Further reading provided once again by Dan Goodin
Companies were slow to remove Russian spies’ malware, so FBI did it for them
How the FBI took down "Cyclops Blink," a Russia state botnet infecting network firewalls.
"The FBI remotely accessed and disinfected US-located devices running a powerful new strain of Russian state botnet malware, federal authorities said Wednesday. Those authorities added that the Kremlin was using the malware to wage stealthy hacks of its adversaries.
The infected devices were primarily made up of firewall appliances from WatchGuard and, to a lesser extent, network devices from Asus. Both manufacturers recently issued advisories providing recommendations for hardening or disinfecting devices infected by the botnet, known as Cyclops Blink. It is the latest botnet malware from Russia’s Sandworm, which is among the world’s most elite and destructive state-sponsored hacking outfits.
Regaining control
Cyclops Blink came to light in February in an advisory jointly issued by the UK’s National Cyber Security Centre (NCSC), the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and the Federal Bureau of Investigation (FBI). WatchGuard said at the time that the malware had infected about 1 percent of network devices it made.Cyclops Blink was a replacement for another piece of Sandworm-designed malware known as VPNFilter, which researchers discovered in 2018 infecting 500,000 US-based routers made by Linksys, MikroTik, Netgear, QNAP, and TP-Link.
The FBI quickly seized a server Sandworm was using to infect devices with VPNFilter. Once that was completed, the bureau instructed the public to reboot their devices. With that, the botnet was dismantled.
Cyclops Blink was Sandworm’s attempt to regain persistent control of networking devices, and the malware almost worked . . .
Slippery slopes and the law of unintended consequences
Following the February advisory, however, the number of devices in the Cyclops Blink botnet fell by just 39 percent. In response, the FBI went one step further than it did with VPNFilter in 2018. In a clandestine takedown operation cloaked by a federal warrant, agents remotely accessed infected WatchGuard devices connected to 13 US-based IP addresses. . .
It’s not the first time the FBI has remotely accessed an infected device to remove a threat, but it is an early example. Many security professionals have raised concerns that such moves have the potential to cause harm if such actions accidentally disrupt a mission-critical process. Privacy advocates have also decried the exposure such actions may have on private individuals’ information.
Jake Williams, a former hacker for the NSA and now Executive Director of Cyber Threat Intelligence at security firm SCYTHE, voiced the same concerns surround this case. He said the specific steps the FBI took, however, left him feeling more comfortable. In a message, he wrote:
I think it’s always dicey for LE [law enforcement] to modify anything on a server that they don’t control. However, in this case, I don’t think there was significant risk, so the benefits clearly outweighed the risks. Many will cite slippery slope arguments as reasons this particular action was improper, but I think that’s wrong. The fact that the FBI coordinated with private enterprise (WatchGuard) in this action is particularly significant.
The FBI affidavit said, last September, agents interviewed representatives of a company operating an infected device on its network. The company allowed the agents to take a forensic image of the machine and to “prospectively observe the network traffic associated with the firewall appliance.”
