GhostDNS: New DNS Changer Botnet Hijacked Over 100,000 Routers

Oct 1, 2018

Chinese cybersecurity researchers have uncovered a widespread,
ongoing malware campaign that has already hijacked over 100,000
home routers and modified their DNS settings to hack users with
malicious web pages—especially if they visit banking sites—and
steal their login credentials.

Dubbed GhostDNS, the campaign has many similarities with
the infamous DNSChanger
malware that works by changing DNS server settings on an
infected device, allowing attackers to route the users’ internet
traffic through malicious servers and steal sensitive data.
^[1]

According to a new report from cybersecurity firm Qihoo
360’s NetLab, just like the regular DNSChanger campaign, GhostDNS
scans for the IP addresses for routers that use weak or no password
at all, accesses the routers’ settings, and then changes the
router’s default DNS address to the one controlled by the
attackers.

GhostDNS System: List of Modules and Sub-Modules

The GhostDNS system mainly includes four modules:

1) DNSChanger Module: This is the main module of GhostDNS
designed to exploit targeted routers based upon collected
information.

DNSChanger Module is comprised of three sub-modules, which the
researchers dubbed, Shell DNSChanger, Js DNSChanger, and PyPhp
DNSChanger.

a.) Shell DNSChanger—Written in the Shell programming language,
this sub-module combines 25 Shell scripts that can brute-force the
passwords on routers or firmware packages from 21 different
manufacturers.

b.) Js DNSChanger—Mainly written in JavaScript, this sub-module
includes 10 attack scripts designed to infect 6 routers or firmware
packages.

“Its functional structure is mainly divided into scanners, payload
generators, and attack programs. The Js DNSChanger program is
usually injected into phishing websites, so it works together with
the Phishing Web System,” the researchers say.

c.) PyPhp DNSChanger—Written in both Python and PHP, this
submodule contains 69 attack scripts against 47 different
routers/firmware and has been found deployed on over 100 servers,
most of which on Google Cloud, and includes functionalities like
Web API, Scanner and Attack module.

This sub-module is the core module of DNSChanger that allows
attackers to scan the Internet to find vulnerable routers.

2) Web Admin module: Though researchers do not have too
much information about this module yet, it seems to be an admin
panel for attackers secured with a login page.

3) Rogue DNS module: This module is responsible for
resolving targeted domain names from the attacker-controlled web
servers, which mainly involves banking and cloud hosting services,
along with a domain that belongs to a security company named
Avira.

“We have no access to the Rouge DNS server, so we can’t say for
sure how many DNS names have been hijacked, but by querying both
Alexa Top1M and our DNSMon’s Top1M domains against the rogue DNS
server (139.60.162.188), we were able to find a total of 52 domains
being hijacked,” NetLab researchers say.

4) Phishing Web module: When a targeted domain successfully
gets resolved through the rogue DNS module, Phishing web module
aims to server the right fake version for that specific website.

GhostDNS Malware Targeting Brazilian Users Primarily

According to the researchers, between September 21 and 27, the
GhostDNS campaign compromised more than 100,000 routers, of which
87.8 percent of devices (which equals to 87,800) are located in
Brazil only, which means Brazil is the primary target for GhostDNS
attackers.
Also Read: VPNFilter Router
Malware Adds 7 New Network Exploitation Modules

“Currently the campaign mainly focuses on Brazil, we have
counted 100k+ infected router IP addresses (87.8% located in
Brazil), and 70+ router/firmware have been involved, and 50+ domain
names such as some big banks in brazil , even Netflix, Citibank.br
have been hijacked to steal the corresponding website login
credentials,” the researchers say.

Since the GhostDNS campaign is highly scaled, utilizes different
attack vector and adopts automated attack process, it poses a real
threat to users. Therefore, users are advised to protect
themselves.

How to Protect Your Home Router from Hackers

In order to avoid yourself from being a victim to such attacks, you
are recommended to ensure that your router is running the latest
version of the firmware and set a strong password for the router
web portal.

You can also consider disabling remote administration, changing
its default local IP address, and hardcoding a trusted DNS
server ^[4] into your router or the
operating system.

NetLab researchers also recommended the router vendors to
increase the complexity of router default password and enhance the
system security update mechanism for their products.

