Thousands of TP-Link routers have been infected by a botnet to spread malware

According to a new report from the Cato CTRL team, the Ballista botnet exploits a remote code execution vulnerability that directly impacts the TP-Link Archer AX-21 router.

The botnet can lead to command injection which then makes remote code execution (RCE) possible so that the malware can spread itself across the internet automatically. This high severity security flaw (tracked as CVE-2023-1389) has also been used to spread other malware families as far back as April 2023 when it was used in the Mirai botnet malware attacks. The flaw also linked to the Condi and AndroxGh0st malware attacks.

[…]

The attack sequence is as follows: it starts with a malware dropper, then a shell script designed to fetch and execute the main binary on the target system for various system architectures. When executed, the malware establishes a command-and-control (C2) channel on port 82 to take control of the device.

This allows the malware to run shell commands to conduct further remote code execution and Denial of Service (DoS) attacks; it will also attempt to read sensitive files on the system.

Supported commands include flooder (triggers a flood attack), exploiter (which exploits CVE-2023-1389), start (an optional parameter used with the exploiter to start the module), close (stops the module triggering function), shell (runs a Linux shell command on the local system) and killall (used to terminate the service).

The Ballista malware is additionally capable of terminating previous instances of itself – and erasing its own presence once execution begins. It’s designed to spread to other routers by attempting to exploit the flaw.

[…]

Source: Thousands of TP-Link routers have been infected by a botnet to spread malware | Tom’s Guide

How The Kill Switch On Exported F-35s Works

[…] Claims that the Joint Strike Fighter has a remote disabling feature are not new, but have resurfaced following the U.S. government’s abrupt decision to cut off military aid and intelligence assistance to Ukraine and new questions about America’s support for NATO under President Donald Trump. Outlets across Europe, including in Belgium, Switzerland, Germany, and the United Kingdom, have published stories touching at least in part on the possibility of an F-35 ‘kill switch’ in the past week or so. This, in turn, has prompted several official responses.

“We have no indication that this is possible,” Belgian Chief of Defence Gen. Frederik Vansina told that country’s newspaper La Dernière Heure on March 5. “The F-35 is not a remote-controlled aircraft. The program relies on worldwide logistical support, with spare parts circulating between user countries.”

[…]

To reiterate, there is no evidence to date that F-35s in service anywhere feature some kind of dedicated capability that can be used to fully disable the jets at the literal or figurative touch of a button. What is true is that Joint Strike Fighters are subject to particularly significant U.S. export and other governmental controls. Virtually all F-35s in service worldwide are dependent in critical ways on proprietary support from the U.S. government and contractors in the United States.

“You don’t need a ‘kill switch’ to severely hamper the utility of an exported weapons system, you just stop providing support for it and it will wither away, some systems very quickly,” TWZ‘s own Tyler Rogoway wrote on X yesterday. “The more advanced the faster the degradation.”

[…]

by retaining key data rights, Lockheed Martin, and to a lesser extent Pratt & Whitney, which supplies the F135 engines that power all Joint Strike Fighter variants, exercise substantial control on almost all aspects of sustaining the F-35. This includes imposing limits on what maintenance work can be done outside of contractor-operated facilities in the United States and other select countries. Many individual components on the jets, especially its ‘black boxes’ that contain critical electronics, are sealed for export control reasons and have to be sent back to designated facilities for maintenance. There is no knowledge base whatsoever to do so in the user’s country.

Even functioning as intended under peacetime conditions, the F-35 sustainment chains that exist now have had significant trouble keeping F-35s, including those in service with the U.S. military, operational.

[…]

ALIS/ODIN is a cloud-based network that is responsible for much more than just managing F-35 logistics, although that too is a critical part of keeping the aircraft flying as it talks directly to the supply and servicing networks discussed above. The system also serves as the port through which data packages containing highly sensitive mission planning information, including details about enemy air defenses and other intelligence, are developed and loaded onto Joint Strike Fighters before sorties as Mission Data Files (MDFs).

It’s this mission planning data package that is a major factor to the F-35’s survivability.

[….]

The MDFs themselves are processed through ALIS/ODIN and rely on work done in facilities located in the United States that are governed by U.S. policy.

[…]

The Israel Defense Forces (IDF), rightly seeing the pitfalls of these critical and heavily intertwined dependencies, is the only F-35 operator to date have negotiated a deal that allows it to operate its jets outside of the ALIS/ODIN network, to install domestically-developed software suites onto the aircraft, and to conduct entirely independent depot-level maintenance. As such, the Israeli F-35I, a subvariant of the F-35A model, is unlike any other Joint Strike Fighter in service elsewhere in the world. The Israelis do still need to source spare parts externally, although they appear to have supplemental access to these resources.

[…]

For a number of America’s NATO allies, continued participation in the alliance’s nuclear weapon sharing agreements is also directly tied to the F-35. The nuclear mission played a particularly key role in Germany’s decision to acquire Joint Strike Fighters. However, this is not really relevant in the context of a country losing access to the F-35 program since the nuclear bombs in question would only ever be released from U.S. custody right before their approved use.

[…]

Source: You Don’t Need A Kill Switch To Hobble Exported F-35s