• About us
  • Contact Us
  • Home
  • Privacy Policy and Disclaimer
TeqGo.com - Tech news
  • News

    How can I save money on Starbucks?

    Do Starbucks workers get stock?

    Can Starbucks hire you at 15?

    Does Starbucks give coffee to employees?

    Why don t Starbucks employees get tips?

    How many stocks do Starbucks partners get?

  • Computer
    How to Realistically Change Hair Color in Photoshop

    How to Realistically Change Hair Color in Photoshop

    How to Blend Images in Photoshop

    How to Outline an Image in Photoshop

    How to Add Texture to an Image in Photoshop

    How to Add Texture to an Image in Photoshop

    How to Export a GIF in Photoshop

    How to Export a GIF in Photoshop

    How to Merge Layers in Photoshop

    How to Undo and Redo in Photoshop

    How to Create a Collage in Photoshop

    How to Create a Collage in Photoshop

  • Gear
    Apple Watch –  Beginners Guide

    Apple Watch – Beginners Guide

    Personal WiFi Routers Help Bring Secure Data Wherever You Are

    Personal WiFi Routers Help Bring Secure Data Wherever You Are

    Trending Tags

    • Best iPhone 7 deals
    • Apple Watch 2
    • Nintendo Switch
    • CES 2017
    • Playstation 4 Pro
    • iOS 10
    • iPhone 7
    • Sillicon Valley
  • Mobile
  • Review
    How To Force Reboot Your Apple Watch (And Why You Might Need To)

    Ccleaner for Mac Review

    Adobe Audition Review

    Adobe Audition Review

    Audacity Review

    Audacity Review

    Tenorshare 4MeKey Review

    Tenorshare 4MeKey Review

    Tenorshare ReiBoot Review

    Tenorshare ReiBoot Review

    DxO PureRaw Review

    DxO PureRaw Review

No Result
View All Result
  • News

    How can I save money on Starbucks?

    Do Starbucks workers get stock?

    Can Starbucks hire you at 15?

    Does Starbucks give coffee to employees?

    Why don t Starbucks employees get tips?

    How many stocks do Starbucks partners get?

  • Computer
    How to Realistically Change Hair Color in Photoshop

    How to Realistically Change Hair Color in Photoshop

    How to Blend Images in Photoshop

    How to Outline an Image in Photoshop

    How to Add Texture to an Image in Photoshop

    How to Add Texture to an Image in Photoshop

    How to Export a GIF in Photoshop

    How to Export a GIF in Photoshop

    How to Merge Layers in Photoshop

    How to Undo and Redo in Photoshop

    How to Create a Collage in Photoshop

    How to Create a Collage in Photoshop

  • Gear
    Apple Watch –  Beginners Guide

    Apple Watch – Beginners Guide

    Personal WiFi Routers Help Bring Secure Data Wherever You Are

    Personal WiFi Routers Help Bring Secure Data Wherever You Are

    Trending Tags

    • Best iPhone 7 deals
    • Apple Watch 2
    • Nintendo Switch
    • CES 2017
    • Playstation 4 Pro
    • iOS 10
    • iPhone 7
    • Sillicon Valley
  • Mobile
  • Review
    How To Force Reboot Your Apple Watch (And Why You Might Need To)

    Ccleaner for Mac Review

    Adobe Audition Review

    Adobe Audition Review

    Audacity Review

    Audacity Review

    Tenorshare 4MeKey Review

    Tenorshare 4MeKey Review

    Tenorshare ReiBoot Review

    Tenorshare ReiBoot Review

    DxO PureRaw Review

    DxO PureRaw Review

No Result
View All Result
TeqGo.com
No Result
View All Result
Home Computer

Hacker group incorporates DNS hijacking into its malicious website campaign

Staff by Staff
January 22, 2023
Hacker group incorporates DNS hijacking into its malicious website campaign
Share on FacebookShare on Twitter


Enlarge / DNS hijacking concept.

Researchers have uncovered a malicious Android app that can tamper with the wireless router the infected phone is connected to and force the router to send all network devices to malicious sites.

