Wednesday, January 8, 2025
HomeComputer SecurityHackers Hijacking DLink Routers to Gain Bank Credentials By Using Various Router...

Hackers Hijacking DLink Routers to Gain Bank Credentials By Using Various Router Exploits

Published on

New research found that malicious hackers exploiting DLink Routers and attempt to Hijacking DLink Routers DNS setting to redirecting Brazilian bank customers into the malicious website to steal bank credentials.

Attackers using old exploits that discovered around 2015 and trying to exploiting the vulnerable DLink Routers that leads to modify the DNS server settings and redirecting all the request to the malicious host that posed as a real Bank website.

Since the attack is very stealthy, compromised users completely unaware of the changes and notice that this approach is very unique which doesn’t require any user interaction.

Attackers influence the routers in gateway level and redirect them into malicious websites regardless of any devices such as a smart phone or tablet that carried by and the hijacking works without crafting or changing URLs in the user’s browser.

Earlier DNS attacks reported in 2014, 2015, a phishing campaign was used with crafted URLs that abuse to change the DNS configuration within the user’s browser and also attackers also used an exploit kit named as RouterHunterBr 2.0 for redirect compromised users to malicious websites.

Hijacking DLink Routers

Researchers observed this campaigns using honeypots between June 8 and August 10 and recorded almost 500 attempts have been made that indicate that the attempt only focuses on Brazilian based victims.

Attackers used exploits are published on as early as February 2015 for multiple DSL routers, mostly D-Link.

According to Radware, the exploit allows unauthenticated remote configuration of DNS server settings on the modem router. The malicious URL takes the following form.

/dnscfg.cgi?dnsPrimary=&dnsSecondary=&dnsDynamic=0&dnsRefresh=1

Most of the attacks recorded from the United States and the Original malicious DNS server IP used in the exploit was 69.162.89.185.

Later on Aug 2, attackers IP address changes to 198.50.222.136 and it resolving  the hostname for Banco de Brazil (www.bb.com.br) through the malicious DNS server.

Users redirect to a fake cloned website that located at https://198.50.222.136/pbb/web that, matching the change of malicious DNS server IP in the exploit attempts.

Once users trying to access the fake cloned website then its asks the sensitive information that includes bank agency number, account number and an eight-digit pin.

Also, fake site requires confirmation of identity by asking users to provide mobile phone, card pin, and a CABB number.

In effect to this hijacking attack user’s may suffer a financial loss, the malicious page looks like a well crafted one and the only indication for the user is the invalid SSL Certificate.

Also Read:

Hackers Attack Over 200,000 MikroTik Routers & Infected with Mass Coinhive Cryptojacking Malware

HNS IoT Botnet Scanning & Exploits the Routers to Compromise the Victims Networks

Russia, Routers, and Why Virtually Everyone is part of the DDoS Problem

Cisco Auditing Tool & Cisco Global Exploiter to Exploit 14 Vulnerabilities in Cisco Switches and Routers

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Gravy Analytics Hit by Cyberattack, Hackers Allegedly Stole data

Gravy Analytics, a prominent player in location intelligence, has reportedly fallen victim to a...

Chrome Security Update – Patch for Multiple Security Vulnerabilities

Google has released an update for its Chrome web browser, advancing to version 131.0.6778.264/.265...

How Nation-State Actors and Organised Hackers Involving in Their Ways of Cyber Attacks

The distinction between nation-state actors and organized cybercriminals is becoming increasingly blurred.Both groups...

Washington State Filed Lawsuit Against T-Mobile Massive Data Breach

Washington State Attorney General Bob Ferguson filed a consumer protection lawsuit against T-Mobile for...

API Security Webinar

72 Hours to Audit-Ready API Security

APIs present a unique challenge in this landscape, as risk assessment and mitigation are often hindered by incomplete API inventories and insufficient documentation.

Join Vivek Gopalan, VP of Products at Indusface, in this insightful webinar as he unveils a practical framework for discovering, assessing, and addressing open API vulnerabilities within just 72 hours.

Discussion points

API Discovery: Techniques to identify and map your public APIs comprehensively.
Vulnerability Scanning: Best practices for API vulnerability analysis and penetration testing.
Clean Reporting: Steps to generate a clean, audit-ready vulnerability report within 72 hours.

More like this

Firefox 133.0 Released with Multiple Security Updates – What’s New!

Mozilla has officially launched Firefox 133.0, offering enhanced features, significant performance improvements, and critical...

Digital Wallets Bypassed To Allow Purchase With Stolen Cards

Digital wallets enable users to securely store their financial information on smart devices and...

Best SIEM Tools List For SOC Team – 2024

The Best SIEM tools for you will depend on your specific requirements, budget, and...