Widespread Compromised Routers Discovered With Altered DNS Configurations

Home / News

Widespread Compromised Routers Discovered With Altered DNS Configurations

By CircleID Reporter
March 04, 2014, 5:10 pm PST Views: 10,214 Add Comment

A widespread compromise of consumer-grade small office/home office (SOHO) routers has been discovered by threat intelligence group Team Cymru. According to the report, “attackers are altering the DNS configuration on these devices in order to redirect victims DNS requests and subsequently replace the intended answers with IP addresses and domains controlled by the attackers, effectively conducting a Man-in-the-Middle attack.”

Below is a quick summary from the report:

In January 2014, Team Cymru’s Enterprise Intelligence Services began investigating a SOHO pharming campaign that had overwritten router DNS settings in central Europe. To date, over 300,000 devices, predominantly in Europe and Asia, have been identified and believed to have been compromised as part of this campaign, one which dates back to at least mid-December of 2013.

Affected devices had their DNS settings changed to use the IP addresses 5.45.75.11 and 5.45.75.36. The analysis indicates that a large majority of affected routers resided in Vietnam. Other top countries affected included India, Italy and Thailand.

Analysis of the victim devices affected revealed that the compromise is not limited to a single manufacturer. A range of router models from several manufacturers appears to be compromised.

Illustrating three phases of SOHO router DNS exploitation via CSRF vulnerability. Source: Team Cymru (Click to Enlarge)

NORDVPN DISCOUNT - CircleID x NordVPN
Get NordVPN [74% +3 extra months, from $2.99/month]

By CircleID Reporter — CircleID’s internal staff reporting on news tips and developing stories. Do you have information the professional Internet community should be aware of? Contact us.
Visit Page

Filed Under

Comments

The Weekly Wrap

More and more professionals are choosing to publish critical posts on CircleID from all corners of the Internet industry. If you find it hard to keep up daily, consider subscribing to our weekly digest. We will provide you a convenient summary report once a week sent directly to your inbox. It's a quick and easy read.