Slashdot Mirror
Hacker Group Has Been Hijacking DNS Traffic On D-Link Routers For Three Months [Update] (zdnet.com)
An anonymous reader quotes a report from ZDNet: For the past three months, a cybercrime group has been hacking into home routers -- mostly D-Link models -- to change DNS server settings and hijack traffic meant for legitimate sites and redirect it to malicious clones. The attackers operate by using well-known exploits in router firmware to hack into vulnerable devices and make silent changes to the router's DNS configuration, changes that most users won't ever notice. Targeted routers include the following models (the number to the side of each model lists the number of internet-exposed routers, as seen by the BinaryEdge search engine): D-Link DSL-2640B - 14,327; D-Link DSL-2740R - 379; D-Link DSL-2780B - 0; D-Link DSL-526B - 7; ARG-W4 ADSL routers - 0; DSLink 260E routers - 7; Secutech routers - 17; and TOTOLINK routers - 2,265.
Troy Mursch, founder and security researcher at internet monitoring firm Bad Packets, said he detected three distinct waves during which hackers have launched attacks to poison routers' DNS settings --late December 2018, early February 2019, and late March 2019. Attacks are still ongoing, he said today in a report about these attacks. A normal attack would look like this:
1. User's computer or smartphone receives wrong DNS server settings from the hacked router.
2. User tries to access legitimate site.
3. User's device makes a DNS request to the malicious DNS server.
4. Rogue server returns an incorrect IP address for the legitimate site.
5. User lands on a clone of the legitimate site, where he might be required to log in and share his password with the attackers. Update: 04/05 16:45 GMT by M : The story adds, "According to Stefan Tanase, security researcher at Ixia, these campaigns have hijacked traffic meant for Netflix, Google,PayPal, and some Brazilian banks, and have redirected users to clone sites, hosted over HTTP, on the networks of known bulletproof hosting providers."
Troy Mursch, founder and security researcher at internet monitoring firm Bad Packets, said he detected three distinct waves during which hackers have launched attacks to poison routers' DNS settings --late December 2018, early February 2019, and late March 2019. Attacks are still ongoing, he said today in a report about these attacks. A normal attack would look like this:
1. User's computer or smartphone receives wrong DNS server settings from the hacked router.
2. User tries to access legitimate site.
3. User's device makes a DNS request to the malicious DNS server.
4. Rogue server returns an incorrect IP address for the legitimate site.
5. User lands on a clone of the legitimate site, where he might be required to log in and share his password with the attackers. Update: 04/05 16:45 GMT by M : The story adds, "According to Stefan Tanase, security researcher at Ixia, these campaigns have hijacked traffic meant for Netflix, Google,PayPal, and some Brazilian banks, and have redirected users to clone sites, hosted over HTTP, on the networks of known bulletproof hosting providers."
It's D-Link. And TOTO for Christ's sake! How can that be wrong?
Routers should only allow DNS queries to DNS servers they are configured to use.
I do this manually on the routers I maintain by blocking all DNS requests and then only allowing the DNS servers that are authorized.
This is basic security.
My eyes reflect the stars and a smile lights up my face.
very seriously folks.
That is all.
More like Pee-Link.
The poisoned DNS servers:
66.70.173.48
144.217.191.145
195.128.126.165
195.128.124.131
Politics; n. : A religion whereby man is god.
Are there particular ISPs or countries more affected?
I use OpenWRT on my router, so I'm not concerned. Even more so, since my router is a Linksys ;-)
Or Russians. Or democrats.
Ner do wells who need to be in prison forever.
Corporatism != Free Market
Secutech routers
Based on not so secure technology
Rick B.
I recently dumped a damn reliable asus router (n56u) after they stopped updating it and decided to go with a router that supported openwrt simply because of the huge amount of router based hacks recently.
You simply CANNOT trust the default firmware in routers any longer
Seriously, the commercial stuff is, as usual, cheapest possible. There is no risk to them usually (for a counter-example, see Boeing at the moment, but even mass-murder will likely let then get away with a slap on the wrist), so security is not a concern. Because security costs money and usually is quite invisible to the customer. Add to that that customers are stupid and will buy the same brands again that just screwed them over, and the situation is explained nicely.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Hosts files protect vs. router DNS redirect (@ router level, @ IP stack level as in DNSChanger malware OR if remote DNS is redirect poisoned (kaminsky flaw)) by doing hardcoded favorite sites where you spend MOST time online @!
This assures you of reaching the proper destination/site you intended to reach (not a malicious doppleganger) & to verify addresses you use you can test on another system (prefereably one on a diff. ISP than you use @ home, say a work one OR a pal's system, to verify hardcodes).
