NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
Solved
Scam "Firmware Update" email - 12/01/2017
On 12/01/17, I received an email titled "Important Security Update from NETGEAR", sent from "<security@e.netgear.com>". It directed me to visit netgear.com/support to obtain a download of a new firm...
Yes, you got the RIGHT thing, the ZIP file with 2 files in it:
K:\Inet DL\R7000-V1.0.9.14_1.2.25>dir
Volume in drive K is Disk_K
Volume Serial Number is 0F0B-10C0
Directory of K:\Inet DL\R7000-V1.0.9.14_1.2.25
12/01/2017 03:45 PM <DIR> .
12/01/2017 03:45 PM <DIR> ..
11/08/2017 10:31 PM 30,859,322 R7000-V1.0.9.14_1.2.25.chk
12/01/2017 04:03 AM 2,894 R7000-V1.0.9.14_1.2.25_Release_Notes.htmlThe reason Windows calls a file with an extension of .chk a "recovered file fragments" is because when CHKDSK finds file problems it creates a file with that extension.
It is ALSO a file extension NetGear uses for it flashes.
All you need do is open the browser to the Router, go to the Advanced tab -> Administration -> Router Update and browse for that .chk file and UPLOAD it.
Alternatively from that same page you could CHECK for a new version, but sometimes it takes a few days after release for that to work and be able to get the new flash for you.
There is no way to click on that file and have it do the update, only the process above.
Thank you
I usually will not take a link in an e-mail when I suspect it might be spam or phishing. I enter the location manually, like in this case go to NETGEAR and click on SUPPORT and drill down into the site for downloads for the R7000.
It could very well be suspect e-mail taking advantage that Netgear DID release new firmware. Not sure how someone would know you had an R7000 though other than Netgear (I never got an e-mail about an update, but maybe it was sent out in groups and takes a few days?).
The new flash is available here --> https://www.netgear.com/support/product/r7000.aspx#download
Well, that's the thing - the email DID NOT specifically identify the R7000 we own, which made me a bit more suspicious. A non-specific blanket invitation not identifying device model is going to seem sketchy - as though netgear's customer account base may have been hacked for addresses.
It asked that we go to the site and enter our device model number, & etc.
In any event, i independently accessed the download center through my legit netgear account to see what firmware updates were available.
If, as now seems likely, this was a legitimate "update" notification email, it was very poorly handled by netgear. The sender's address itself (security@e.netgear.com - 108.168.157.87) seemed odd and suspicious. In an era of paranoia over malware and bogus communications, this practice doesn't much help customer confidence.
Not unusual for companies to use a 3rd party to send out 'blast' emails? That site is not known for malware either (https://www.malwares.com/report/ip?ip=108.168.157.87).
You would have also found the new firmware release here (https://community.netgear.com/t5/Nighthawk-WiFi-Routers/New-R7000-Firmware-Version-1-0-9-14-Released-12-01-2017-still/m-p/1444167#M73327) as well. Not a STICKY yet though.
You also didn't need to sign-in to Netgear to get the flash.
You said "It asked that we go to the site and enter our device model number, & etc." which is correct, but unless the Netgear site had a link or was hijacked you'd be doing the right thing. Since I use different passwords for sites, I can't see any possible 'damage' if someone got my credentials for this site? Worst case, cause havoc in the forums and I'd be locked out I'd think? No money or hardware could be stolen from me? Now if I used common credentials across many sites (and I'm sure some people do) that would be a different issue.
Yep, the "blast" outfit checks out (it is, as you point out, just a mass-mailing outfit), but I'm now puzzled as to why Malwarebytes blocked the linked site.
Yeah, I didnt really need to formally logon to netgear, but was just trying to be careful - and I never use common credentials across sites.
Thanks again for your help in addressing my concerns! Truly appreciated!