World's stealthiest rootkit pushes DNS hijacking trojan

Discussion in 'malware problems & news' started by hawki, Nov 14, 2011.

Thread Status:
Not open for further replies.
  1. hawki

    hawki Registered Member

    Joined:
    Dec 17, 2008
    Posts:
    1,954
    Location:
    DC Metro Area

    World's stealthiest rootkit pushes DNS hijacking trojan


    DNS Changer dropped by TDSS


    By Dan Goodin •
    Posted in Malware, 14th November 2011 21:49 GMT


    One of the world's most advanced pieces of malware is being used to spread DNS Changer, a trojan at the heart of a massive click fraud scheme that has already hijacked 4 million PCs, security researchers said.

    Just a few days after federal prosecutors in the US shuttered the international conspiracy, researchers from Dell SecureWorks said they discovered DNS Changer is being spread by TDSS. The rootkit, as previously reported, is among the hardest to detect and remove and is often used as a means to install keyloggers, tools for attacking websites, and other malware.

    Once installed, DNS Changer is able to alter the DNS, or domain name system, settings that computers and routers use to find the IP numbers that correspond to domain names such as theregister.co.uk and google.com. By replacing legitimate DNS servers with servers under the control of the attackers, they are able to send victims to fraudulent websites instead of the destinations the victims intended to visit.

    Last week, seven people from Estonia and Russia were criminally charged in a scam that for more than five years used DNS Charger to generate more than $14 million in profit. The racked up the windfall by redirecting victims to imposter websites that paid advertising fees to the attackers each time they were clicked on. The scheme preyed on users of computers running Microsoft Windows and Apple OS X operating systems. DNS Changer is also able to change DNS configuration settings in certain routers, particularly when they use default usernames and passwords.

    The ability of TDSS to evade antivirus protection and other security software is well documented. The rootkit, which is also known as TDL4 and Aleureon, is among the world's most advanced, with the ability to infect 64-bit versions of Windows, infect a computer's master boot record, and communicate over the Kad peer-to-peer network. It's newest payload means that victims now have an easy way to tell if they are infected.

    "The real danger of a DNS Changer infection is that it is an indicator that your system is infected with a larger malware cocktail with malware such as Rogue AV, Zeus Banking Trojan, Spam Bot, etc." an emailed report from Dell SecureWorks stated. "Controlling DNS literally gives an attacker complete access to a system."

    End users who want to know if their systems are infected should check the DNS server settings of their operating system and routers. Compromised systems will show server IP addresses within the following ranges:

    85.255.112.0 through 85.255.127.255

    67.210.0.0 through 67.210.15.255

    93.188.160.0 through 93.188.167.255

    77.67.83.0 through 77.67.83.255

    213.109.64.0 through 213.109.79.255

    64.28.176.0 through 64.28.191.255

    To check DNS settings on Windows open a command prompt and type "ipconfig /all" and then check the DNS Server field. On a Mac, choose System Preferences and then select Network. Then click on the Advanced button of the active connection. Users may also want to check the DNS servers used by their router.

    FBI officials said 4 million PCs were infected by the DNS Changer used in the operation that was shut down last week. The Dell SecureWorks report said researchers aren't sure if that number is accurate. Researchers monitoring the command and control servers used in the attack are seeing about 600,000 unique IP addresses connect per day. ®


    http://www.theregister.co.uk/2011/11/14/tdss_drops_dns_changer/
     
  2. Rilla927

    Rilla927 Registered Member

    Joined:
    May 12, 2005
    Posts:
    1,710
    Good to know, thanks.
     
