Thursday, March 28, 2024

Hackers Hijacking DLink Routers to Gain Bank Credentials By Using Various Router Exploits

New research found that malicious hackers exploiting DLink Routers and attempt to Hijacking DLink Routers DNS setting to redirecting Brazilian bank customers into the malicious website to steal bank credentials.

Attackers using old exploits that discovered around 2015 and trying to exploiting the vulnerable DLink Routers that leads to modify the DNS server settings and redirecting all the request to the malicious host that posed as a real Bank website.

Since the attack is very stealthy, compromised users completely unaware of the changes and notice that this approach is very unique which doesn’t require any user interaction.

Attackers influence the routers in gateway level and redirect them into malicious websites regardless of any devices such as a smart phone or tablet that carried by and the hijacking works without crafting or changing URLs in the user’s browser.

Earlier DNS attacks reported in 2014, 2015, a phishing campaign was used with crafted URLs that abuse to change the DNS configuration within the user’s browser and also attackers also used an exploit kit named as RouterHunterBr 2.0 for redirect compromised users to malicious websites.

Hijacking DLink Routers

Researchers observed this campaigns using honeypots between June 8 and August 10 and recorded almost 500 attempts have been made that indicate that the attempt only focuses on Brazilian based victims.

Attackers used exploits are published on as early as February 2015 for multiple DSL routers, mostly D-Link.

According to Radware, the exploit allows unauthenticated remote configuration of DNS server settings on the modem router. The malicious URL takes the following form.

/dnscfg.cgi?dnsPrimary=&dnsSecondary=&dnsDynamic=0&dnsRefresh=1

Most of the attacks recorded from the United States and the Original malicious DNS server IP used in the exploit was 69.162.89.185.

Later on Aug 2, attackers IP address changes to 198.50.222.136 and it resolving  the hostname for Banco de Brazil (www.bb.com.br) through the malicious DNS server.

Users redirect to a fake cloned website that located at https://198.50.222.136/pbb/web that, matching the change of malicious DNS server IP in the exploit attempts.

Once users trying to access the fake cloned website then its asks the sensitive information that includes bank agency number, account number and an eight-digit pin.

Also, fake site requires confirmation of identity by asking users to provide mobile phone, card pin, and a CABB number.

In effect to this hijacking attack user’s may suffer a financial loss, the malicious page looks like a well crafted one and the only indication for the user is the invalid SSL Certificate.

Also Read:

Hackers Attack Over 200,000 MikroTik Routers & Infected with Mass Coinhive Cryptojacking Malware

HNS IoT Botnet Scanning & Exploits the Routers to Compromise the Victims Networks

Russia, Routers, and Why Virtually Everyone is part of the DDoS Problem

Cisco Auditing Tool & Cisco Global Exploiter to Exploit 14 Vulnerabilities in Cisco Switches and Routers

Website

Latest articles

Hackers Actively Exploiting Ray AI Framework Flaw to Hack Thousands of Servers

A critical vulnerability in Ray, an open-source AI framework that is widely utilized across...

Chinese Hackers Attacking Southeast Asian Nations With Malware Packages

Cybersecurity researchers at Unit 42 have uncovered a sophisticated cyberespionage campaign orchestrated by two...

CISA Warns of Hackers Exploiting Microsoft SharePoint Server Vulnerability

Cybersecurity and Infrastructure Security Agency (CISA) has warned about a critical vulnerability in Microsoft...

Microsoft Expands Edge Bounty Program to Include WebView2!

Microsoft announced that Microsoft Edge WebView2 eligibility and specific out-of-scope information are now included...

Beware of Free Android VPN Apps that Turn Your Device into Proxies

Cybersecurity experts have uncovered a cluster of Android VPN applications that covertly transform user...

ZENHAMMER – First Rowhammer Attack Impacting Zen-based AMD Platforms

Despite AMD's growing market share with Zen CPUs, Rowhammer attacks were absent due to...

Airbus to Acquire INFODAS to Strengthen its Cybersecurity Portfolio

Airbus Defence and Space plans to acquire INFODAS, a leading cybersecurity and IT solutions...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles