New DNS Trojan Hacks Home Routers

Researchers discover new variant of DNSChanger that changes DNS settings in home routers

A newly discovered Trojan in the wild hacks into home wireless routers and changes their DNS settings to point to the attacker’s rogue DNS server. The malware is a new variant of the DNSChanger Trojan that has been circulating around the Internet, according to researchers at Secure Computing who have been studying it.

Home routers make easy prey because many users don’t lock them down, and even use their default passwords for authentication. There’s been plenty of research in this space over the past year, everything from drive-by hacks to botnet infections to DNS rebinding. (See Attackers Use New 'Call-Home' Method to Infiltrate Home Networks and RSA Session Features Live Linksys Router Hack and The Hack Your Home Router Challenge.)

Sven Krasser, director of data mining research for Secure Computing, says the new DNSChanger Trojan attack also indirectly infects any machine that connects to the router. “This is the first time we’ve seen on [a] wide basis that the computing resources of the wireless router are part of the attack,” he says. “It also [affects] machines that are not directly exploited -- ones that are connecting to the router.”

The Trojan executes brute-force attacks on the Web interface of a router that only uses basic authentication -- and it’s mostly going after D-Link and Linksys routers so far, according to Krasser.

Secure Computing says the attackers behind the malware are the infamous Zlob malware authors.

Krasser says the attackers can send a victim to any Website, and most times return the correct site back to the user to evade detection. Other times they redirect a user to their own spoofed pages, he says. He says phishing is a likely goal of the attackers.

He says it’s possible that attackers could kick the attack up a notch and add put their malcode onto the routers, such as zombie code. Secure Computing researchers have posted some screen shots and an analysis of the Trojan in their blog.

Never use default passwords in home routers, Krasser says, and keep it updated.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

About the Author(s)

Kelly Jackson Higgins, Editor-in-Chief, Dark Reading

Kelly Jackson Higgins is the Editor-in-Chief of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise Magazine, Virginia Business magazine, and other major media properties. Jackson Higgins was recently selected as one of the Top 10 Cybersecurity Journalists in the US, and named as one of Folio's 2019 Top Women in Media. She began her career as a sports writer in the Washington, DC metropolitan area, and earned her BA at William & Mary. Follow her on Twitter @kjhiggins.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like

More Insights