  3. siljaline

    siljaline Former Poster

    Joined:
    Jun 29, 2003
    Posts:
    6,619
    More from ThreatPost

    More at Link
     
  4. siljaline

    siljaline Former Poster

    Joined:
    Jun 29, 2003
    Posts:
    6,619
  5. Dermot7

    Dermot7 Registered Member

    Joined:
    Dec 20, 2009
    Posts:
    3,196
    Location:
    Surrey, England.
  6. Dermot7

    Dermot7 Registered Member

    Joined:
    Dec 20, 2009
    Posts:
    3,196
    Location:
    Surrey, England.
    "DNS Changer infrastructure shutdown is a "good" thing" : http://nakedsecurity.sophos.com/2012/02/05/dns-changer-infrastructure-shutdown-is-a-good-thing/
     
  7. Dermot7

    Dermot7 Registered Member

    Joined:
    Dec 20, 2009
    Posts:
    3,196
    Location:
    Surrey, England.
    https://krebsonsecurity.com/2012/02/feds-request-dnschanger-deadline-extension/
     
  8. Page42

    Page42 Registered Member

    Joined:
    Jun 18, 2007
    Posts:
    5,828
    Location:
    Last Breath Farm
    dnschanger warning sign.jpg

    Hopefully you will see this green sign displayed...
    dnschanger warning sign II.jpg
    For English speaking users: Your system is not affected by the DNSChanger trojan malware. For more information on this topic please visit the FBI website.

    - excerpted from SmartComputing
     
  9. Baserk

    Baserk Registered Member

    Joined:
    Apr 14, 2008
    Posts:
    1,317
    Location:
    AmstelodamUM
    FBI request for extension approved, according to F-Secure weblog, link

    'Update: The U.S. District Court, Southern District of New York has granted the F.B.I. permission to host its substitute DNS servers for an additional 120 days — July 9th is the new deadline.'

    I can understand the FBI can't force a specific malware removal prog onto users/corporations affected but could a warning page be possible like Dutch police has done after participating in taking down the Bredolab botnet link (The approach by the NL High Tech Crime Unit was controversial reg. privacy laws, due to a program installed onto botnet victim PC's redirecting them to a warning page).
    US law is also restrictive in this regard?
     
  10. Page42

    Page42 Registered Member

    Joined:
    Jun 18, 2007
    Posts:
    5,828
    Location:
    Last Breath Farm
    Hi Baserk,
    So why is the FBI interested in continuing to host the substitute DNS servers?
    Out of the goodness of their hearts?
    Ongoing evidence-gathering? :doubt:
     
  11. grasshopper44

    grasshopper44 Registered Member

    Joined:
    Feb 18, 2012
    Posts:
    4
    Location:
    United States
    so what software do people used to kill this thing?
     
  12. Baserk

    Baserk Registered Member

    Joined:
    Apr 14, 2008
    Posts:
    1,317
    Location:
    AmstelodamUM
    My guess is that the above quote from Dermot7 has to do with it;
    'More than two months after authorities shut down a massive Internet traffic hijacking scheme, the malicious software that powered the criminal network is still running on computers at half of the Fortune 500 companies, and on PCs at nearly 50 percent of all federal government agencies'

    I wonder, now that the FBI has the botnet herders in custody, if they're afraid of the (legal) backlash if they'd just switch off the servers.
    Then all of a sudden it's the FBI who has 'killed' internet for hundreds of thousands of users and more importantly, corporations and government agencies as well.
    They're pretty much damned if they will and damned if they don't (kill the DNS servers).
    I hardly think they need to use these servers to spy on US citizens (could be wrong though).
    For example; Kaspersky TDSS Killer/MalwarebytesAntiMalware/HitmanPro3, aka the usual suspects.
     
  13. Page42

    Page42 Registered Member

    Joined:
    Jun 18, 2007
    Posts:
    5,828
    Location:
    Last Breath Farm
    The SmartComputing link I provided at the end of the above post has some additional steps for removing DNSChanger.
     
  14. Page42

    Page42 Registered Member

    Joined:
    Jun 18, 2007
    Posts:
    5,828
    Location:
    Last Breath Farm
    @ Baserk...
    I see what you mean, and agree with you.
    Btw, this is indeed astounding, when you think about it...
     
Loading...
Thread Status:
Not open for further replies.