New DNSChanger Trojan Allows Mass DNS Hijack, Non-Windows And Fully Patched Systems Affected
A new trojan has been identified by researchers that can tamper with a wide array of devices on a local network and redirect users to impostor websites, even if they are using fully patched machines or run non-Windows operating systems.
The malware is a new variant of the DNSChanger, a trojan that has long been known to change the domain name system settings of PCs and Macs. According to researchers with anti-virus provider McAfee’s Avert Labs, the update allows a single infected machine to pollute the DNS settings of potentially hundreds of other devices running on the same local area network by undermining its dynamic host configuration protocol, or DHCP, which dynamically allocates IP addresses.
DNS-changing Trojan can:
Modify Windows Hosts file to map specific domain names to specific IP addresses (McAfee classifies these Trojans as QHOSTS Trojans, more of a precursor to DNSChangers.
Modify Windows registry settings to reference specific (rogue) DNS servers [DNSChanger.f]
Create a scheduled task under Mac OS X to reference specific (rogue) DNS servers [OSX/Puper]
Exploit cross-site request forgery vulnerabilities in routers to overwrite the DNS server configuration offered to local area network clients [DNSChanger.f]
“Systems that are not infected with the malware can still have the payload of communicating with the rogue DNS servers delivered to them,” McAfee’s Craig Schmugar writes here of the new variant. “This is achieved without exploiting any security vulnerability.”
The only way a user might know the attack is underway is by manually checking the DNS server his computer is using. There are several countermeasures users can take, Schmugar said, the easiest being hard-coding a DNS server in a machine’s configuration settings.
In an interview, Schmugar said the DHCP attack doesn’t exploit a vulnerability in either user machines or network hardware, allowing it to work with a wide variety of home and enterprise routers. It involves a ndisprot.sys driver that is installed on the infected box. Once there, it monitors network traffic for DHCP requests and responds with bogus offers that contain the IP address to the rogue DNS server.
DNSChanger has already been viewed exploiting router weaknesses to change DNS settings, but the ability to poison other machine’s DHCP connections appears to be new, said Eric Sites, VP of research at Sunbelt Software. For the moment, the new variant doesn’t appear to be widely circulated, but the prospect of a trojan that can poison other machines’ DHCP connections suggests this one is worth watching.
Variants using this functionality are not known to be widespread at this point, though even a single infected system could potentially impact hundreds of other systems on the LAN. Though it’s awkward to check, users could examine their DNS settings to see if they have been impacted. For example, type “ipconfig /all” from a Windows command prompt.
More on CyberInsecure:
Posts
Leave a Reply
Comments with unsolicited links to other resources will be marked as spam. DO NOT leave links in comments. Please leave your real email, it wont be published.