Categories: NewsSecurity

DNSChanger Exploit Kit Can Hijack over 160 Different Router Models

Internet users have yet another threat to worry about. DNSChanger, a new exploit kit being used to target over 160 different router models, is currently being spread through a dedicated malvertising campaign. Unlike what most people assumed at first, this kit does not hijack browsers but goes after the router itself. This is an unprecedented type of attack that has security researchers quite concerned.

DNSChanger Does Not Hijack Browsers

As one would expect from malware attack users at the router-level, there is hardly any major brand not susceptible to these attacks. NetGear, D-Link, and quite a few other companies all produce router hardware, most of which can be affected by this new exploit kit. At first, it was assumed that these malvertising distribution campaigns would hijack one’s browser, but it turns out that the consequences are far more worrisome.

This news comes on the heels of other exploits plaguing Netgear routes, although these are two separate threats. Gaining root access to a device controlling one’s entire internal network is very troublesome, yet there is nothing that the end user can do about these things right now. It is up to individual manufacturers to fix the vulnerabilities and push a mandatory update.

Getting infected with DNSChanger is not that difficult, unfortunately. Mainstream websites are unknowingly hosting malicious advertisements, which contain JavaScript code that reveals the visitor’s real IP address. This is achieved through a WebRTC Request, which is then broadcasted to a Mozilla STUN server.



Related Post

Once the information (IP address and port of the client) is sent back from the STUN servers, it can be identified through the malicious JavaScript code. All an attacker needs is one’s local IP address to see if they are worth attacking. High-profile targets are served a malicious advertisement, whereas everyone else will see a normal one.

What is rather disconcerting is how DNSChanger uses Chrome to load different functions into a small image. Among these features are an AES Key, which is hidden in the picture through steganography. This key can cloak traffic and decrypt router fingerprints to see if the victim can be hijacked through the exploit kit.  This professional level of reconnaissance is rather disconcerting, and it shows how cybercriminals have stepped up their game in recent months.

Even though the Chrome browser is a big part of this malware scheme, the browser itself is never hijacked. It behaves correctly, yet it is used to determine vulnerabilities in the router. The browser does only what it always does, but the data stream coming back from the router is at risk. For now, it remains unclear how severe the consequences of these attacks will be.

If you liked this article, follow us on Twitter @themerklenews and make sure to subscribe to our newsletter to receive the latest bitcoin, cryptocurrency, and technology news.

JP Buntinx

JP Buntinx is a FinTech and Bitcoin enthusiast living in Belgium. His passion for finance and technology made him one of the world's leading freelance Bitcoin writers, and he aims to achieve the same level of respect in the FinTech sector.

Share
Published by
JP Buntinx

Recent Posts

BDAG’s $20 Target Outshine DOGE and LTC Predictions

Best Crypto Investment: BlockDAG Sets $20 Price Goal for 2027, Outpaces Dogecoin and Litecoin with…

3 hours ago

BDAG Enhances Payment Options & Outperforms BNB & LTC

BlockDAG Launches Advanced Payment Options With Predictions To Hit $10, Surpassing Litecoin and Binance Coin.…

7 hours ago

Investor Frenzy: BEFE Coin Price Expected to Pump

The crypto market is finally back in full swing and is abuzz with rising price…

15 hours ago

Bitgert Coin: May 2024’s Top-Trending Cryptocurrency

Taking a look at the crypto market today, there's a lot of coin influx and…

15 hours ago

XERA, a Beacon of the Future For its Global Community

In the ever-evolving landscape of technology, some companies rise above the noise, not just for…

16 hours ago

Boost your crypto trading game and grow passive income with ValueZone

In the ever-evolving world of cryptocurrencies, the concept of cryptocurrency trading bots has attracted a…

20 hours ago