Ongoing DNS hijackings target unpatched consumer routers

guest · Apr 5, 2019

Ongoing DNS hijackings target unpatched consumer routers
Three waves of attacks all come from people abusing Google cloud service, researcher says
April 4, 2019
https://arstechnica.com/information...hijackings-target-unpatched-consumer-routers/

Over the past four months, a blog post published Thursday said, attackers have been using Google cloud service to scan the Internet for routers that are vulnerable to remote exploits. When they find susceptible routers, the attackers then use the Google platform to send malicious code that configures the routers to use malicious DNS servers.

At the time this post was being written, the last batch of rogue DNS servers was still operating, Mursch told Ars. The DNS servers from the previous waves, he added, were no longer operating. While the attacks abused services from a variety of providers, Mursch said Google's cloud service stood out.

"It's not meant to be a Google hit piece," the researcher said of Thursday's post. "But it's so trivial to abuse their platform. You sign up for an account and boom. It really is that easy."
Click to expand...

Troy Mursch, the independent security researcher who published Thursday's post, said the first wave hit in late December. The campaign exploited vulnerabilities in four models of D-Link routers [...]
A second wave in early February targeted the same vulnerable D-Link routers [...]
The third and last-known wave occurred last week. It came from three distinct Google Cloud Platform hosts and targeted additional consumer router models including the ARG-W4 ADSL, DSLink 260E, and those from Secutech and TOTOLINK. [...]
Click to expand...

Log in or Sign up

Ongoing DNS hijackings target unpatched consumer routers

guest Guest

Log in or Sign up

Ongoing DNS hijackings target unpatched consumer routers

guest Guest

Useful Searches