Monday, March 4, 2024

Switcher – Android Malware Seize Routers’s DNS Settings

Switcher – Android Malware Seize Routers’s DNS Settings: A new Android Trojan was identified by malware researchers at Kaspersky Lab’s.

This trojan is bit special instead of attacking the user, it attacks the wireless router that user is connected to and execute a DNS Robbery attack.

Malware AndroidOS Switcher, carry out a brute force attack on the router’s admin panel if the attacks succeeded then the malware can change the IP address of the DNS servers in the router.

By Changing the DNS servers attackers can re-route the traffic to servers operated by cyber criminals. This process of overthrow is referred as DNS-hijacking.

How Switcher Performs Its Brute-force Attacks

As per Kaspersky lab’s to date, they have identified two versions of trojans.

acdb7bfebf04affd227c93c97df536cf; package name – com.baidu.com
64490fbecefa3fcdacd41995887fe510; package name – com.snda.wifi

The first version (com.baidu.com), impersonate itself as a mobile client for the Chinese search engine Baidu, simply opening a URL http://m.baidu.com inside the application.

The second version is a well-made imitation of a popular Chinese app (http://www.coolapk.com/apk/com.snda.wifilocating) for sharing information about Wi-Fi networks (including the security password) between users of the app.

Cyber criminals even created a website (though badly made) to advertise and distribute the aforementioned fake version of com.snda.wifilocating. The web server that hosts the site is also used by the malware authors as the command-and-control (C&C) server.

Switcher - Android Malware Seize Routers's DNS SettingsInfection Process Secrets Revealed

  • Trojan gets the Wireless access point of the network and informs the command and control server that the trojan is being activated in a network with this Wireless access point.
  • Then it tries to get the name of the ISP (Internet Service Provider) and uses that to determine which rogue DNS server will be used for DNS-hijacking.
  • There are three possible DNS servers – 101.200.147.153, 112.33.13.11 and 120.76.249.59; with 101.200.147.153 being the default choice, while the others will be chosen only for specific ISPs.
  • Launches a brute-force attack with the following predefined dictionary of logins and passwords:

admin:00000000, admin:admin, admin:123456, admin:12345678, admin:123456789, admin:1234567890, admin:66668888, admin:1111111, admin:88888888, admin:666666, admin:87654321, admin:147258369, admin:987654321, admin:66666666, admin:112233, admin:888888, admin:000000, admin:5201314, admin:789456123, admin:123123, admin:789456123, admin:0123456789, admin:123456789, admin:11223344, admin:123123123.

  • If this brute force attempt with admin interface is successful, the trojan navigates to the WAN settings and exchanges the primary DNS server for a rogue DNS controlled by the cyber criminals, and a secondary DNS with 8.8.8.8 (the Google DNS, to ensure ongoing stability if the rogue DNS goes down).
Switcher - Android Malware Seize Routers's DNS Settings
Switcher - Android Malware Seize Routers's DNS Settings
  • If the accomplishment successful with DNS addresses, the trojan report its success to the command-and-control (C&C) server.

One Word: Why It Is Bad

The domain name system (DNS) maps internet domain names to the internet protocol(IP).

Cybercriminals change the victim’s (which in our case is the router) TCP/IP settings to force it to make DNS queries to a DNS server controlled by them – a rogue DNS server.

Switcher - Android Malware Seize Routers's DNS Settings

You may ask – why does it matter: routers don’t browse websites, so where’s the risk? Unfortunately, the most common configuration for Wi-Fi routers involves making the DNS settings of the devices connected to it the same as its own, thus forcing all devices in the network to use the same rogue DNS. So, after gaining access to a router’s DNS settings one can control almost all the traffic in the network served by this router.

The cyber criminals were not cautious enough and left their internal infection statistics in the open part of the C&C website.

Switcher - Android Malware Seize Routers's DNS SettingsConclusion

The Trojan.AndroidOS.Switcher does not attack users directly. Instead, it targets the entire network, exposing all its users to a wide range of attacks – from phishing to secondary infection.

The main danger of such tampering with routers’ setting is that the new settings will survive even a reboot of the router, and it is very difficult to find out that the DNS has been hijacked.

Even if the rogue DNS servers are disabled for some time, the secondary DNS which was set to 8.8.8.8 will be used, so users and/or IT will not be alerted.

We recommend that all users check their DNS settings and search for the following rogue DNS servers:

  • 101.200.147.153
  • 112.33.13.11
  • 120.76.249.59

If you have one of these servers in your DNS settings, contact your ISP support or alert the owner of the Wi-Fi network.

Website

Latest articles

New Silver SAML Attack Let Attackers Forge Any SAML Response To Entra ID

SolarWinds cyberattack was one of the largest attacks of the century in which attackers...

AI Worm Developed by Researchers Spreads Automatically Between AI Agents

Researchers have developed what they claim to be one of the first generative AI...

20 Million+ Cutout.Pro User Records Leaked On Hacking Forums

CutOut.Pro, an AI-powered photo and video editing platform, has reportedly suffered a data breach,...

CWE Version 4.14 Released: What’s New!

The Common Weakness Enumeration (CWE) project, a cornerstone in the cybersecurity landscape, has unveiled...

RisePro Stealer Attacks Windows Users Steals Sensitive Data

A new wave of cyber threats has emerged as the RisePro information stealer targets...

Golden Corral Restaurant Chain Hacked: 180,000+ Users’ Data Stolen

The Golden Corral Corporation, a popular American restaurant chain, has suffered a significant data...

CISA Warns Of Hackers Exploiting Multiple Flaws In Ivanti VPN

Threat actors target and abuse VPN flaws because VPNs are often used to secure...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Live Account Takeover Attack Simulation

Live Account Take Over Attack

Live Webinar on How do hackers bypass 2FA ,Detecting ATO attacks, A demo of credential stuffing, brute force and session jacking-based ATO attacks, Identifying attacks with behaviour-based analysis and Building custom protection for applications and APIs.

Related Articles