Saturday, June 15, 2024

Hackers Hijacking DLink Routers to Gain Bank Credentials By Using Various Router Exploits

New research found that malicious hackers exploiting DLink Routers and attempt to Hijacking DLink Routers DNS setting to redirecting Brazilian bank customers into the malicious website to steal bank credentials.

Attackers using old exploits that discovered around 2015 and trying to exploiting the vulnerable DLink Routers that leads to modify the DNS server settings and redirecting all the request to the malicious host that posed as a real Bank website.

Since the attack is very stealthy, compromised users completely unaware of the changes and notice that this approach is very unique which doesn’t require any user interaction.

Attackers influence the routers in gateway level and redirect them into malicious websites regardless of any devices such as a smart phone or tablet that carried by and the hijacking works without crafting or changing URLs in the user’s browser.

Earlier DNS attacks reported in 2014, 2015, a phishing campaign was used with crafted URLs that abuse to change the DNS configuration within the user’s browser and also attackers also used an exploit kit named as RouterHunterBr 2.0 for redirect compromised users to malicious websites.

Hijacking DLink Routers

Researchers observed this campaigns using honeypots between June 8 and August 10 and recorded almost 500 attempts have been made that indicate that the attempt only focuses on Brazilian based victims.

Attackers used exploits are published on as early as February 2015 for multiple DSL routers, mostly D-Link.

According to Radware, the exploit allows unauthenticated remote configuration of DNS server settings on the modem router. The malicious URL takes the following form.

/dnscfg.cgi?dnsPrimary=&dnsSecondary=&dnsDynamic=0&dnsRefresh=1

Most of the attacks recorded from the United States and the Original malicious DNS server IP used in the exploit was 69.162.89.185.

Later on Aug 2, attackers IP address changes to 198.50.222.136 and it resolving  the hostname for Banco de Brazil (www.bb.com.br) through the malicious DNS server.

Users redirect to a fake cloned website that located at https://198.50.222.136/pbb/web that, matching the change of malicious DNS server IP in the exploit attempts.

Once users trying to access the fake cloned website then its asks the sensitive information that includes bank agency number, account number and an eight-digit pin.

Also, fake site requires confirmation of identity by asking users to provide mobile phone, card pin, and a CABB number.

In effect to this hijacking attack user’s may suffer a financial loss, the malicious page looks like a well crafted one and the only indication for the user is the invalid SSL Certificate.

Also Read:

Hackers Attack Over 200,000 MikroTik Routers & Infected with Mass Coinhive Cryptojacking Malware

HNS IoT Botnet Scanning & Exploits the Routers to Compromise the Victims Networks

Russia, Routers, and Why Virtually Everyone is part of the DDoS Problem

Cisco Auditing Tool & Cisco Global Exploiter to Exploit 14 Vulnerabilities in Cisco Switches and Routers

Website

Latest articles

Sleepy Pickle Exploit Let Attackers Exploit ML Models And Attack End-Users

Hackers are targeting, attacking, and exploiting ML models. They want to hack into these...

SolarWinds Serv-U Vulnerability Let Attackers Access sensitive files

SolarWinds released a security advisory for addressing a Directory Traversal vulnerability which allows a...

Smishing Triad Hackers Attacking Online Banking, E-Commerce AND Payment Systems Customers

Hackers often attack online banking platforms, e-commerce portals, and payment systems for illicit purposes.Resecurity...

Threat Actor Claiming Leak Of 5 Million Ecuador’s Citizen Database

A threat actor has claimed responsibility for leaking the personal data of 5 million...

Ascension Hack Caused By an Employee Who Downloaded a Malicious File

Ascension, a leading healthcare provider, has made significant strides in its investigation and recovery...

AWS Announced Malware Detection Tool For S3 Buckets

Amazon Web Services (AWS) has announced the general availability of Amazon GuardDuty Malware Protection...

Hackers Exploiting MS Office Editor Vulnerability to Deploy Keylogger

Researchers have identified a sophisticated cyberattack orchestrated by the notorious Kimsuky threat group.The...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles