What is Decoy Dog Malware?

In April, Researchers discovered Decoy Dog, a remote access trojan (RAT) toolkit that uses DNS domains that act as command and control (C2) servers for the malware. It caused abnormal DNS signatures in enterprise networks across various regions, and some communications are being sent to a controller in Russia. Then researchers discovered DNS query patterns in enterprise networks that were not linked to consumer devices. They confirmed that the queries came from network appliances in only a few customer networks. Despite researchers announcement and technical analysis of this malware similarity to the Pupy open-source RAT, the toolkit’s operators continued their activity. At that time, had the following domains, which experts recommended organizations to block:

• claudfront[.]net
• allowlisted[.]net
• atlas-upd[.]com
• ads-tm-glb[.]click
• cbox4[.]ignorelist[.]com
• hsdps[.]cc

However, new research reveals that Decoy Dog significantly improves from Pupy, utilizing new domains, unique commands, and configurations that are not publicly available. Pupy is an open-source post-penetration remote access toolkit that emerged in 2015. Its primary purpose was serving a role of RAT in penetration testing simulations. The configs I mentioned as unavailable were hidden until 2019, and are related to the way malware resolves the C2 DNS. But even having the code, it was needed to perform a thorough name server setup for each malware run – which is a complicated task worthy of network engineers.

Decoy Dog Is a Better Pupy RAT

Researchers have been investigating the differences between Decoy Dog and Pupy since April. They set up their own C2 server for Pupy to analyze its DNS communication protocol. Thus, they could create DNS signatures to detect new controllers of this malware. Pupy and Decoy Dog both use nonces to identify sessions with clients and establish the ordering of messages. However, the subject uses the same query structure as Pupy. So, researchers decoded nonce values and correlated queries to the same compromised device.

Moreover, researchers could track each controller’s activity, including the sessions’ length and number of active clients. Unfortunately, encryption prevented researchers from seeing the specific data communicated, but they identified the types of messages sent and profiled the overall communication behavior of both clients. Decoy Dog responds to replays, while Pupy does not and has a richer set of commands and responses. The malware also exhibits more variance in message payload length than Pupy.

From this, researchers confirmed that Decoy Dog is a major refactor of Pupy with advanced capabilities that have changed over time. It includes a domain generation algorithm and the ability for clients to execute arbitrary Java code. These features indicate sophistication and intentionality beyond many threat actors. Security vendor detectors still identify Decoy Dog as Pupy, possibly Since reverse engineers assumed the binary samples were identical.

Today’s activity

Decoy Dog’s creators quickly adjusted their system in response to its initial disclosure. Malware has expanded its reach, with at least three different actors now using it. Thus, they ensured uninterrupted operations and still access to previously compromised devices. Though based on the open-source RAT Pupy, researchers have identified Decoy Dog as a new and previously unknown form of malware with advanced features that allow it to persist on compromised machines. Today research shows how Decoy Dog significantly improved over Pupy. The former utilizes unique commands and configurations that are not publicly available. TAs use it in ongoing nation-state cyber-attacks through DNS to establish Command and Control.

While much about Decoy Dog remains unclear, specialists determined that the malware can only be detected through DNS threat detection algorithms. At least three threat actors have been identified using this malware based on the open-source remote access trojan called Pupy. However, significant changes to the code suggest the involvement of a sophisticated black hat. The security firm stated that the subject can respond to complex DNS requests that do not follow the typical communication structure. In addition, they specified that Pupy, which is associated with Decoy Dog, is a cover-up for the actual abilities of the program.

Threat Actors Use Decoy Dog for Precise Hacking

Based on the analysis of passive DNS traffic, analysts have difficulty determining the exact number of Data Dog targets and affected devices. However, the lowest and highest number of active concurrent connections detected by investigators on any one controller were 4 and 50, respectively. In addition, the number of compromised devices is less than a few hundred. This indicates a minimal target list, typical of a reconnaissance operation. In any case, experts suggest that well-secured and sophisticated attackers are using the malware.