The malicious app, found by Kaspersky, uses a technique known as DNS (Domain Name System) hijacking. Once the app is installed, it connects to the router and attempts to log in to its administrative account by using default or commonly used credentials, such as admin:admin. When successful, the app then changes the DNS server to a malicious one controlled by the attackers. From then on, devices on the network can be directed to imposter sites that mimic legitimate ones but spread malware or log user credentials or other sensitive information.

Capable of spreading widely

“We believe that the discovery of this new DNS changer implementation is very important in terms of security,” Kaspersky researchers wrote. “The attacker can use it to manage all communications from devices using a compromised Wi-Fi router with the rogue DNS settings.”

The researchers continued: “Users connect infected Android devices to free/public Wi-Fi in such places as cafes, bars, libraries, hotels, shopping malls, and airports. When connected to a targeted Wi-Fi model with vulnerable settings, the Android malware will compromise the router and affect other devices as well. As a result, it is capable of spreading widely in the targeted regions.”

DNS is the mechanism that matches a domain name like ArsTechnica.com to 18.188.231.255, the numerical IP address where the site is hosted. DNS lookups are performed by servers operated by a user’s ISP or by services from companies such as Cloudflare or Google. By changing the DNS server address in a router’s administrative panel from a legitimate one to a malicious one, attackers can cause all devices connected to the router to receive malicious domain lookups that lead to lookalike sites used for cybercrime.

Advertisement

The Android app is known as Wroba.o and has been in use for years in various countries, including the US, France, Japan, Germany, Taiwan, and Turkey. Curiously, the DNS hijacking technique the malware is capable of is being used almost exclusively in South Korea. From 2019 to most of 2022, attackers lured targets to malicious sites that were sent through text messages, a technique known as smishing. Late last year, the attackers incorporated DNS hijacking into their activities in that Asian nation.

Infection flow with DNS hijacking and smishing.
Enlarge / Infection flow with DNS hijacking and smishing.

The attackers, known in the security industry as Roaming Mantis, designed the DNS hijacking to work only when devices visit the mobile version of a spoofed website, most likely to ensure the campaign goes undetected.

While the threat is serious, it has a major shortcoming—HTTPS. Transport Layer Security (TLS) certificates that serve as the underpinning for HTTPS bind a domain name such as ArsTechnica.com to a private encryption key that’s known only to the site operator. People directed to a malicious site masquerading as Ars Technica using a modern browser will receive warnings that the connection isn’t secure or will be asked to approve a self-signed certificate, a practice that users should never follow.

Another way to combat the threat is to ensure the password protecting a router’s administrative account is changed from the default one to a strong one.

Still, not everyone is versed in such best practices, which leaves them open to visiting a malicious site that looks almost identical to the legitimate one they intended to access.

“Users with infected Android devices that connect to free or public Wi-Fi networks may spread the malware to other devices on the network if the Wi-Fi network they are connected to is vulnerable,” Thursday’s report stated. “Kaspersky experts are concerned about the potential for the DNS changer to be used to target other regions and cause significant issues.



Source link

Staff

Staff

Next Post
Musk Completes Twitter Takeover, Promises It Won't Become a 'Hellscape'

Twitter Bans Third-Party Apps Without Warning

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Recent Posts

  • Ryobi Just Introduced 17 New Products To Its Lineup – Here Are Our Favorites
  • Clever Ryobi Products Everybody At The Tailgate Will Be Jealous Of You For Having
  • How to Realistically Change Hair Color in Photoshop
  • How to Outline an Image in Photoshop
  • How to Add Texture to an Image in Photoshop
  • How to Export a GIF in Photoshop
  • How To Spot Fake Customer Reviews When Buying Tech Gadgets Online
  • 5 Of The Best Apple Watch Apps For Hikers
  • How To Make Your iPhone’s Screen Black And White (And Why You Should)
  • About us
  • Privacy Policy and Disclaimer
  • Software Reporter Tool
  • Numizmatika
  • Pro Tools Guide
  • Contact Us

© 2019-2023 TEQGo.com

No Result
View All Result
  • Review
  • Computer
  • News
  • Gear

© 2019-2023 TEQGo.com