Gigantic 100,000-strong botnet used to hijack traffic meant for Brazilian banks

[steven36]

Botnet redirects hijacked traffic to over 50 active phishing sites.

 

 

Over 100,000 routers have had their DNS settings modified to redirect users to phishing pages. The redirection occurs only when users are trying to access e-banking pages for Brazilian banks.

 

Around 88% of these routers are located in Brazil, and the campaign has been raging since at least mid-August when security firm Radware first spotted something strange.

 

But according to a new report published last week by Chinese cyber-security firm Qihoo 360, the group behind these attacks have stepped up their game.

 

By analyzing massive amounts of collected data, Qihoo 360's Netlab division gained a deep look into the group's modus operandi.

 

According to Netlab experts, the hackers are scanning the Brazilian IP space for routers that use weak or no passwords, accessing the routers' settings, and replacing legitimate DNS settings with the IPs of DNS servers under their control.

 

This change redirects all DNS queries that pass through the compromised routers to the malicious DNS servers, which respond with incorrect info for a list of 52 sites.

 

 

Most of these sites are Brazilian banks and web hosting services, and the redirection leads back to a phishing page that steals victims' credentials for these sites.

 

Attackers do all this with the help of three modules, which Netlab has dubbed Shell DNSChanger, Js DNSChanger, and PyPhp DNSChanger, all based on the programming languages in which they have been coded.

 

The first module, Shell DNSChanger, is written in Shell and is a combination of 25 Shell scripts that can brute-force the passwords of 21 routers or firmware packages.

 

"This sub-module is only being used lightly, with limited deployment by the attacker," Netlab researchers said over the weekend.

 

The second module, Js DNSChanger, is written in JavaScript, and is a collection of only 10 JS scripts that can brute-force the passwords of six routers or firmware packages.

 

This one is only deployed on already-compromised routers to scan and brute-force other routers and devices on internal networks.

 

The third module, PyPhp DNSChanger, is written in a combination of Python and PHP, and is the most potent of all three. Netlab says this module has been deployed on over 100 Google Cloud servers, from where the attackers are constantly scanning the Internet to identify vulnerable routers.

 

This module uses 69 attack scripts that can brute-force the passwords of 47 different routers and firmware packages.

 

Furthermore, this module also uses an exploit that can bypass the authentication procedures for some routers and alter DNS settings. This particular exploit (known as the dnscfg.cgi vulnerability) has been seen exploited in Brazil in a similar fashion in February 2015, also used to change DNS settings and redirect Brazilian bank users to phishing sites.

 

Netlab researchers say that they've managed to access this third module's admin area, where they discovered that PyPhp DNSChanger alone had infected over 62,000 routers just by itself.

 

 

In addition, this third module also seems to use what appears to be stolen Shodan API key to identify vulnerable routers it can exploit using the Shodan IoT search engine.

 

All in all, the operators of this botnet, which Netlab have nicknamed GhostDNS, can target over 70 different types of routers, have already infected over 100,000 routers, and are currently host phishing pages for over 70 different services (the 52 URLs found by Netlab researchers, plus another 19 phishing sites hosted on the same phishing servers, but for which GhostDNS had not redirected traffic to yet).

 

Netlab says it notified affected entities such as Brazilian ISPs about the ongoing campaign. A list of URLs for which GhostDNS is redirecting traffic to phishing pages, along with the list of routers GhostDNS is known to be able to infect, are available in Netlab's report, here.

 

Source

[nir]

GhostDNS: New DNS Changer Botnet Hijacked Over 100,000 Routers

 

Chinese cybersecurity researchers have uncovered a widespread, ongoing malware campaign that has already hijacked over 100,000 home routers and modified their DNS settings to hack users with malicious web pages—especially if they visit banking sites—and steal their login credentials.

Dubbed GhostDNS, the campaign has many similarities with the infamous DNSChanger malware that works by changing DNS server settings on an infected device, allowing attackers to route the users' internet traffic through malicious servers and steal sensitive data.

According to a new report from cybersecurity firm Qihoo 360's NetLab, just like the regular DNSChanger campaign, GhostDNS scans for the IP addresses for routers that use weak or no password at all, accesses the routers' settings, and then changes the router's default DNS address to the one controlled by the attackers.

GhostDNS System: List of Modules and Sub-Modules

 

The GhostDNS system mainly includes four modules:

1) DNSChanger Module: This is the main module of GhostDNS designed to exploit targeted routers based upon collected information.

DNSChanger Module is comprised of three sub-modules, which the researchers dubbed, Shell DNSChanger, Js DNSChanger, and PyPhp DNSChanger.
 

a.) Shell DNSChanger—Written in the Shell programming language, this sub-module combines 25 Shell scripts that can brute-force the passwords on routers or firmware packages from 21 different manufacturers.

 

b.) Js DNSChanger—Mainly written in JavaScript, this sub-module includes 10 attack scripts designed to infect 6 routers or firmware packages.

"Its functional structure is mainly divided into scanners, payload generators, and attack programs. The Js DNSChanger program is usually injected into phishing websites, so it works together with the Phishing Web System," the researchers say.
 

c.) PyPhp DNSChanger—Written in both Python and PHP, this submodule contains 69 attack scripts against 47 different routers/firmware and has been found deployed on over 100 servers, most of which on Google Cloud, and includes functionalities like Web API, Scanner and Attack module.

This sub-module is the core module of DNSChanger that allows attackers to scan the Internet to find vulnerable routers.

2) Web Admin module: Though researchers do not have too much information about this module yet, it seems to be an admin panel for attackers secured with a login page.

3) Rogue DNS module: This module is responsible for resolving targeted domain names from the attacker-controlled web servers, which mainly involves banking and cloud hosting services, along with a domain that belongs to a security company named Avira.
 

"We have no access to the Rouge DNS server, so we can’t say for sure how many DNS names have been hijacked, but by querying both Alexa Top1M and our DNSMon’s Top1M domains against the rogue DNS server (139.60.162.188), we were able to find a total of 52 domains being hijacked," NetLab researchers say.

4) Phishing Web module: When a targeted domain successfully gets resolved through the rogue DNS module, Phishing web module aims to server the right fake version for that specific website.

GhostDNS Malware Targeting Brazilian Users Primarily

According to the researchers, between September 21 and 27, the GhostDNS campaign compromised more than 100,000 routers, of which 87.8 percent of devices (which equals to 87,800) are located in Brazil only, which means Brazil is the primary target for GhostDNS attackers.

 

"Currently the campaign mainly focuses on Brazil, we have counted 100k+ infected router IP addresses (87.8% located in Brazil), and 70+ router/firmware have been involved, and 50+ domain names such as some big banks in brazil , even Netflix, Citibank.br have been hijacked to steal the corresponding website login credentials," the researchers say.

Since the GhostDNS campaign is highly scaled, utilizes different attack vector and adopts automated attack process, it poses a real threat to users. Therefore, users are advised to protect themselves.

How to Protect Your Home Router from Hackers

In order to avoid yourself from being a victim to such attacks, you are recommended to ensure that your router is running the latest version of the firmware and set a strong password for the router web portal.

You can also consider disabling remote administration, changing its default local IP address, and hardcoding a trusted DNS server into your router or the operating system.

NetLab researchers also recommended the router vendors to increase the complexity of router default password and enhance the system security update mechanism for their products.

 

Source

[DKT27]

The first thing to do when getting a router is to change it's default username and password and disable remote administration in it. Also disable daemon in them, at least the ones which one is not using them.