Hackers have infiltrated the DNS settings of over 180,000 routers in Brazil during the first six months of 2019, says Avast. This comes in the wake of 100,000 home routers (in Brazil) having their DNS settings hacked and modified during mid-2018.
The 2018 attack redirected users to malicious clone websites of a number of Brazilian banks. The latest attack, while also using the same method to target e-bank websites, also redirected users to phishing pages for online giants such as PayPal, Netflix, Gmail, and Uber, according to researchers at Ixia.
The attacks have been come about primarily from users visiting movie and sport streaming services, as well as adult websites. Malicious ads on these sites search for the IP address of the router, then use default usernames and passwords to access the device. Once accessed, malicious code within the ad alters the DNS setting of the router so it receives the IP address of the hackers’ DNS server.
According to Avast, hackers have been using two kits for the attacks - GhostDNS and Navidade, which 'attempted to attack Avast users' routers 2.6 million times in February alone and was spread via three campaigns.' Another botnet, SonarDNS, which appears to copy how GhostDNS functions, came onto the scene in April.
"Avast calls this new botnet SonarDNS because the attacker appears to have re-purposed a penetration testing framework named Sonar.js as the backbone for their infrastructure. Sonar.js is perfect for the router attacks. This JavaScript library is normally used by penetration testers for identifying and launching exploits against internal network hosts, and is ideal for determining a router type and running exploits on the targeted device with just a few lines of code." (ZDNet)