The attackers are likely targeting specific organizations with high information value. As mentioned above, there is a possibility that the victims are located in Russia. However, experts do not rule out that the attackers directed the victims’ traffic through this region as bait or to limit requests to relevant ones. Since it is quite difficult to change this system in modern networks, Decoy Dog behaves similarly to Pupy and uses the default recursive resolver to connect to DNS.

Safety recommendations

Security measures against Decoy Dog are generally similar to basic cyber security recommendations. However, there are key points to consider first. Here are some safety recommendations against this malware:

• Keep your software up to date. Auto-update should be enabled by default because it includes security patches that can help to protect your devices from malware.
• Use a firewall and antivirus software. A firewall can help to block unauthorized traffic from reaching your devices, and antivirus software can help to detect and remove malware.
• Be careful on the web. Look at what websites you visit and what links you click on. Decoy Dog can be spread through malicious websites and links.
• Use strong passwords and change them regularly. While this is a general recommendation, it is essential because strong passwords can protect your accounts from unauthorized access.
• Be aware of the signs of malware infection. Some symptoms include the computer running slowly, pop-ups and new programs appearing that you didn’t initiate, your browser settings changing, and files disappearing.

If you think your computer may be infected with Decoy Dog, contact your IT security team immediately. They will be able to help you to remove the malware and protect your organization from further attacks.

Web safety tips

Here are some additional tips to help you stay safe while web surfing:

• Use VPN when connecting to public Wi-Fi. This will help to protect your traffic from being intercepted by malicious actors.
• Be careful about what information you share online. Don’t share your personal information, such as your Social Security or credit card number, with websites or individuals you don’t trust.
• Please educate yourself about malware and how to protect yourself from it. Forewarned is forearmed. There is a lot of helpful, valuable information in the public domain today to help you keep up to date with the latest developments in cybersecurity.

By following these tips, you can help to protect yourself from Decoy Dog and other malware.

The post Decoy Dog Malware Uncovered: Next-Gen Spyware appeared first on Gridinsoft Blog.

What is an IP address?

An IP address is a unique number that is assigned to each device on a TCP/IP network. Similar to a physical home address, an IP address lets people know where to send your email. IP addresses identify computers and devices and allow them to communicate.

Each IP address is made up of numbers. Just as we use the domain names, we are accustomed to, and computers use addresses they understand. The Domain Name System (DNS) is used to make it all work in harmony. It’s a sort of phone book, so you can use facebook.com to navigate the web, and the DNS will map that address to the address your computer can understand, 157.240.22.35, and direct you to the website you want. These days, many electronic devices in your home can have an IP address. These devices can be anything that connects to the network: computers, TV, a smart speaker, or a robot vacuum cleaner.

Related Content: How To Hide IP Address in Few Steps

There are only two versions of IP addresses: IPv4 and IPv6. IPv4 has four hexadecimal numbers separated by dots, such as 192.168.0.1, and IPv6 has six hexadecimal numbers separated by colons, such as fd04:2ca1:ab5e:65c8:4e19:382c:12ef:ad68. There are 4.3 billion IPv4 addresses worldwide, and the problem is that today that number is not enough to provide all devices with addresses. But in contrast to IPv4, there are many more IPv6 addresses. Their number is 79,228,162,514,264,337,593,543,950,336 addresses. This number should be enough for decades to come. And so, let’s still discuss and consider static IP and dynamic IP, what are the differences or similarities?

What is a Static IP Address Meaning?

A static IP meaning is permanent; it does not change. When your device is assigned a static IP address, it usually remains until your network architecture changes. They are often used by servers or other essential equipment. These addresses are assigned by Internet Service Providers (ISPs). Depending on your data plan or service agreement, your ISP may assign or may not assign you a static IP address. It also increases the cost of your contract with your ISP. A static IP address can be either IPv4 or IPv6. But at the moment, most static addresses use the IPv4 version.

What is a Dynamic IP address?

