CURRENT ACTIVITIES : DNS Changer Malware

DNS Changer Malware


http://www.cert-in.org.in


It has been observed that a malware called as DNS Changer Trojan which
changes the DNS server entries in the computer systems and ADSL /VoIP
router (home gateway devices) is widely propagating.
The malware initially infects the Windows or Apple computers and
subsequently gain access to routers coneected to those systems to exploit
weakness like default factory configurations, easily guessable passwords
etc.
Once exploited or accessed, changes the DNS settings in the said computers
and devices and make them point to rouge foreign DNS servers.

In a typical attack scenario, the unwitting users are enticed to download
malware (similar to Trojan:BAT/Dnschanger.B) which subsequently, tampers
the Windows network settings (entry of DNS in the host file, adding a
proxy in the browser settings) in the host computer and scans for the
connected DSL devices and tries to login directly to the Admin interface to
change the DNS settings in the routers.

By achieving this, cyber criminals can control what sites the user connects
on the internet. The following actions could be performed on infected
system:
• Redirecting the intended queries to malicious servers and hence
further downloading of malware , potentially unwanted programs or
conducting phishing attacks
• eavesdropping the user sessions
• Man in the Middle attack (MITM)
• Serving advertisements with the attackers choice
• Prevent downloading operating system and Antivirus updates.

Confirming malware Infection

• Check the local or ADSL / VoIP router DNS server settings against the
identified rouge DNS servers:
 64.28.176.0 - 64.28.191.255
 67.210.0.0 - 67.210.15.255
 77.67.83.0 - 77.67.83.255
 93.188.160.0 - 93.188.167.255
 85.255.112.0 - 85.255.127.255
 213.109.64.0 - 213.109.79.255

(Note:
Local DNS list can be found by using “ipconfig /all | findstr “DNS”
in the windows command prompt. If found any suspicious entries, delete the
entries and use ipconfig / flushdns to clear the previous entries
Access the Router interface and check the DNS entries. Refer the owner’s
manual for accessing and configuring the device.)

• Check the windows/Apple system for entries related to malicious DNS
servers
Typical registry entry will be like:

o
HKLM\SYSTEM\CurrentControlSet\

Services\Tcpip\Parameters\Interfaces\{random}
DhcpNameServer = 93.188.161.105
o
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{random}
DhcpNameServer = 93.188.166.105
o
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{random}
DhcpNameServer = 85.255.xx.xxx,85.255.xxx.xxx

• Check the host file entries, proxy setting in the browser configuration
in the local system for suspicious entries. Delete fraudulent entries if
found. The below given steps locates the entries.


Tools
• Anti-virus vendor AVIRA has released a DNS repair tool. This can be
downloaded from here to clean infected system

• If it is suspected that Router’s credentials are changed in
unathorised fashion, Reset the router settings and change the credentials
for the modem's interface and reboot devices.
Countermeasures
• Restrict Web Management Interface of Routers to authorized users and
change default username/passwords
• Report suspicious entries in Routers to your Internet Service Provider
• Keep up to date Antivirus on the computer system
• keep up-to-date on patches and fixes on the operating system and
applications

References:
http://www.fbi.gov/news/stories/2011/november/malware_110911/malware_110911
http://www.fbi.gov/news/stories/2011/november/malware_110911/DNS-changer-ma
lware.pdf
http://techblog.avira.com/2012/01/23/avira-dns-repair-tool-released/en/
http://www.cert-in.org.in/s2cMainServlet?pageid=PUBVA01&VACODE=CIVA-2010-08
39
http://www.cert-in.org.in/s2cMainServlet?pageid=PUBVA01&VACODE=CIVA-2010-08
82