stay safe out there.
-Attila
PS. If you think this email might be of value to a friend or colleague, feel free to forward it along.