Attackers Target Home Routers with DNS Hijacking

Attackers Target Home Routers with DNS Hijacking

The latest victims to DNS hijacking appears to be the home routers manufactured by D-Link. Here the traffic is redirected to various malicious sites.

Researchers have detected different types of attacks that are targeting consumer routers, all of which were reportedly traced back to hosts on the Google Cloud Platform (AS15169) network.

Troy Mursch, the person who discovered this issue, detailed three different waves of findings, which started in December 2018. In the most recent wave, discovered on March 26, “attacks came from three distinct Google Cloud Platform hosts and targeted additional types of consumer routers not previously seen before.”

Mursch also states that it is virtually impossible to determine the scope and scale of these attacks is unless researchers use the tactics employed by malicious actors.

“We have suspended the fraudulent accounts in question and are working through established protocols to identify any new ones that emerge. We have processes in place to detect and remove accounts that violate our terms of service and acceptable use policy, and we take action on accounts when we detect abuse, including suspending the accounts in question. These incidents highlight the importance of practicing good security hygiene, including patching router firmware once a fix becomes available," wrote a Google Cloud spokesperson.

“Home router vulnerabilities are a great nuisance for organizations, and in light of the latest news about hackers leveraging D-Link routers to hijack DNS traffic, organizations should put their guard up,” said Justin Jett, director of audit and compliance for Plixer.

“While home routers don’t directly connect with the corporate network, they are used by individuals at home and in many cases connect business assets like mobile phones and computers to the internet when employees are not on campus.”

Asa the number of remote workers keeps on increasing, it makes easy for perpetrators to go around the corporate defenses via employees' home networks, thus making it more vulnerable due to its less little security. Also, users may unknowingly connect to sites that download malware onto their system, by connecting the DNS server settings at the home router.