Attackers Target Home Routers with DNS Hijacking

Security

Hackers have been breaking into home routers to change DNS server settings and hijack the traffic to redirect it to malicious sites, according to Troy Mursch, security researcher for Bad Packets.

Researchers have detected different types of attacks that are targeting consumer routers, all of which were reportedly traced back to hosts on the Google Cloud Platform (AS15169) network. Mursch detailed three different waves of findings, which started in December 2018. In the most recent wave, discovered on March 26, “attacks came from three distinct Google Cloud Platform hosts and targeted additional types of consumer routers not previously seen before.”

According to Mursch, determining the scope and scale of these attacks is virtually impossible unless researchers use the tactics employed by the malicious actors.

“Home router vulnerabilities are a great nuisance for organizations, and in light of the latest news about hackers leveraging D-Link routers to hijack DNS traffic, organizations should put their guard up,” said Justin Jett, director of audit and compliance for Plixer.

“While home routers don’t directly connect with the corporate network, they are used by individuals at home and in many cases connect business assets like mobile phones and computers to the internet when employees are not on campus.”

Considering the growing number of remote workers, it’s not terribly difficult for malicious actors to go around the corporate defenses via employees’ home networks, which are often much less secure or have fewer safeguards in place. “By changing the DNS server settings at the home router, users may unknowingly connect to sites that will download malware onto their system,” Jett said.

“When the users return to the corporate network, or connect to the VPN, the malware can begin looking for ways to further exploit the organization. Network and security professionals should leverage network traffic analytics to understand normal user behavior. By doing so, when a user returns to the corporate network and starts to display unusual traffic behavior, the network and security teams can quickly identify that there is a problem and remediate.”

Products You May Like

Articles You May Like

PathAI raises $60 million for its computer vision-based pathogen detection technology
Facebook: we logged 100x more Instagram plaintext passwords than we thought
Facebook Stored Millions of Instagram Users’ Passwords in Plaintext
ProcessOut improves payment data visualization
No one knows how to hire, plus brand design and African tech

Leave a Reply

Your email address will not be published. Required fields are marked *