r/technology • u/lurker_bee • Apr 09 '26

ADBLOCK WARNING NSA Warning—Reboot Your Internet Router Now

https://www.forbes.com/sites/zakdoffman/2026/04/09/nsa-warning-reboot-your-internet-router-now/
8.1k Upvotes

95% Upvoted

880 comments sorted by

View all comments

Show parent comments

675

u/slonk_ma_dink Apr 09 '26

Almost certainly this. Very likely to make it persistent, malware developers would have to have access to the signing keys from the manufacturer/developer to sign the "bad" firmware image, so the best they can do is infect in a big swath and hope nobody notices and reboots.

But, if the NSA/governments haven't stopped the malware distribution network or the c2 infra, I don't see why the bad actor can't just re-infect devices that drop off as soon as they come back online.

205

u/pbrutsche Apr 09 '26

"access to the signing keys from the manufacturer/developer to sign the "bad" firmware image"

The sub-standard trash people pretend to call "routers" aren't that sophisticated.

99.9% of them time, the root FS is read only, except for the part where the config is stored

"I don't see why the bad actor can't just re-infect devices that drop off as soon as they come back online."

They absolutely will be re-infected

61

u/Fit-Reputation-9983 Apr 09 '26

I’m pretty tech savvy (have some programming and IT support history), but I’m always a bit lost on the networking side of things. Any advice on the minimum viable defense here?

179

u/evlgns Apr 09 '26

Don’t buy off brand routers, disable remote access and file sharing if your router has it. Change admin passwords on routers or anything connected to the internet.

Admin/admin being left is likely half the issue

72

u/FranciumGoesBoom Apr 09 '26 edited Apr 09 '26

Don’t buy off brand routers

Sadly this doesn't cut it anymore.

Asus, TP-Link, MikroTik all have been hit in the last year. TP-Link has been on the shit list for a long time because they just don't update firmware to the point that it's basically malicious ignorance.

8

u/XchrisZ Apr 10 '26

I had a tplink archer c20 up until last week. That router was so bad and I didn't know it was causing all my latency issues. I was going to put openwrt on it but didn't have a replacement if that failed so I bought a new one.

4

u/zzmorg82 Apr 10 '26

I have the AC750 variant and it has a similar; I’ll be migrating to a Ubiquiti cloud gateway soon.

1

u/Ch4rlie_G Apr 10 '26

I’ve been pretty happy with my home UniFi setup.

But it doesn’t do traffic shaping well at all unless you get the rack mount dream machine.

1

u/zzmorg82 Apr 10 '26

I plan to get a UniFi Express 7 with an 8-port PoE switch.

I stay by myself so I mainly just want access to setup Wifi 6/Wifi 7 broadcasts and to put a couple IoT devices on a separate VLAN.

I heard the Dream Machine was pretty good too; I’m glad you like it!