A dynamic IP address meaning is the opposite of the previous point. It changes periodically. Dynamic addresses are assigned by Dynamic Host Configuration Protocol (DHCP) servers. Since IPv4 does not provide a sufficient number of static IP addresses, it was decided to use dynamic addresses. Thus, all devices connected to the wifi in a hotel, for example, will have dynamic IP addresses. However, the hotel’s primary router will have a static IP address.

Likewise, your home or office on the Internet may be assigned a dynamic IP address by the DHCP server of your Internet provider. In your home or corporate network, in turn, your router will assign a dynamic IP address to your devices – whether they are computers, smartphones, or media streaming devices, tablets, etc. Dynamic IP is a standard used by consumer equipment.

Static or Dynamic: What is better?

It is impossible to say which IP address option will be ideal for everyone and on all occasions. For some tasks, a static IP address is best, and sometimes a dynamic IP address works best. It also depends on your specific needs. For example, a static IP address is more suitable for business, and a dynamic IP address for a home network.

Advantages of a Static IP

Here are the main advantages of using a static IP address:

Disadvantages of a Static IP

Virtual private networks (VPN) can help solve this problem by hiding your physical location. In addition to the advantages, a static IP address has some disadvantages:

Advantages of a Dynamic IP

Dynamic IP addresses are easy to manage and cheaper to deploy than static IP addresses. They also have some advantages:

Disadvantages of a Dynamic IP

However, there are situations where dynamic IP addresses lose out to static ones. For example, they may not work well with Internet services like e-mail.

As we found out, static IP addresses are more suitable for businesses with websites or Internet services. Static IP addresses also work well if remote workers connect to work via VPN. However, dynamic IP addresses are suitable for most consumers. They are cheaper and pose fewer security risks.

Can I Сhange My Static IP address?

In most cases, if you get your Internet service through an ISP, it assigns you a dynamic IP address. Your devices are assigned dynamic IP addresses on your network by default. Switching to a static IP address is usually straightforward. You first need to contact your ISP to find out if static IP service is available, and if so, ask them to activate it. The ISP will give you your IP address, and you must specify it in the router settings.

How to Protect Your IP address?

Regardless of your IP address, your Internet Service Provider (ISP) and hackers can determine where you are and what you do on the Internet. To conceal your IP address and thus protect yourself from surveillance on the Internet, the most effective way is to use a VPN. It fully encrypts your traffic, eliminating the possibility of interception by intruders.

The post Static And Dynamic Ip Address: Brief Comparison appeared first on Gridinsoft Blog.

What is a DNS Server?

DNS means “domain name system”. But before we explain DNS servers, it is essential to clarify the terms related to this topic. Now that we’ve established the definition of DNS and have a basic understanding of DNS let’s understand how DNS lookups work.

How Does DNS Lookup Work?

The process of finding a site by domain name works as follows:

1. Your web browser tries to recall the IP address associated with the domain name. If this site has been visited, the IP address may be stored in the local memory cache and recalled from there.
2. The process continues until one of the components finds out where the destination IP address is.
3. The browser requests a resolving name server to retrieve the IP address. This request searches through the chain of servers to find the appropriate IP address for the domain.
4. Eventually, the resolver finds and relays the IP address to the server, which forwards it back to the web browser.

The DNS lookup process is an integral part used throughout the Internet. Unfortunately, criminals can take advantage of vulnerabilities in DNS, so you need to be aware of possible redirects. First, let’s clarify what DNS spoofing is and how it works.

How DNS Cache Poisoning and Spoofing Works?

