Kaspersky Lab experts have uncovered a remarkable evolution in Android OS malware: the Switcher Trojan. It treats unsuspecting Android device users as tools to infect Wi-Fi routers, changing the routers’ DNS settings and redirecting traffic from devices connected to the network to websites controlled by the attackers, leaving users vulnerable to phishing, malware and adware attacks and more. The attackers claim to have successfully infiltrated 1,280 wireless networks so far, mainly in China.
Domain Name Servers (DNS) turn a readable web address such as ‘x.com’ into the numerical IP address required for communications between computers. The ability of the Switcher Trojan to hijack this process gives the attackers almost complete control over network activity which uses the name-resolving system, such as internet traffic. The approach works because wireless routers generally reconfigure the DNS settings of all devices on the network to their own – thereby forcing everyone to use the same rogue DNS.
The infection is spread by users downloading one of two versions of the Android Trojan from a website created by the attackers.
When an infected device connects to a wireless network, the Trojan attacks the router and tries to brute-force its way to the web admin interface by guessing the password, relying on a long, predefined list of password and login combinations. If the attempt is successful, the Trojan exchanges the existing DNS server for a rogue one controlled by the cybercriminals, and also a secondary DNS, to ensure ongoing stability if the rogue DNS goes down.
To illustrate, what normally happens is this:
Following a successful Switcher attack, this is what happens:
The attackers have built a website to promote and distribute the Trojanized Wi-Fi app to users. The web server that hosts this site doubles as the malware authors’ command-and-control (C&C) server. Internal infection statistics spotted on an open part of this website reveal the attackers’ claims to have compromised 1,280 websites – potentially exposing all the devices connected to them to further attack and infection.
“The Switcher Trojan marks a dangerous new trend in attacks on connected devices and networks. It does not attack users directly. Instead, it turns them into unwilling accomplices: physically moving sources of infection. The Trojan targets the entire network, exposing all its users, whether individuals or businesses, to a wide range of attacks – from phishing to secondary infection. A successful attack can be hard to detect and even harder to shift: the new settings can survive a router reboot, and even if the rogue DNS is disabled, the secondary DNS server is on hand to carry on. Protecting devices is as important as ever, but in a connected world we cannot afford to overlook the vulnerability of routers and Wi-Fi networks,” said Nikita Buchka, mobile security expert, Kaspersky Lab.
The company recommends that all users check their DNS settings and search for the following rogue DNS servers:
If you have one of these servers in your DNS settings, contact your ISP support or alert the owner of the Wi-Fi network. Kaspersky Lab also strongly advises users to change the default login and password to the admin web interface of your router to prevent such attacks in the future.
View Previous Issue
Trend Micro detects new Android malware – MilkyDoor
Better user experience primary driving force behind new devices: Dell Study
Zyxel safeguard growing businesses with premium VPN firewall
NETGEAR Orbi Wifi System
Nithya Krishnan, Director, Marketing – India & SAARC, Trend Micro
Shilpa Mahna Bhatnagar, CEO and Co-founder at Evoxyz Technologies
Savneet Shergill, Director – India Talent Acquisition, Diversity & Inclusion, Dell
Shweta Thakare, Senior AVP – Europe, APAC & SAARC, eScan
Mangala Seshadri, Vice President, Analytics, SAP India
Parvinder Kaur, Arrow PC Solution
Ruchi Mahajan, Design Principal for ThoughtWorks India
Radhika Kalia – Associate Director, Corporate Affairs & CSR at Panasonic India
Kamolika Peres, Vice President and Head – Strategic Customer Program, SAP India
Kalika Bali- Researcher at Microsoft Research Labs India
Jaya Vaidhyanathan, President-BFSI & Strategic Business Initiatives, Bahwan CyberTek
Daisy Chittilapilly, Managing Director, Partner Organisation, Cisco India and SAARC
Chandana Gupta, Associate Director of Consumer Sales, Acer India
Arati Naik, COO, DIGISOL Systems Ltd
Adele Beachley, Managing Director, APAC for SOTI Inc,
Jaya Jagdish, Senior Director – Design Engineering at AMD
Amrita Malik, Business Head for Innoviti Payment Solutions
Aruna Reddy- Director of Global Partner Services, Microsoft India
Syamala Lanka, Global Delivery head at Wells Fargo India Solutions
Jyoti Chopra Director, Glaze Trading India Pvt. Ltd.
Peter Chang, Regional Head – South Asia & Country Manager – System Business Group – ASUS India
Pinaki Chatterjee, Regional Director (India & SAARC), AXILSPOT
Pankaj Harjai, Director of National Commercial Channel and Small and Medium Business (SMB), Lenovo India
Rajesh Doshi, Director, Zebronics India Pvt Ltd
Rajiv Bhatia, VP & COO – Ricoh India Ltd
Sanket Kulkarni, VP – Channel Sales, India & SAARC – D-Link
Vishal Parekh, Marketing Director, Kingston Technology – India
Sagar Gosalia, Sr. Vice President – Marketing & Sales, Matrix Comsec
Manoj Khadkikar, Business Unit Head- Channels & Solution Group- ZICOM
Mandar Joshi, Head – Channel Business, DIGISOL Systems Ltd
Marthesh Nagendra, Country Manager, NETGEAR, India & SAARC
Kuldeep Malhotra, Vice President, Konica Minolta Business Solution India
Limesh Parekh, CEO, Enjay IT Solutions
Krithiwas Neelakantan, Director Channel & Alliances for India & SAARC Operations, NetApp
Jitendra Ghughal, National Channel Manager, India & SAARC, Fortinet
Chandrahas Panigrahi CMO and Consumer Business Head Acer India
Avinash Purwar, Vice President, Global Partner Operations and Head of Emerging Business, SAP India
Chiradeep Rao, Channel Head, India and SAARC, Avaya
Eklavya Bhave, Head – Channels and Alliances (India & SAARC), Citrix
Altaf Halde, Managing Director, Kaspersky Lab (South Asia)
Anil Gupta, AVP- India, Sales, eScan
Adele Beachley, Managing Director, APAC for SOTI Inc
Ganesan Arumugam, Director – Partner & Commercial Sales, India, Symantec
Balaji Rajagopalan, Executive Director, Technology, Channels & International Distributor Operations, Xerox India
The IOT Market in India is Poised to Reach $15 Billion by 2020
Convergence & Collaboration are growth drivers for Barco
Connectivity Accessories will be a Big Business in Near Future
ICTS Virtual Computer – VM-900
Unmatched Quality, after sales support differentiate Matrix
PS Neogi, Joint Chief Operating Officer of IT Division
Prashanth G J, CEO at TechnoBind
Sunil Pillai, Founder & MD at iValue InfoSolutions
Manoj Kanodia, Chief Executive Officer, Inspira
Jaishankar Krishnan Ingram Micro
Byju Pillai, President and CEO, Inflow Technologies
Ashok Kumar, MD & CEO, RAH Infotech
Bhavin P Bhatt – Regional Director India & Saarc, MTech
Gopal Pansari Director at Savera Digital India Pvt Ltd.
Naresh Desai, GM, Avnet Technology Solutions, India
Bhavin Bhatt , Regional Director India & SAARC, M.Tech
Unni Krishnan. R, Transition Systems Pvt Ltd.
Byju Pillai, President & CEO, Inflow Technologies
Harish Rai Comguard
Manoj Kanodia, CEO, Inspira Enterprise
Ravi Pagar element14
Matrix Setu Vg –Multi-Sim Voip To Gsm/3g Gateway
RDP TD-500 Zero Client
2015 Powered By SME Channels