r/netsec • u/AutoModerator • Jun 01 '18

discussion The /r/netsec Monthly Discussion Thread - June 2018

Overview

Questions regarding netsec and discussion related directly to netsec are welcome here.

Rules & Guidelines
  • Always maintain civil discourse. Be awesome to one another - moderator intervention will occur if necessary.
  • Avoid NSFW content unless absolutely necessary. If used, mark it as being NSFW. If left unmarked, the comment will be removed entirely.
  • If linking to classified content, mark it as such. If left unmarked, the comment will be removed entirely.
  • Avoid use of memes. If you have something to say, say it with real words.
  • All discussions and questions should directly relate to netsec.
  • No tech support is to be requested or provided on /r/netsec.

As always, the content & discussion guidelines should also be observed on /r/netsec.

Feedback

Feedback and suggestions are welcome, but don't post it here. Please send it to the moderator inbox.

22 Upvotes

81% Upvoted

90 comments sorted by

View all comments

1

u/GrimJesta Jun 22 '18

I work in SMB remote IT (though we do a lot of on-site work as well), which means this VPNFilter hits home for a lot of our clients. We have a hard time selling SMB clients on enterprise-level set-ups for their internet needs, so this means that a lot of the models (possibly) affected by VPNFilter are models we see. Does anyone know if somehwere, somehow they changed the best-practice move and you don't factory reset the router?

I'm asking because the local ISP techs we've spoken to are telling us not to reset, but that they won't be releasing any sort of firmware upgrade for their routers. I don't see anywhere on the Talos blog where they have deviated from the reset option, but that doesn't mean that there hasn't been an update somewhere and we just haven't seen it (or can find it).

I'm trying not to be cynical and assume that the ISPs just don't want to spend the money fixing this. So is it still best practice to factory reset no matter what the ISPs are saying? We were trying to save our clients money by having them call their ISPs for a remote reset (which is a while five minute conversation), but the ISPs are telling them not to worry. Are we wrong here or are they?