D-Link routers under siege from months-long DNS hack

The attackers are running malicious IPs through a Google Cloud Platform virtual machine

Picture of a DNS server

An ongoing hacking campaign is targeting consumer network routers, mainly D-Link branded ones, which hijacks DNS traffic redirecting users away from legitimate sites and towards malicious clones.

The attackers made attempts on vulnerable router firmware using a Google Cloud Shell which, according to Troy Mursch, a security researcher at Bad Packets, who discovered the issue, is notoriously easy to abuse. 

Advertisement - Article continues below

"Anyone with a Google account can access a 'Google Cloud Shell' machine by simply visiting [the Cloud Shell URL]. This service provides users with the equivalent of a Linux VPS with root privileges directly in a web browser," said Murshc. "Due to the ephemeral nature of these virtual machines coupled with Google's slow response time to abuse reports, it's difficult to prevent this kind of malicious behavior."

Mursch said he found three waves of these attacks dating back to December 2018, tweeting about them as and when they were discovered. IT Pro has contacted D-Link for its side of the story but has not immediately replied.

The attack works by injecting the IP addresses (four have been used so far) of rogue DNS servers inside the vulnerable routers. The servers changed the IP addresses of legitimate sites to malicious copies the attackers were running. The attack is still running at present.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

It points to a sophisticated phishing attack where unsuspecting users would visit the seemingly legitimate site and input their real login credentials ready to be intercepted by attackers.

The attack should be heeded by consumers and businesses alike because although only consumer home routers are affected, remote working culture is on the up and SMBs are also known to rely on home network packages and routers as enterprise offerings are too costly and provide more service than required.

There was a fairly high-profile example of this happening back in October 2018 where Brazillian banks were targeted via DNS hijackers, again harnessing three-year-old exploits in D-Link routers, according to Radware researchers.

The leader of an Estonian cybercrime group was charged in 2018 after pleading guilty to the distribution of malware called DNSChanger. Once infected, the malware would change the DNS settings on infected computers (Windows and Mac versions were about), replacing legitimate ads on websites with ads that would reward the man's own company Rove Digital.

Advertisement - Article continues below

Between 2007 and 2011, the company lead by Vladimir Tsastsin, 35, and six other men raked in $14 million through click hijacking and ad-replacement fraud.

The group were originally arrested in 2011 and later acquitted until 2014 where the Estonian Supreme Court revoked their acquittal and charged them for money laundering.

Featured Resources

Preparing for long-term remote working after COVID-19

Learn how to safely and securely enable your remote workforce

Download now

Cloud vs on-premise storage: What’s right for you?

Key considerations driving document storage decisions for businesses

Download now

Staying ahead of the game in the world of data

Create successful marketing campaigns by understanding your customers better

Download now

Transforming productivity

Solutions that facilitate work at full speed

Download now
Advertisement

Recommended

Visit/security/ransomware/356292/university-of-california-gets-fleeced-by-hackers-for-114-million
ransomware

University of California gets fleeced by hackers for $1.14 million

30 Jun 2020
Visit/security/cyber-security/356289/australia-announces-135b-investment-in-cybersecurity
cyber security

Australia announces $1.35 billion investment in cyber security

30 Jun 2020
Visit/cloud/cloud-security/356288/csa-and-issa-form-cybersecurity-partnership
cloud security

CSA and ISSA form cyber security partnership

30 Jun 2020
Visit/business/policy-legislation/356215/senators-propose-a-bill-aimed-at-ending-warrant-proof-encryption
Policy & legislation

Senators propose a bill aimed at ending warrant-proof encryption

24 Jun 2020

Most Popular

Visit/mobile/google-android/356373/over-2-dozen-additional-android-apps-found-stealing-user-data
Google Android

Over two dozen Android apps found stealing user data

7 Jul 2020
Visit/laptops/29190/how-to-find-ram-speed-size-and-type
Laptops

How to find RAM speed, size and type

24 Jun 2020
Visit/cloud/356260/the-road-to-recovery
Sponsored

The road to recovery

30 Jun 2020