Categories: Computer SecuritySecurity Hacker

Hackers Hijacking DLink Routers to Gain Bank Credentials By Using Various Router Exploits

New research found that malicious hackers exploiting DLink Routers and attempt to Hijacking DLink Routers DNS setting to redirecting Brazilian bank customers into the malicious website to steal bank credentials.

Attackers using old exploits that discovered around 2015 and trying to exploiting the vulnerable DLink Routers that leads to modify the DNS server settings and redirecting all the request to the malicious host that posed as a real Bank website.

Since the attack is very stealthy, compromised users completely unaware of the changes and notice that this approach is very unique which doesn’t require any user interaction.

Attackers influence the routers in gateway level and redirect them into malicious websites regardless of any devices such as a smart phone or tablet that carried by and the hijacking works without crafting or changing URLs in the user’s browser.

Earlier DNS attacks reported in 2014, 2015, a phishing campaign was used with crafted URLs that abuse to change the DNS configuration within the user’s browser and also attackers also used an exploit kit named as RouterHunterBr 2.0 for redirect compromised users to malicious websites.

Hijacking DLink Routers

Researchers observed this campaigns using honeypots between June 8 and August 10 and recorded almost 500 attempts have been made that indicate that the attempt only focuses on Brazilian based victims.

Attackers used exploits are published on as early as February 2015 for multiple DSL routers, mostly D-Link.

Shuttle Tech ADSL Modem-Router 915 WM / Unauthenticated Remote DNS Change. Exploit http://www.exploit-db.com/exploits/35995/
D-Link DSL-2740R / Unauthenticated Remote DNS Change Exploit http://www.exploit-db.com/exploits/35917/
D-Link DSL-2640B Unauthenticated Remote DNS Change Exploit https://www.exploit-db.com/exploits/37237/
D-Link DSL-2780B DLink_1.01.14 – Unauthenticated Remote DNS Change https://www.exploit-db.com/exploits/37237/
D-Link DSL-2730B AU_2.01 – Authentication Bypass DNS Change https://www.exploit-db.com/exploits/37240/
D-Link DSL-526B ADSL2+ AU_2.01 – Unauthenticated Remote DNS Change https://www.exploit-db.com/exploits/37241/

According to Radware, the exploit allows unauthenticated remote configuration of DNS server settings on the modem router. The malicious URL takes the following form.

/dnscfg.cgi?dnsPrimary=&dnsSecondary=&dnsDynamic=0&dnsRefresh=1

Most of the attacks recorded from the United States and the Original malicious DNS server IP used in the exploit was 69.162.89.185.

Later on Aug 2, attackers IP address changes to 198.50.222.136 and it resolving the hostname for Banco de Brazil (www.bb.com.br) through the malicious DNS server.

Users redirect to a fake cloned website that located at https://198.50.222.136/pbb/web that, matching the change of malicious DNS server IP in the exploit attempts.

Once users trying to access the fake cloned website then its asks the sensitive information that includes bank agency number, account number and an eight-digit pin.

Also, fake site requires confirmation of identity by asking users to provide mobile phone, card pin, and a CABB number.

In effect to this hijacking attack user’s may suffer a financial loss, the malicious page looks like a well crafted one and the only indication for the user is the invalid SSL Certificate.