Exploit Tool Used to Hijack Router DNS Settings for Large Scale Attacks

If you read these articles often, you have heard the term DNS. It is the acronym for Domain Name System and essentially works as the address book for the Internet. It is the service that translates an IP (Internet Protocol) address to a name that is more meaningful than a series of numbers. The data is routed to a DNS server through a router.

Now, cybercriminals have created a tool to take over the routers that send that information to the DNS servers on a large scale. The ultimate goal for the hackers in these cases, is to replace the DNS that is on the routers with their own addresses. Then they can do a variety of things, such as spoof websites and inject rogue ads on the web pages.   

As traffic is making its way from your keyboard to the authoritative DNS servers of the address requested, it may hit a variety of servers en route. If an attacker can insert him or herself into any point in the process, the browser may be tricked into going to a different server that may not have your best interest at heart. 

This recent tool allows a bad guy to determine what type of router model is being used and then replace the DNS information with their own. This is a different type of attack, because the vast majority of these take place when the cybercriminals target outdated browser plug-ins or exploit outdated software in order to install malware, as opposed to fiddling with routers. The new exploit tool reportedly can detect over 40 router models, including the most common ones. 

Some router vendors have already issued updates for this issue. Even routers in private homes need to be updated from time to time. However, because it's not a simple point and click type met horology to update a router, many never get this attention. That's why this exploit is such a big deal. Some vulnerabilities that are targeted in this newest kit are from 2008. 

Users should periodically check the manufacturers' websites for updates for their routers. They should be installed immediately. In addition, this is good time to make sure that the administration access is limited, default passwords are changed to something that meets strong passphrase minimums, and that the administration interface is restricted to an IP addresses that is not used by other devices. This IP addresses should be one that can be manually assigned to the administrator computer when making changes to the router settings. 

According to some research on this issue, attacks got to 250,000 unique visitors per day. It spiked to nearly one million on one day in May and users in the U.S., Russia, Brazil, India, and Australia were impacted most.