Here are the two most common variants of DNS attacks:

Methods of DNS spoofing and Cache Poisoning Attacks

Here are the most common methods of DNS attacks:

Risks of DNS Poisoning and Spoofing

DNS spoofing has some risks, which can put your devices and data at risk. Listed below are the risks of poisoning and DNS spoofing:

1. Personal data theft can be incredibly lucrative for attackers using DNS spoofing. Banking websites and famous online stores are easy to spoof, meaning any password, credit card information, or personal information can be compromised. Redirects will be to phishing websites designed to collect your data.
2. Malware infection is another common threat of DNS spoofing. The destination may turn out to be a fake site containing viruses. Drive-by Downloads are an easy way to automate infection of your system. As a result, if you do not use protection, you are exposed to risks such as spyware, keyloggers, or worms.
3. A fake DNS can cause your security updates to stop. If fake sites include Internet security vendors, legitimate security updates will not be performed. As a result, the device may be exposed to additional threats such as viruses or Trojans.
4. Censorship is a risk that is common in some countries. For example, China uses DNS modifications to ensure that all Websites viewed in the country are filtered. This national-level block, known as the Great Firewall, is one example of how powerful DNS spoofing can be.
5. It’s pretty difficult to eliminate the effects of DNS cache poisoning. Because clearing an infected server doesn’t get rid of the problem on a desktop or mobile device, the device will return to the spoofed site again. In addition, clean devices connecting to the infected server will be compromised again.

How to Prevent?

When trying to prevent DNS spoofing, user-side protections are limited. Website owners and server providers have slightly more options to protect themselves and their users. To properly secure everyone, both sides must try to avoid fakes. To prevent attacks, website owners and DNS providers need to have:

1. Tools to detect DNS spoofing
2. End-to-end encryption
3. Domain name system security extensions

End users, on the other hand, must follow basic rules:

1. Never click on a link that you do not know
2. Scan your computer regularly for malware
3. Clean the DNS cache to solve the poisoning problem
4. Use a virtual private network (VPN)

Tips for DNS Server Providers and Website Owners

Protecting users lies entirely with the website owners or DNS server provider. Owners need to use various security tools and protocols to protect against threats. Among these resources are:

From the latest news in cybersecurity: Last weekend, hackers successfully attacked and corrupted the website of the Ministry of Construction, Housing and Communal Services of Russia.

Working Tips for Users

Users are especially vulnerable, so to avoid becoming a victim of a DNS poisoning attack, it’s essential to follow these simple tips:

The post DNS Cache Poisoning and DNS Spoofing appeared first on Gridinsoft Blog.

A DNS attack is the situation when an attacker either attempts to compromise a DNS network or uses its inherent attributes to conduct a broader attack. A well-orchestrated DNS attack can cause severe damage to an organization. DNS is the main form of communication. It receives domains entered by the user and maps them to an IP address. DNS attacks use this mechanism to perform malicious actions. For example, DNS tunneling techniques allow attackers to compromise network connectivity and gain remote access to the target server. Other DNS attacks can allow attackers to shut down servers, steal data, direct users to rogue sites, and perform DDoS attacks .

What is DNS?

To understand what a DNS attack is, let’s first remember it and how it works. DNS (Domain Name System) is a protocol that converts a domain name such as yoursite.com to an IP address such as 205.38.05.159. When users enter the domain name yoursite.com in a browser, the DNS resolver (a program in the operating system) searches for the numeric IP address or yoursite.com. Here’s how it works:

1. The DNS resolver looks for an IP address in its local cache.
2. If the DNS resolver can not find the address in the cache, it queries the DNS server.
3. The recursive nature of DNS servers allows them to query each other to find the DNS server with the correct IP address or to find an authoritative DNS server that stores the canonical mapping of a domain name to its IP address.
4. When the resolver finds the IP address, it returns it to the requesting program and also caches the address for future use.

Download Gridinsoft Anti-Malware

Why Perform an Attack on the DNS?

DNS is a primary IP network and Internet service; therefore, it is required during most exchanges. Communication usually begins with DNS resolution. If the resolution service becomes unavailable, most applications will no longer work. Attackers often try to disallow the DNS service by bypassing the standard protocol function or using exploits and flaws. This can open the door to tunneling, data theft, and other exploits that exploit underground communications, as well as limiting the victim’s access to sites where they can find information on how to solve the problem.

