Your ISP knows the Mac address of your router since it requests a public IP from them using DHCP. That’s why if you contact support they usually can confirm the brand of your router by doing an oui lookup.
In theory the FBI could have collected a list of MACs and optionally used an ASN lookup on the public IP and then handed each ISP their list of MACs, which the ISP could associate back to customers to contact. It would only not work for customers who spoof their router WANs ethernet mac.
But I think just patching it is a normal and fine solution imo.
creepy: a buttload of out-of-date routers were infected with chinese malware and unknowingly used as a botnet in a cyberattack
creepier: the fbi was able to take control of all of the routers and wipe the malware
creepiest: the router owners were unaware anything had happened
How would you like the router owners to have been alerted?
Perhaps via the contact information they provided to their ISP?
My ISP has never had info on my router, for 20+ years. Was there something in the story I missed about these being ISP issued routers?
Your ISP knows the Mac address of your router since it requests a public IP from them using DHCP. That’s why if you contact support they usually can confirm the brand of your router by doing an oui lookup.
In theory the FBI could have collected a list of MACs and optionally used an ASN lookup on the public IP and then handed each ISP their list of MACs, which the ISP could associate back to customers to contact. It would only not work for customers who spoof their router WANs ethernet mac.
But I think just patching it is a normal and fine solution imo.
Or I mean, Shodan exists. I’m sure the gov has better.
A theoretical botnet I was looking at on github used shodan to identify possible targets to infect.