PyPhp DNSChanger is the core module of DNSChanger, we have observed that the attacker has deployed this program on 100+ servers, most of which on Google Cloud. The following is the IP range it scans 192.168.0.1 The following are affected routers/firmwares that we identified A-Link WL54AP3 / WL54AP2 The following is part of the code structure of JS DNSChanger: ├── These requests perform password guessing on the web authentication page of these routers, and then changes the default DNS address of the router to the Rogue DNS Server through the corresponding DNS configuration interface. The attacker program in the payload constructs http requests via jQuery.ajax. The payload includes the attacker program, and is run in the form of Data URI Scheme. The payload generator generates Base64 encoded payload based on the router IP and Rogue DNS IP. If the port is detected to be open, the corresponding intranet IP will be passed along to the payload generator. The attacker uses the Image() function to perform port scan on a list of predefined intranet IP addresses commonly used by routers. The Js DNSChanger program is usually injected into phishing websites, so it works together with the Pishing Web System.įor example, a Js DNSChanger code on the home page of 35.236.25.247 (the title of the website is: Convertidor Youtube Mp3 | Mp3 youtube). Its functional structure is mainly divided into scanners, payload generators and attack programs. It involves 10 attack scripts, which can infect 6 routers/firmware. Js DNSChanger is mainly written in Javascript. The following are affected routers/firmwares that we have identified 3COM OCR-812 The following is the key code structure of Shell DNSChanger ├── brasil If it is success, the default DNS address on the router will be changed to a Rogue DNS server. The Fscan scan IP range is a list of selected network segments, most of which are attributed to Brazil.Īfter the initial scan, this sub-module then uses the router device information collected to perform password crack on the web authentication pages of these routers. It's configured with a large number of scanning rules, a list of user passwords, and some startup scripts.

This sub-module uses a third-party program, Fast HTTP Auth Scanner v0.6 (FScan) to perform scan. This sub-module is only being used lightly, with limited deployment by the attacker. It is basically a combination of 25 attack Shell scripts, which works on 21 routers/firmware. The Shell DNSChanger was first available around June 2016. The module includes 100+ attack scripts altogether, affecting 70+ different routers. The attacker uses three DNSChanger sub-modules to carry out attack against routers on both internet and intranet networks. The DNSChanger module is the main module of GhostDNS.

Among them, the DNSChanger module is responsible for information collection and exploitation.įigure 1: Flow chart of GhostDNS（click to enlarge image） DNSChanger System The GhostDNS system consists of four parts: DNSChanger module, Phishing Web module, Web Admin module, Rogue DNS module. Here we call the whole campaign GhostDNS.Ĭurrently the campaign mainly focuses on Brazil, we have counted 100k+ infected router IP addresses (87.8% located in Brazil), and 70+ router/firmware have been involved, and 50+ domain names such as some big banks in brazil, even Netflix, Citibank.br have been hijacked to steal the corresponding website login credentials. These four parts work together to perform DNS hijacking function. The whole campaign also includes: Phishing Web System, Web Admin System, Rogue DNS System. Just like the regular dnschanger, this campaign attempts to guess the password on the router's web authentication page or bypass the authentication through the dnscfg.cgi exploit, then changes the router's default DNS address to the Rogue DNS Server through the corresponding DNS configuration interface.īut this campaign has more, we have found three related DNSChanger programs, which we call Shell DNSChanger, Js DNSChanger and PyPhp DNSChanger according to their programming languages.įurthermore, the above DNSChanger Systems are only part of a larger system that the malware campaign runs. Starting from September 20, 2018, we noticed the campaign starting to ramp up its’ effort significantly with a whole bunch of new scanners, we think it is time to expose more details and take some needed actions. With that being said, we have been keeping an eye on a particle one for a while, this one has been active for a long time, and radware has also blogged about it recently.

Note:We have informed various ISPs on the IoC list, and OVH, ORACLE, Google, Microsoft have taken down the related IPs and some others are working on it (Thanks!) Background introductionĭNSchanger is not something new and was quite active years ago, we occasionally encountered one every once in a while, but given the impact they have, we normally don’t bother to write any article.

D-link dsl 500g firmware