Friday, March 29, 2024

Hackers Hijacking DLink Routers to Gain Bank Credentials By Using Various Router Exploits

New research found that malicious hackers exploiting DLink Routers and attempt to Hijacking DLink Routers DNS setting to redirecting Brazilian bank customers into the malicious website to steal bank credentials.

Attackers using old exploits that discovered around 2015 and trying to exploiting the vulnerable DLink Routers that leads to modify the DNS server settings and redirecting all the request to the malicious host that posed as a real Bank website.

Since the attack is very stealthy, compromised users completely unaware of the changes and notice that this approach is very unique which doesn’t require any user interaction.

Attackers influence the routers in gateway level and redirect them into malicious websites regardless of any devices such as a smart phone or tablet that carried by and the hijacking works without crafting or changing URLs in the user’s browser.

Earlier DNS attacks reported in 2014, 2015, a phishing campaign was used with crafted URLs that abuse to change the DNS configuration within the user’s browser and also attackers also used an exploit kit named as RouterHunterBr 2.0 for redirect compromised users to malicious websites.

Hijacking DLink Routers

Researchers observed this campaigns using honeypots between June 8 and August 10 and recorded almost 500 attempts have been made that indicate that the attempt only focuses on Brazilian based victims.

Attackers used exploits are published on as early as February 2015 for multiple DSL routers, mostly D-Link.

According to Radware, the exploit allows unauthenticated remote configuration of DNS server settings on the modem router. The malicious URL takes the following form.

/dnscfg.cgi?dnsPrimary=&dnsSecondary=&dnsDynamic=0&dnsRefresh=1

Most of the attacks recorded from the United States and the Original malicious DNS server IP used in the exploit was 69.162.89.185.

Later on Aug 2, attackers IP address changes to 198.50.222.136 and it resolving  the hostname for Banco de Brazil (www.bb.com.br) through the malicious DNS server.

Users redirect to a fake cloned website that located at https://198.50.222.136/pbb/web that, matching the change of malicious DNS server IP in the exploit attempts.

Once users trying to access the fake cloned website then its asks the sensitive information that includes bank agency number, account number and an eight-digit pin.

Also, fake site requires confirmation of identity by asking users to provide mobile phone, card pin, and a CABB number.

In effect to this hijacking attack user’s may suffer a financial loss, the malicious page looks like a well crafted one and the only indication for the user is the invalid SSL Certificate.

Also Read:

Hackers Attack Over 200,000 MikroTik Routers & Infected with Mass Coinhive Cryptojacking Malware

HNS IoT Botnet Scanning & Exploits the Routers to Compromise the Victims Networks

Russia, Routers, and Why Virtually Everyone is part of the DDoS Problem

Cisco Auditing Tool & Cisco Global Exploiter to Exploit 14 Vulnerabilities in Cisco Switches and Routers

Website

Latest articles

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles