Do I need to reboot my router?

[bkellar878]

I just read that the FBI recommends rebooting routers due to VPNFilter malware. Does that apply to the router that Sonic supplied me?

[miken]

I recall the impacted equipment list on Ars Technica being mostly Netgear and Linksys model routers. Pace and SmartRG are not on there.

Edit: Link for reference https://arstechnica.com/information-tec ... h-malware/

[Oaklandrone]

I also want to know if it is a problem with Sonic/ATT's router because the article says: "Among the affected networking equipment it found during its research were devices from manufacturers including Linksys, MikroTik, Netgear and TP-Link."

I took the "among the affected networking equipment" as those four and maybe others they know or have not yet tested. I A definitive answer by Sonic would ease my mind. Especially because what they wrote happened to me last night. My access to the web slowed and stopped for several minutes. I had to shut down three browsers, reset the router and the PC. Though the web access worked after that I got paranoid and ran a malware check with Malwarebytes which found the PC "clean."

Then I read the NYT article just now and the anxiety level just shot up. If no one else jumps in with an answer I'll have to start with Sonic support.

[miken]

If you’ve got a Sonic owned and managed router, we keep it secure. If you own any other third party routers, you should reboot to err on the side of caution.

Edit: Spelling

[root]

'err' not 'air'

[dengle]

Hi @miken,

Your reply, "If you’ve got a Sonic owned and managed router, we keep it secure. If you own any other third party routers, you should reboot to err on the side of caution." is what I just received from support@sonic. However, I'm hearing that more drastic measures are required. First it was thought that a reboot of the router would solve it. But now I'm hearing you should reset the router to factory, which obviously Sonic support is not going to do because users will lose access to their wifi.

Quoting from a discussion at UC Berkeley:

Two very informative posts are available from Talos:

[1] https://blog.talosintelligence.com/2018 ... ilter.html
[2] https://blog.talosintelligence.com/2018 ... pdate.html

The FBI has released an announcement on May 23 - recommending rebooting devices:

[3] https://www.justice.gov/opa/pr/justice- ... t-infected


However, based on information from Talos, rebooting is ineffective in removal - as one stage of VPNFilter is known to survive reboots.

Talos recommends reseting to factory default, applying all pending firmware updates and using a strong password for the admin user.

Talos released a longer list of known affected devices today (see [2] above).

[miken]

But now I'm hearing you should reset the router to factory, which obviously Sonic support is not going to do because users will lose access to their wifi.

We don't manage third party routers for users - we only support Sonic provided equipment, which doesn't require action from the user to keep secure as our equipment is not impacted by this.

[ronks]

To follow up on this thread, are settings for my (Sonic-provided but with at&t U-verse logo) router accessible from my Windows 10 desktop to which it's cable-attached?
I'm mostly asking out of curiosity, but it would be useful to know.

[miken]

Yes. Some settings are locked by AT&T, but there are some things you can modify. IP address and username/password for modifying settings will be located on the sticker on the side of the modem.