Major Types of DNS attacks

Below are some of the methods used for DNS attacks:

DNS Tunneling

DNS tunneling passes information through the DNS protocol, which typically resolves network addresses. Normal DNS queries contain only the information needed to communicate between the client and the server. DNS tunneling inserts an extra line of data into this path. It establishes communication that can bypass most filters, firewalls, and packet-capture software. This makes it difficult to detect and trace its origin. DNS tunneling can establish command and control or it can exfiltrate data. Information is often broken into smaller pieces, moved through the DNS, and collected at the other end.

DNS Amplification

A DNS amplification attack is a DDoS attack in which attackers use available public DNS servers to flood the target with response DNS traffic. The attacker sends a DNS lookup request to a public DNS server with a fake source address, which is the target’s address. When the DNS server sends the response to the DNS record, it is sent to the target instead.

DNS Flood Attack

DNS flooding attacks are another DNS-related type of DDoS attack that involves using the DNS protocol to perform User Datagram Protocol (UDP) flooding. Attackers deploy valid (not spoofed) DNS query packets at extremely high packet transmission rates and then create an array of raw IP addresses. Because the queries appear valid, the target DNS servers begin to respond to all queries. The DNS server can then be overwhelmed by a huge number of requests. In addition, the DNS attack requires a lot of network resources, which tires out the target DNS infrastructure until it is shut down. As a result, Internet access to the target is also reduced.

DNS Spoofing

DNS spoofing or DNS cache poisoning uses security holes in the DNS protocol to redirect Internet traffic to malicious websites. They are sometimes referred to as man-in-the-middle attacks (MITM). This type of attack involves using altered DNS records to redirect online traffic to a rogue site that impersonates the intended recipient. When your browser goes online, it first queries a local DNS server to find the IP address for the website name. The local DNS server will request the address from the root servers that own the domain and then from the authoritative name server for that domain.

DNS poisoning occurs when an attacker interferes with this process and gives the wrong answer. Once he has tricked the browser into thinking he got the correct answer to his query, the attacker can redirect traffic to any fake website he wants. When the victim reaches the fake website, they are prompted to enter their login and password and log in to their account.

Once they enter data, they essentially give the attacker the ability to steal the credentials to access, and any sensitive information entered into the fraudulent login form. In addition, these malicious websites are often used to install viruses or worms on end-user computers, giving the threat actor long-term access to the machine and any data stored on it.

NXDOMAIN Attack

The NXDOMAIN Flood DDoS DNS attack attempts to overload the DNS server by using a huge volume of requests for non-existent records. These attacks are often handled by the DNS proxy, which uses most (or all) of its resources to query the authoritative DNS server. This causes both the authoritative DNS server and the proxy DNS server to use all of their time to process invalid queries. As a result, response time to legitimate requests slows down until it eventually stops altogether.

Botnet-based Attacks

A botnet is a series of devices connected to the Internet. It can be used to execute a distributed denial-of-service (DDoS) attack that steals data, sends spam, and allows an attacker to access the device and its connectivity. Moreover, botnets are a diverse and constantly evolving threat, so all of these attacks will inevitably evolve in parallel with our growing dependence on digital devices, the Internet, and new future technologies.

DNS Attack Prevention

The DNS service is like a giant contact list that a device uses to access a specified IP address. Implementing a solid security plan and following some basic security measures can help protect against evolving DNS attacks. Here are a few ways that can help you protect your organization from DNS attacks:

As you can see, the DNS service is essential to the day-to-day operation of websites. The Internet is open to everyone, including cybercriminals who actively exploit weaknesses in a company’s security infrastructure. Therefore, a robust DNS security hardening policy will help organizations mitigate various DNS attacks.

The post TOP DNS Attacks Types appeared first on Gridinsoft Blog.

DNS (Domain name server) spoofing or DNS cache poisoning is a type of cyberattack used by an attacker to direct the victim’s traffic to a malicious website (instead of a legal IP address). Attackers use DNS cache poisoning to redirect Internet traffic and steal sensitive information.

