Android Spyware & Banking Trojan Attack via DNS Spoofing that Poses as Legitimate Facebook or Chrome App

A new wave of network attacks that uses DNS spoofing and cache poisoning method to distribute XLoader  Android Spyware and Banking Trojan.

DNS Spoofing or poisoning  is a type of cyber-attack that exploits system vulnerabilities in the domain name server to divert traffic away from legitimate servers and directs it towards fake ones

The malicious app poses a legitimate Chrome or Facebook app and it is distributed through fake by pushing a notification to a victim device.

According to TrendMicro analysis report “this new wave of network attacks since early March which for now are targeting Japan, Korea, China, Taiwan, and Hong Kong.

Upon installation, the malicious app is capable of stealing personal information, financial data and it installs additional apps to the device.

It is also capable of hijacking the device and establish persistence through administrator privileges.

How the Infection Work with DNS Spoofing

Attackers compromise the router settings and redirect the traffic to certain websites and fake drive users to the malicious domains and to download XLoader.

Once the application triggered it hides from the application list and keeps running in the background and triggers the malicious activities.

Trend Micro Researcher says “XLoader creates a provisional web server to receive the broadcast events. It can also create a simple HTTP server on the infected device to deceive victims. It shows a web phishing page whenever the affected device receives a broadcast event (i.e., if a new package is installed or if the device’s screen is on) to steal personal data, such as those keyed in for banking apps”.

The Phishing page translated to Korean, Japanese, Chinese, or English based on the device language that setup in the device. It is capable of collecting SMS details, records phone calls, steals personal and financial data from the device.

XLoader abuses WebSocket protocol over SSL/TLS to establish persistent and secure communication with C&C server, it also abuses message pack to steal the exfiltrated the data faster.

Mitigations

Setup complex password to routers.
Regularly update the Router & Firewall Firmware.
Monitoring the router’s DNS setting at regular intervals.
Stay wise against social engineering attacks.