Hackers in Your Home – DNS Hijacking

In recent DNS Hijacking attacks, attackers have been targeting Linksys and D-Link routers to serve a mock World Health Organization webpage that hosts Oski infostealer designed to extract browser credentials and other victim data. In some cases, the attackers simply scan the internet for vulnerable routers and attempt to brute-force weak administrative passwords.

Once the router is compromised and the DNS setting has been changed, a malicious page is displayed instructing the victim to download an application from the W.H.O. to receive important information related to the COVID-19 pandemic. Once the user clicks on the link, he/she is redirected to a Bitbucket page to install the malicious application.

Since the router itself is compromised, the user may never see any form of antivirus notification. The attack targets the router directly by compromising it, changing its default DNS settings to display webpages of the attacker’s choosing, and hosting the malware outside of the network on cloud-based infrastructure. This makes these types of attacks much more difficult to detect.

These attacks targeting consumer routers are often abusing vulnerabilities in outdated firmware or in default settings on the router. With more people teleworking than ever before, this has become greater for corporations and organizations that cannot monitor or control their employees’ home networks and router configurations. They can, however, take steps to ensure that employee devices are properly secured and connections to corporate networks are secured and monitored.