For example, a hacker wants to trick users into entering personal information on an insecure site. How does he do that? By poisoning the DNS cache. The hacker spoofs or replaces the DNS data for a specific site and redirects the victim to the attacker’s server instead of the legitimate server. In this way, the hacker achieves his goal because he has many opportunities: he can commit a phishing attack, steal data or even inject malware into the victim’s system.

How Does DNS Spoofing Work?

Before talking about DNS cache poisoning, let’s first remember what DNS and DNS caching are. DNS is a worldwide directory of IP addresses and domain names. DNS pairs user-friendly addresses, such as facebook.com, into IP addresses, such as 157.240.22.35, that computers use on the network. DNS caching is a system for storing addresses on DNS servers worldwide. To speed up the processing of your DNS requests, developers have created a distributed DNS system. Each server keeps a list of available DNS records called a cache. If the DNS server closest to you does not have the required IP address, it queries the higher DNS servers until the address of the website you are trying to get to is not found. Your DNS server then saves this new record in your cache to get a response faster next time.

Unfortunately, DNS has several security flaws that attackers can exploit and insert forged Internet domain address records into the system. Typically, criminals send fake responses to the DNS server. The server then replies to the user who made the request, and at the same time, the legitimate servers will cache the fake record. Once the DNS cache server stores the fake pair, all subsequent requests for the compromised record will get the server’s address controlled by the attacker.

DNS Spoofing Techniques Can Include:

Cybercriminals can easily compromise DNS responses while remaining undetected due to security vulnerabilities in specific web applications and the lack of proper authentication of DNS records. Let’s take a closer look at them:

Lack of Verification and Validation

DNS has a first trust structure that does not require IP validation to verify before sending a response. Because DNS resolvers do not validate data in the cache, an invalid entry remains until it is manually deleted or the TTL expires.

Recursive DNS Resolver Vulnerability

When recursive querying is active, the DNS server receives the request and does all the work of finding the correct address and sending the response to the user. If it does not have a record in its cache, it will query other DNS servers until it gets the address and returns it to the user. Enabling recursive querying presents a security vulnerability that attackers can exploit to poison the DNS cache.

As the server looks for the address, the attacker can intercept the traffic and provide a fake response. The recursive DNS server will send the response to the user and simultaneously store the spoofed IP address in its cache.

No Encryption

Typically, the DNS protocol is not encrypted, making it easier for attackers to intercept its traffic. In addition, servers do not have to verify the IP addresses to which they route traffic. Hence they cannot determine whether it is genuine or spoofed.

How to Prevent DNS Spoofing?

Real-time monitoring of DNS data can help identify unusual patterns, user actions, or behaviors in traffic, such as visiting malicious sites. And while detecting DNS cache poisoning is difficult, there are several security measures companies and service providers can take to prevent it. Some measures to prevent DNS cache poisoning include using DNSSEC, disabling recursive queries, and more.

The Limit of The Trust Relationships

One of the vulnerabilities of DNS transactions is the high trust relationship between different DNS servers. Therefore, servers do not authenticate the records they receive, allowing attackers to send fake responses from their illegitimate servers.

To prevent attackers from exploiting this flaw, security groups should limit the level of trust their DNS servers have with others. Configuring DNS servers to not rely on trust relationships with other DNS servers makes it difficult for hackers to use a DNS server to compromise records on legitimate servers. There are many tools available to check for DNS security threats.

Use the DNSSEC protocol

Because Domain Name System Security Extensions (DNSSEC) uses public-key cryptography to sign DNS records, it adds validation and allows systems to determine whether an address is valid or not. This prevents forgery by verifying and authenticating requests and responses.

In regular operation, the DNSSEC protocol associates a unique cryptographic signature with other DNS information, such as CNAME and A records. The DNS resolver then uses this signature to authenticate the DNS response before sending it to the user.