^[2]^[3]

References

^{^}
DNSChanger malware
(thehackernews.com)
^{^}
report
(blog.netlab.360.com)
^{^}
VPNFilter Router Malware Adds 7 New
Network Exploitation Modules
(thehackernews.com)
^{^}
trusted DNS server
(thehackernews.com)

The Hacker News Headlines

New Apple iOS 16 Exploit Enables Stealthy Cellular Access Under Fake Airplane Mode

Aug 18, 2023

The Hacker News Headlines

China-Linked Bronze Starlight Group Targeting Gambling Sector with Cobalt Strike Beacons

Aug 18, 2023

The Hacker News Headlines

NoFilter Attack: Sneaky Privilege Escalation Method Bypasses Windows Security

Aug 18, 2023

OWASP TOP !0

Injection. Injection flaws, such as SQL, NoSQL, OS, and LDAP injection, occur when untrusted data is sent to an interpreter as part of a command or query. The attacker’s hostile data can trick the interpreter into executing unintended commands or accessing data without proper authorization. Broken Authentication. Application functions related to authentication and session management are often implemented incorrectly, allowing attackers to compromise passwords, keys, or session tokens, or to exploit other implementation flaws to assume other users’ identities temporarily or permanently. Sensitive Data Exposure. Many web applications and APIs do not properly protect sensitive data, such as financial, healthcare, and PII. Attackers may steal or modify such weakly protected data to conduct credit card fraud, identity theft, or other crimes. Sensitive data may be compromised without extra protection, such as encryption at rest or in transit, and requires special precautions when exchanged with the browser. XML External Entities (XXE). Many older or poorly configured XML processors evaluate external entity references within XML documents. External entities can be used to disclose internal files using the file URI handler, internal file shares, internal port scanning, remote code execution, and denial of service attacks. Broken Access Control. Restrictions on what authenticated users are allowed to do are often not properly enforced. Attackers can exploit these flaws to access unauthorized functionality and/or data, such as access other users’ accounts, view sensitive files, modify other users’ data, change access rights, etc. Security Misconfiguration. Security misconfiguration is the most commonly seen issue. This is commonly a result of insecure default configurations, incomplete or ad hoc configurations, open cloud storage, misconfigured HTTP headers, and verbose error messages containing sensitive information. Not only must all operating systems, frameworks, libraries, and applications be securely configured, but they must be patched/upgraded in a timely fashion. Cross-Site Scripting XSS. XSS flaws occur whenever an application includes untrusted data in a new web page without proper validation or escaping, or updates an existing web page with user-supplied data using a browser API that can create HTML or JavaScript. XSS allows attackers to execute scripts in the victim’s browser which can hijack user sessions, deface web sites, or redirect the user to malicious sites. Insecure Deserialization. Insecure deserialization often leads to remote code execution. Even if deserialization flaws do not result in remote code execution, they can be used to perform attacks, including replay attacks, injection attacks, and privilege escalation attacks. Using Components with Known Vulnerabilities. Components, such as libraries, frameworks, and other software modules, run with the same privileges as the application. If a vulnerable component is exploited, such an attack can facilitate serious data loss or server takeover. Applications and APIs using components with known vulnerabilities may undermine application defenses and enable various attacks and impacts. Insufficient Logging & Monitoring. Insufficient logging and monitoring, coupled with missing or ineffective integration with incident response, allows attackers to further attack systems, maintain persistence, pivot to more systems, and tamper, extract, or destroy data. Most breach studies show time to detect a breach is over 200 days, typically detected by external parties rather than internal processes or monitoring.

GhostDNS: New DNS Changer Botnet Hijacked Over 100,000 Routers

GhostDNS System: List of Modules and Sub-Modules

GhostDNS Malware Targeting Brazilian Users Primarily

How to Protect Your Home Router from Hackers

References

Related Post

New Apple iOS 16 Exploit Enables Stealthy Cellular Access Under Fake Airplane Mode

China-Linked Bronze Starlight Group Targeting Gambling Sector with Cobalt Strike Beacons

NoFilter Attack: Sneaky Privilege Escalation Method Bypasses Windows Security

You missed

Setting up a Kali Linux USB drive with persistence is a great way to have a portable and customized security testing environment. This allows you to save files, configurations, and installed tools across reboots.

Windows Subsystem for Linux (WSL): A Technical Overview

Protected: VPNs and Netlimiter

Security Information and Event Management (SIEM) systems what are they give the top ten real world examples free open source and proprietary