It was reported that home routers were being targeted by DNS hijacking.
Security researchers at Bad Packets found that there were three waves of attacks that happened between December 2018 and March 2019.
The first and the second wave compromised old models of D-Link router, and the third wave happened on March 26, 2019, and came from three distinct Google Cloud Platform hosts and targeted additional types of consumer routers not previously seen before.
The purpose of hackers in exploiting routers is that, they were attempting to fool users to enter their login details of a well-known website, using a rogue website they control.
Once a person enters their details, the data can subsequently be stolen by attackers.
"The purpose of these attacks is to modify DNS settings in the routers to point to unauthorized webpages that skim user input data," explained Mihai Vasilescu senior security research engineer in a blog.
"When end users try to access a targeted website, they will land on a webpage designed to look like the original but is controlled by the attacker."
To do this, the malicious actors that hack into routers were able to intercept requests, to then send faked DNS responses which point users to a malicious server hosting with a fake login page.
Researchers found that on the fake page, the web servers were unsecured, as they were running on HTTP instead of HTTPS, in which the latter wasn’t running at all.
"That server would then grab your credentials, giving the attacker access to your bank accounts," added Vasilescu.
"By querying the malicious DNS server for specific domains, we can easily compare the results with queries against Google’s 8.8.8.8 resolver, clearly indicating something is wrong."
The researchers identified four distinct rogue DNS servers being used to redirect web traffic for malicious purposes: 66.70.173.48, 144.217.191.145, 195.128.126.165 and 195.128.124.131.
There are three types of targets. According to researchers at Ixia:
Internet-based global enterprises
- paypal.com.
- gmail.com.
- uber.com.
- netflix.com.
Local web hosting providers
- hostgator.com.br.
- kinghost.com.br.
- uolhost.uol.com.br.
- locaweb.com.br.
Brazilian banks and financial institutions
- caixa.gov.br.
- itau.com.br.
- bb.com.br.
- sicredi.com.br.
- cetelem.com.br.
- bancobrasil.com.br.
- santander.com.br.
- pagseguro.uol.com.br.
- santandernet.com.br.
However, some of the targets weren't fully functional yet.
According to Vasilescu this is because either the attackers haven’t had the time to configure their servers, or have misconfigured the Apache configuration.
To ensure security, Vasilescu pointed out the importance of ensuring routers to be updated to the latest release.
“And not exposing the admin interface online is important," he said, adding that users should "Make sure that the connections are HTTPS" by checking the certificate.
Google Cloud has suspended the fraudulent accounts found by the researchers, and is working through "established protocols" to identify any new ones that emerge.
"We have processes in place to detect and remove accounts that violate our terms of service and acceptable use policy, and we take action on accounts when we detect abuse, including suspending the accounts in question," a spokesperson at Google Cloud said.
"These incidents highlight the importance of practicing good security hygiene, including patching router firmware once a fix becomes available.”