Security signatures ensure that a legitimate source server validates responses to requests that users receive. Although DNSSEC can prevent DNS cache poisoning, it has drawbacks such as complex deployment, data provisioning, and zone enumeration vulnerabilities in earlier versions.

Use The Latest DNS and BIND Versions Software

Beginning with version 9.5.0 BIND (Berkeley Internet Name Domain) includes enhanced security features such as cryptographically secure transaction identifiers and port randomization, which minimizes the chance of DNS cache poisoning. It is also important that the IT staff keeps it up to date and ensures that it is the latest and safest version. Here are some more useful tips to help prevent DNS cache poisoning.

DNS cache poisoning causes domain users to be redirected to malicious addresses. In addition, some attacker-controlled servers can trick unsuspecting users into downloading malware or providing passwords, credit card information, and other confidential information. To prevent this, it is essential to use reliable security methods.

The post DNS Spoofing: Key Facts, Meaning appeared first on Gridinsoft Blog.

The flaw affects Linux firmware used in various routers, hotspots, and other IoT devices. It also hits Linux distributives for the embedded operating systems like Embedded Gentoo and OpenWRT. The vulnerability reveals itself in many different devices. For example, Linksys, Netgear, and Axis all use uClibc libraries. Since the vulnerability is not yet cured in uClibc and uClibc-ng, the details about specific devices and manufacturers in whose products the problem occurs are not brought to the public yet.

The vulnerability mechanism

The vulnerability comes from the usage of predictable transaction identifiers in the library-generated DNS requests. DNS request IDs are formed by simple incrementing of the counter without any additional randomization of the port numbers. This mechanism, in turn, allowed DNS cache poisoning through the proactive sending of a UDP packet with a forged response. The spoof will be accepted if it features a correct request ID and arrives before the genuine server’s response. Unlike the Kaminsky method proposed in 2008, the current approach doesn’t even require guesswork since the transaction ID is initially predictable. The initial value (1) gets incremented with each query, not chosen randomly.

Security recommendations against ID breaking include randomizing numbers of source network ports whence the DNS request. This measure must compensate for the short length of the identifier. If randomization is activated, the forgery of a 16-bit ID is not enough – hackers then would have to additionally brute-force the network port number. In uClibc and uClibc-ng, the random source UDP port didn’t show during the bind request. Therefore, the randomizer was turned off, and its application required changing settings in the operating system.

With the randomization switched off, the problem of guessing an incremented request ID becomes trivial. But even if the randomization were applied, the attackers would only need to pick up a port number from a range of 32768–60999 (Linux uses such.) They could have used a massive simultaneous sending of fake responses to different network ports yet to win against the legitimate DNS response.

History of the inquiry

The problem has been confirmed in all working versions of the uClibc and uClibc-ng, including the latest uClibc 0.9.33.2 and uClibc-ng 1.0.40. In September 2021, the information on the vulnerability was sent to CERT/CC for coordinated fixes preparation. Moreover, In January 2022, the data was delivered to more than 200 manufacturers working with CERT/CC. In March, there was communication with the uClibc-ng project support. They admitted they could not fix the vulnerability themselves and recommended disclosing the information to the community so that it could assist with the development of the fix. Nozomi Networks, the company that detected the flaw, brought the information to the public in a thorough report on May 2, 2022. In the meantime, Netgear has announced an update wherein they promise to deal with the vulnerability.

The post A DNS vulnerability in uClibc/uClibs-ng libraries jeopardizes IoT devices appeared first on Gridinsoft Blog.

GhostDNS is a set of exploits for routers that uses CSRF queries to change DNS settings and then redirect users to phishing pages (where from victims are stolen credentials from various sites and services).

Researchers say that an unknown hacker uploaded an unprotected password-protected KL DNS.rar archive into an unnamed file exchange website, containing a malware and several phishing pages. At the same time, the attackers seemed to forget that Avast antivirus was installed on his machine with the active Web Shield component that protects against malicious web content. As a result, the file with the malware was analyzed by the Avast solution, and the researchers got access to the source code.

