Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

New Trojan Can Change IP Addresses

A new Trojan horse called DNSChanger.eg can route unsuspecting users to a fraudulent site - even if they type the URL themselves

A new Trojan is on the loose that enables attackers to reroute users to phony Websites -- even when the user types the URL out manually.

The Trojan, dubbed DNSChanger.eg, corrupts the process of translating a domain name into an IP address, according to security researchers at security software vendor MicroWorld Technologies, which discovered the vulnerability. The exploit has "high risk potential," the researchers say.

When a user types in a URL, the smart Trojan changes the "NameServer" registry key value to a fraudulent IP address. Phishers can design the fraudulent page to look very much like the pages of the site they are defrauding -- such as a bank or retailer -- and fool the user into typing in their account information.

"Phishing usually requires you to be lured through emails that lead you to impostor Websites, but this requires nothing of that sort," says Govind Rammurthy, CEO of MicroWorld Technologies. "While the unsuspecting user continues an online transaction in good faith, he could be playing directly into the hands of a remote fraudster."

DNSChanger.eg can also be used to corrupt the DNS server itself, according to the researchers. Attackers can poison the DNS cache so that Website requests are answered with fraudulent IP addresses, effectively rendering the servers ineffective.

MicroWorld said it is updating its antivirus software to detect the Trojan and prevent clients from being rerouted to fraud sites. The exploit has been posted on vulnerability sites such as Kaspersky Labs, but, as of this writing, other antivirus tool vendors have not yet posted updates to patch the vulnerability.

— Tim Wilson, Site Editor, Dark Reading

Organizations mentioned in this article:

  • Kaspersky Lab

  • MicroWorld Technologies Inc.

    Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

    Comment  | 
    Print  | 
    More Insights
  • Comments
    Newest First  |  Oldest First  |  Threaded View
    Attackers Leave Stolen Credentials Searchable on Google
    Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2021
    How to Better Secure Your Microsoft 365 Environment
    Kelly Sheridan, Staff Editor, Dark Reading,  1/25/2021
    Register for Dark Reading Newsletters
    White Papers
    Video
    Cartoon Contest
    Write a Caption, Win an Amazon Gift Card! Click Here
    Latest Comment: We need more votes, check the obituaries.
    Current Issue
    2020: The Year in Security
    Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
    Flash Poll
    Assessing Cybersecurity Risk in Today's Enterprises
    Assessing Cybersecurity Risk in Today's Enterprises
    COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    CVE-2021-1070
    PUBLISHED: 2021-01-26
    NVIDIA Jetson AGX Xavier Series, Jetson Xavier NX, TX1, TX2, Nano and Nano 2GB, L4T versions prior to 32.5, contains a vulnerability in the apply_binaries.sh script used to install NVIDIA components into the root file system image, in which improper access control is applied, which may lead to an un...
    CVE-2021-1071
    PUBLISHED: 2021-01-26
    NVIDIA Tegra kernel in Jetson AGX Xavier Series, Jetson Xavier NX, TX1, TX2, Nano and Nano 2GB, all L4T versions prior to r32.5, contains a vulnerability in the INA3221 driver in which improper access control may lead to unauthorized users gaining access to system power usage data, which may lead to...
    CVE-2020-23774
    PUBLISHED: 2021-01-26
    A reflected XSS vulnerability exists in tohtml/convert.php of Winmail 6.5, which can cause JavaScript code to be executed.
    CVE-2020-23776
    PUBLISHED: 2021-01-26
    A SSRF vulnerability exists in Winmail 6.5 in app.php in the key parameter when HTTPS is on. An attacker can use this vulnerability to cause the server to send a request to a specific URL. An attacker can modify the request header 'HOST' value to cause the server to send the request.
    CVE-2021-3309
    PUBLISHED: 2021-01-26
    packages/wekan-ldap/server/ldap.js in Wekan before 4.87 can process connections even though they are not authorized by the Certification Authority trust store,