Update as of October 3, 2018:
The IoT hijacking aimed at Brazilian banks continues. Security researchers report that the attack on DLink DSL modem routers – which intended to steal bank users’ financial information – has amplified its campaign. It now affects 100,000 router IP addresses and 70 different types of IoT devices.
The campaign, which Quihoo's Netlab 360 researchers have dubbed “GhostDNS,” boasts of a four-part system: Phishing Web module, Web Admin module, Rogue
The scheme began as an attack directed towards Banco de Brasil customers. Recent developments in the intensified IoT campaign shows that most attacks are still Brazil-directed:
Security researchers have been trailing the activity of cybercriminals who have waged a hijacking campaign on IoT devices, specifically, DLink DSL modem routers. This IoT threat aimed to steal the sensitive banking information of a Brazilian financial institution’s customers.
The IoT scheme started with an attempted change in the domain name system or DNS server settings of routers located in Brazil. The scammers rerouted all the requests that go through the DNS server to a malicious server. The malicious server then hijacked all DNS requests for the Banco
[READ: Security 101: Protecting Wi-Fi Networks Against Hacking and Eavesdropping]
The fake website, which is not associated with Banco de Brasil, asked for the following personal information: a user’s bank agency number, account and pin numbers, mobile number, bank card pin and an associated CABB number.
While the bank’s legitimate website was not hacked, it's an effective deception as bank users were not able to tell right away that they’ve been redirected to a malicious website, aside from an invalid certificate notification. Regardless of the browser or device used, a DNS request for the Banco de Brasil website led them to the fake website due to their infected IoT devices.
[READ: Over 200,000 MikroTik Routers Compromised in Cryptojacking Campaign]
The security researchers discovered that the exploit attempts were done from servers in the US and Brazil and targeted victims located solely in Brazil.
Another bank based in Brazil, Itau Unibanco, was also a victim of the IoT hijacking, but users were not redirected to a fake website. The banks have been alerted and that the DNS and
[READ: A Look Into the Most Noteworthy Home Network Security Threats of 2017]
The researchers recommend the following to check whether users have been compromised IoT devices, and what steps to take:
Trend Micro Solutions
The Trend Micro™ Smart Home Network, which has web protection and deep packet inspection capabilities, is a solution that secures devices against IoT-related threats.
Users of the Smart Home Network solution are protected from this threat via this rule:
1130410 WEB Multiple Devices Unauthenticated Remote DNS Change Vulnerability -18
1131093 WEB Multiple Devices Unauthenticated Remote DNS Change Vulnerability -9
A comprehensive guide on how homes and businesses can better defend themselves against attacks on routers can be found via Securing Your Home Routers: Understanding Attacks and Defense Strategies.
Indicators of Compromise
DNSChanger Module (SHA256)
The following are detected as HTML_DNSCHA.SM:
Like it? Add this infographic to your site:
1. Click on the box below. 2. Press Ctrl+A to select all. 3. Press Ctrl+C to copy. 4. Paste the code into your page (Ctrl+V).
Image will appear the same size as you see above.