“We downloaded the linked file and found the full source code for the GhostDNS exploit suite”, — say the experts.

As showed analysis of the malware, the exploit kit used two methods to attack routers: Router EK and BRUT. Both methods used CSRF queries to change the DNS settings. So, Router EK is designed for attacks from the local network and requires the user to click on a malicious link. BRUT is a scanner that searches the Internet for insecure routers and attacks them (in this case, user interaction is not required).

Researchers found in the archive a list of prefixes for IP addresses in 69 countries of the world that the malware had to scan. For each prefix, were checked 65,536 addresses. Though majority of the target countries were in South America (Brazil was the most affected), victims are also found in the USA, Australia and Germany.

To gain access to the device and override the DNS settings, the new version of GhostDNS applied bruteforce, using a small dictionary containing a list of 22 default credentials. At the same time, older versions of the malware had a list of 84 credentials.

After gaining access to the device, the malware changed the DNS settings so they pointed to the attacker’s servers. To do this, a hacked version includes SimpleDNS Plus application.

In turn, RouterEK attacks victims through malicious advertising. If the user clicks on such a malicious ad, begins the search for the internal IP address of the router.

In this case, used a smaller set of credentials than in the case of BRUT. Avast analysts found a list of just eight usernames and passwords, all of which are most commonly found in Brazil.

If the credentials from the router successfully match, GhostDNS proceeds to the phase of displaying phishing pages. In the KL DNS.rar archive can be found several templates of such fakes that imitated the sites of the largest banks in Brazil and Netflix.

Let me remind you that recently I wrote that hackers spoof DNS settings to distribute fake coronavirus applications.

The post Avast experts accidentally got source code for GhostDNS exploit appeared first on Gridinsoft Blog.

The reason for the investigation were complaints of users, which reported on the forums that they were obsessively offered to download a strange application, allegedly informing about COVID-19 and created by WHO.

As it turned out, the routers of these users were compromised, and under the mask of an application was distributed an infostiller. Only recently I wrote about phishing with letters supposedly from WHO, exploiting the theme of coronavirus, and this seems to be the next technological level from cybercriminals.

The publication says that in all cases, the victims were the owners of D-Link or Linksys routers, and unknown attackers changed the DNS settings on the devices.

“It is not yet clear exactly how the attackers gained access to the devices, but several victims admitted that they could access their routers remotely, and they used weak passwords. So it’s probably a matter of brute force and enumerating credentials from a list of known defaults,” – says Bleeping Computer.

Having gained access to the device, attackers change the DNS server addresses to 109.234.35.230 and 94.103.82.249.

Researchers explain that when a computer connects to a network, Microsoft uses the Network Connectivity Status Indicator (NCSI) feature, which periodically checks to see if your Internet connection is active.

So, in Windows 10, one of these tests will be connecting to http://www.msftconnecttest.com/connecttest.txt and checking if the answer is “Microsoft Connect Test”. If it does, then the computer is connected to the Internet, and if not, Windows will warn that the Internet is not available.

If the user is working with a compromised router, then the malicious DNS servers force Windows, instead of connecting to the legitimate IP address of Microsoft 13.107.4.52, to connect to the intruders resource located at 176.113.81.159. As a result, instead of sending the aforementioned text file, the site displays a page asking the victim to download and install the fake application “Emergency – COVID-19 Informator” or “COVID-19 Inform App”, supposedly created by WHO.

If the user is caught by attackers, and downloads and installs this application, instead of information about the coronavirus, he received the Oski Trojan. This malware will try to collect and transmit the following information to the attackers (the list is incomplete):

• Cookies
• browser history;
• Billing information from the browser
• saved credentials;
• cryptocurrency wallet data;
• text files;
• autocomplete data for forms in the browser;
• DB 2FA Authy identifiers;
• screenshots of the desktop at the time of infection.

The post Hackers spoof DNS settings to distribute fake coronavirus applications appeared first on Gridinsoft Blog.