World's stealthiest rootkit pushes DNS hijacking trojan

World's stealthiest rootkit pushes DNS hijacking trojan


DNS Changer dropped by TDSS


By Dan Goodin •
Posted in Malware, 14th November 2011 21:49 GMT


One of the world's most advanced pieces of malware is being used to spread DNS Changer, a trojan at the heart of a massive click fraud scheme that has already hijacked 4 million PCs, security researchers said.

Just a few days after federal prosecutors in the US shuttered the international conspiracy, researchers from Dell SecureWorks said they discovered DNS Changer is being spread by TDSS. The rootkit, as previously reported, is among the hardest to detect and remove and is often used as a means to install keyloggers, tools for attacking websites, and other malware.

Once installed, DNS Changer is able to alter the DNS, or domain name system, settings that computers and routers use to find the IP numbers that correspond to domain names such as theregister.co.uk and google.com. By replacing legitimate DNS servers with servers under the control of the attackers, they are able to send victims to fraudulent websites instead of the destinations the victims intended to visit.

Last week, seven people from Estonia and Russia were criminally charged in a scam that for more than five years used DNS Charger to generate more than $14 million in profit. The racked up the windfall by redirecting victims to imposter websites that paid advertising fees to the attackers each time they were clicked on. The scheme preyed on users of computers running Microsoft Windows and Apple OS X operating systems. DNS Changer is also able to change DNS configuration settings in certain routers, particularly when they use default usernames and passwords.

The ability of TDSS to evade antivirus protection and other security software is well documented. The rootkit, which is also known as TDL4 and Aleureon, is among the world's most advanced, with the ability to infect 64-bit versions of Windows, infect a computer's master boot record, and communicate over the Kad peer-to-peer network. It's newest payload means that victims now have an easy way to tell if they are infected.

"The real danger of a DNS Changer infection is that it is an indicator that your system is infected with a larger malware cocktail with malware such as Rogue AV, Zeus Banking Trojan, Spam Bot, etc." an emailed report from Dell SecureWorks stated. "Controlling DNS literally gives an attacker complete access to a system."

End users who want to know if their systems are infected should check the DNS server settings of their operating system and routers. Compromised systems will show server IP addresses within the following ranges:

85.255.112.0 through 85.255.127.255

67.210.0.0 through 67.210.15.255

93.188.160.0 through 93.188.167.255

77.67.83.0 through 77.67.83.255

213.109.64.0 through 213.109.79.255

64.28.176.0 through 64.28.191.255

To check DNS settings on Windows open a command prompt and type "ipconfig /all" and then check the DNS Server field. On a Mac, choose System Preferences and then select Network. Then click on the Advanced button of the active connection. Users may also want to check the DNS servers used by their router.

FBI officials said 4 million PCs were infected by the DNS Changer used in the operation that was shut down last week. The Dell SecureWorks report said researchers aren't sure if that number is accurate. Researchers monitoring the command and control servers used in the attack are seeing about 600,000 unique IP addresses connect per day. ®


http://www.theregister.co.uk/2011/11/14/tdss_drops_dns_changer/

 

Good to know, thanks.

 

More from ThreatPost

More at Link

 

Existing thread:
https://www.wilderssecurity.com/showthread.php?t=311763

@ Mods - merge at your discretion, thanks.

 

https://krebsonsecurity.com/2012/02...s-govt-still-infected-with-dnschanger-trojan/

 

"DNS Changer infrastructure shutdown is a "good" thing" : http://nakedsecurity.sophos.com/2012/02/05/dns-changer-infrastructure-shutdown-is-a-good-thing/

 

https://krebsonsecurity.com/2012/02/feds-request-dnschanger-deadline-extension/

 

Hopefully you will see this green sign displayed...

For English speaking users: Your system is not affected by the DNSChanger trojan malware. For more information on this topic please visit the FBI website.

- excerpted from SmartComputing

 

FBI request for extension approved, according to F-Secure weblog, link

'Update: The U.S. District Court, Southern District of New York has granted the F.B.I. permission to host its substitute DNS servers for an additional 120 days — July 9th is the new deadline.'

I can understand the FBI can't force a specific malware removal prog onto users/corporations affected but could a warning page be possible like Dutch police has done after participating in taking down the Bredolab botnet link (The approach by the NL High Tech Crime Unit was controversial reg. privacy laws, due to a program installed onto botnet victim PC's redirecting them to a warning page).
US law is also restrictive in this regard?

 

Hi Baserk,
So why is the FBI interested in continuing to host the substitute DNS servers?
Out of the goodness of their hearts?
Ongoing evidence-gathering?

 

so what software do people used to kill this thing?

 

My guess is that the above quote from Dermot7 has to do with it;
'More than two months after authorities shut down a massive Internet traffic hijacking scheme, the malicious software that powered the criminal network is still running on computers at half of the Fortune 500 companies, and on PCs at nearly 50 percent of all federal government agencies'

I wonder, now that the FBI has the botnet herders in custody, if they're afraid of the (legal) backlash if they'd just switch off the servers.
Then all of a sudden it's the FBI who has 'killed' internet for hundreds of thousands of users and more importantly, corporations and government agencies as well.
They're pretty much damned if they will and damned if they don't (kill the DNS servers).
I hardly think they need to use these servers to spy on US citizens (could be wrong though).

For example; Kaspersky TDSS Killer/MalwarebytesAntiMalware/HitmanPro3, aka the usual suspects.

 

The SmartComputing link I provided at the end of the above post has some additional steps for removing DNSChanger.

 

@ Baserk...
I see what you mean, and agree with you.

Btw, this is indeed astounding, when you think about it...