Hacker Group Has Been Hijacking DNS Traffic On D-Link Routers For Three Months [Update] (zdnet.com) 40
An anonymous reader quotes a report from ZDNet: For the past three months, a cybercrime group has been hacking into home routers -- mostly D-Link models -- to change DNS server settings and hijack traffic meant for legitimate sites and redirect it to malicious clones. The attackers operate by using well-known exploits in router firmware to hack into vulnerable devices and make silent changes to the router's DNS configuration, changes that most users won't ever notice. Targeted routers include the following models (the number to the side of each model lists the number of internet-exposed routers, as seen by the BinaryEdge search engine): D-Link DSL-2640B - 14,327; D-Link DSL-2740R - 379; D-Link DSL-2780B - 0; D-Link DSL-526B - 7; ARG-W4 ADSL routers - 0; DSLink 260E routers - 7; Secutech routers - 17; and TOTOLINK routers - 2,265.
Troy Mursch, founder and security researcher at internet monitoring firm Bad Packets, said he detected three distinct waves during which hackers have launched attacks to poison routers' DNS settings --late December 2018, early February 2019, and late March 2019. Attacks are still ongoing, he said today in a report about these attacks. A normal attack would look like this:
1. User's computer or smartphone receives wrong DNS server settings from the hacked router.
2. User tries to access legitimate site.
3. User's device makes a DNS request to the malicious DNS server.
4. Rogue server returns an incorrect IP address for the legitimate site.
5. User lands on a clone of the legitimate site, where he might be required to log in and share his password with the attackers. Update: 04/05 16:45 GMT by M : The story adds, "According to Stefan Tanase, security researcher at Ixia, these campaigns have hijacked traffic meant for Netflix, Google,PayPal, and some Brazilian banks, and have redirected users to clone sites, hosted over HTTP, on the networks of known bulletproof hosting providers."
Troy Mursch, founder and security researcher at internet monitoring firm Bad Packets, said he detected three distinct waves during which hackers have launched attacks to poison routers' DNS settings --late December 2018, early February 2019, and late March 2019. Attacks are still ongoing, he said today in a report about these attacks. A normal attack would look like this:
1. User's computer or smartphone receives wrong DNS server settings from the hacked router.
2. User tries to access legitimate site.
3. User's device makes a DNS request to the malicious DNS server.
4. Rogue server returns an incorrect IP address for the legitimate site.
5. User lands on a clone of the legitimate site, where he might be required to log in and share his password with the attackers. Update: 04/05 16:45 GMT by M : The story adds, "According to Stefan Tanase, security researcher at Ixia, these campaigns have hijacked traffic meant for Netflix, Google,PayPal, and some Brazilian banks, and have redirected users to clone sites, hosted over HTTP, on the networks of known bulletproof hosting providers."
Re:Whitelist DNS on your router (Score:5, Informative)
But these routers were hacked
Did you not even read the summary?
Re: Whitelist DNS on your router (Score:2, Insightful)
He didn't even read the topic title.
Re: (Score:1)
This is basic security.
No, it is security theater. The router is the firewall. If the router is hacked to change the upstream DNS servers, then the attacker can also disable your firewall rules. Your firewall rules probably also prevent devices from using more secure resolvers with DNSSEC support. A network where I can't reach DNS servers of my choosing is always highly suspect.
Take our browser certificate warnings... (Score:5, Informative)
very seriously folks.
That is all.
Re: (Score:1)
Why did you post this as an AC? Now people will ignore it and not read the ONLY sensible comment one could make here.
What many people forget is that the whole https thing is not just about encrypting traffic. It's at the very least as much about verifying who you're talking to. This is a perfect example of why this should not even be an issue, but is because people got used to clicking on the "trust it anyway" button.
Re: (Score:1)
Why did you post this as an AC?
Why did you reply if you could have moderated the comment up? Now people won't see the ONLY sensible comment because you wanted to complain rather than help.
For those that didn't rtfm (Score:5, Informative)
The poisoned DNS servers:
66.70.173.48
144.217.191.145
195.128.126.165
195.128.124.131
Re: (Score:1)
Why don't we just DoS them to death?
OpenWRT (Score:1)
How Ironic! (Score:2)
Secutech routers
Based on not so secure technology
Re: (Score:3)
Re: (Score:1)
You can't expect a company, or anyone, to continue to support such an old device. Asuswrt-Merlin supports a wide range of Asus models, but they also stopped updating the n56u because the hardware is simply not up to modern standards anymore. I enjoy the support I get for my RT-AC87U from Asuswrt-Merlin.
How do you define old? Asus doesn't.
Merlin has had to stop supporting even some 802.11ac routers not because they're too old but because Asus arbitrarily stopped updating the routers' closed source components that he depends upon, turning the hardware into e-waste the next time a serious vulnerability comes around. Asus could do the same with your router next.
I agree with the grandparent poster that open source routers are the way to go. Or at the least you want a committed support lifetime.
Use OpenWRT (Score:2)
Seriously, the commercial stuff is, as usual, cheapest possible. There is no risk to them usually (for a counter-example, see Boeing at the moment, but even mass-murder will likely let then get away with a slap on the wrist), so security is not a concern. Because security costs money and usually is quite invisible to the customer. Add to that that customers are stupid and will buy the same brands again that just screwed them over, and the situation is explained nicely.
DLinks are flaky (Score:1)
I've had several DLink products over the years, both personally and professionally, and don't recommend them. From switches dying prematurely with cheap, noisy fans to consumer routers turning into doorstops. And this is just the hardware, let alone the firmware that has a nice interface but turns out to be buggy.
Their only claim to fame was the venerable WRT54G, which was one of the first (if not the first) router that wonderful people created custom firmware for that brought some great features to a con
Re: (Score:1)
And I just realized that I screwed up and that linksys made the WRT54G. oops