For the BEST such hosts file, multithreaded & multiplatform:
APK Hosts File Engine 2.0++ 64-bit for Linux h t t p : / / a p k . i t - m a t e . c o . u k / A P K H o s t s F i l e E n g i n e F o r L i n u x . z i p
APK Hosts File Engine 10++ SR-1 32/64-bit for Windows https://hosts-file.net/?s=Down...
APK
P.S.=> You also RESOLVE FASTER this way, by FAR as well as being safer vs. such exploits (double-bonus!)... apk
FACT: Then browsers are subverting a proven for almost 50 yr. working IP stack design! This is EASY to FIX (since it's stupid usermode complexity for breakdown/exploit & inefficient + WHY):
Especially the redundant WASTE & in SLOWER usermode!
DUMB again for another thing!
Why subvert a FASTER kernelmode native TCP/IP stack w/ 45++ yrs. of refinement in it that WORKS or even systemd/launchd already doing that in a Windows-like slower usermode dnscache client (busted on larger hosts files & other security issues too).
Easy to get around though via:
FF about:config
network.dnsCacheEntries 0
network.trr.mode to 5 (SHUTS IT OFF)
network.trr.uri (set to 208.67.222.222)
Chrome also has a way to turn this off, just turn "Data Saver" off (credit green1 https://tech.slashdot.org/comm... )
APK
P.S.=> Each of which is another ALSO DUMBO thing to do vs. hosts cached in PURE KERNELMODE (diskcache subsystems + the IP stack itself hosts is part of)... apk
Nothing I do is EVER a joke: What I do works vs. threats: US DHS issues DNS redirect is HUGE danger (not w/ hosts vs.) https://threatpost.com/gov-war... & ICANN ISSUES SAME WARNING https://tech.slashdot.org/stor...
* Now, "shoo, lil' troll"...
(Hosts DO protect you vs. that threat & IP stack DNSChanger resets & YES, poisoned routers (since YOU make the requests hardcoded in hosts, avoiding DNS issues in security & slower resolutions).
APK
P.S.=> Between THIS reply to you & my other one here https://it.slashdot.org/commen... I put you away easily (OR are you telling us SLOWER, buggy, INEFFICIENT usermode COMPLEXITY is good engineering? It's not - GOOD engineering is SIMPLE & EFFECTIVE - not complexity for worse performance, resource waste & EXPLOITATION in more moving parts to breakdown OR exploit)... apk
See subject: Make SURE your DNS you use is Kaminsky redirect poisoning patched - OpenDNS is & they filter vs. threats too, acting as another layer of defense vs. malware IF hosts don't have the protective entries (or your firewall via IP address & ranges it can block)
Plus, VICE-A-VERSA as 1 thing I've noticed - NO SINGLE SOURCE is the "ultimate 'perfect' filter"!
WHY my program uses 8 to merge together from reputable & reliable SECURITY COMMUNITY SOURCES!
I go "above & beyond" that & hit the SECURITY SITE ARTICLES DAILY (100 of them & find another 200++/day more that way too that are NOT in "std. hosts file format").
ICANN = another (not sure if they filter vs. threats like OpenDNS does, hence why I chose that one) & I KNOW the Root 13 DNS main servers ARE patched vs. kaminsky redirect poisonings too.
APK
P.S.=> 95++% of ISP DNS, to this very day, though a patch has existed since iirc, 2010, AREN'T - stupid... apk
1) Never use a router with stock firmware. Use Tomato, OpenWRT, etc.
2) Change default passwords and make them strong.
3) Change DNS to use DNSSEC and verify server certs before using them
4) Redirect all DNS queries from LAN to your router (use IPTables)
5) drop all from WAN (make it air-tight)
It's worth understanding the above if you want adequate security.
I've had several DLink products over the years, both personally and professionally, and don't recommend them. From switches dying prematurely with cheap, noisy fans to consumer routers turning into doorstops. And this is just the hardware, let alone the firmware that has a nice interface but turns out to be buggy.
Their only claim to fame was the venerable WRT54G, which was one of the first (if not the first) router that wonderful people created custom firmware for that brought some great features to a consumer grade product. I still have one kicking around somewhere. ...but I'm sure that everyone here knows what I'm talking about.
You could help a brother out and name some secure routers... jus' sayin'...
Man! That's what we all need to put this stupid censorship argument to rest once and for all!
And if we ever develop ad hoc networking, we won't have to worry about DNS. For now, keep your own cache.