Android Trojan Targets WiFi Network

Thursday, December 29, 2016 @ 02:12 PM gHale

A new Android Trojan can redirect traffic to malicious websites after it gets into routers and changes their DNS settings.

The malware, called “Switcher,” looks like an Android client for the Chinese search engine Baidu, and a Chinese app for sharing WiFi network details, said researchers at Kaspersky Lab.

RELATED STORIES
Trojan can Bypass Virtual Environment
Android Devices Packed with Trojans
PowerShell Used in Malware Attack
Malware Updates, Adds More Capabilities

Once users install one of these apps, the malware attempts to guess the username and password of the WiFi router of the infected Android device.

“This Trojan is quite unique. Instead of attacking a user, it attacks the WiFi network the user is connected to, or, to be precise, the wireless router that serves the network,” said Nikita Buchka, mobile security researcher at Kaspersky Lab.

Switcher includes a list of more than two dozen username and password combinations that could allow it to access the router’s web administration interface, such as admin:admin, admin:123456, or admin:00000000.

“With the help of JavaScript it tries to login using different combinations of logins and passwords,” Buchka said in a blog post. “Judging by the hardcoded names of input fields and the structures of the HTML documents that the Trojan tries to access, the JavaScript code used will work only on web interfaces of TP-LINK WiFi routers.”

If the web administration interface can end up accessed, the Trojan replaces the device’s primary and secondary DNS servers with IP addresses pointing to rogue DNS servers. These addresses are 101.200.147.153, 112.33.13.11 and 120.76.249.59 — one is the default option, while the other two are set for specific ISPs.

“The code that performs these actions is a complete mess, because it was designed to work on a wide range of routers and works in asynchronous mode,” Buchka said.

With the router’s DNS settings pointing to a machine controlled by the attackers, traffic gets redirected to malicious websites instead of the legitimate site the victim is trying to access. The developers behind the Trojan said they have compromised nearly 1,300 websites, mainly in China, Kaspersky researchers said.

“The Trojan targets the entire network, exposing all its users, whether individuals or businesses, to a wide range of attacks — from phishing to secondary infection,” Buchka said. “A successful attack can be hard to detect and even harder to shift: The new settings can survive a router reboot, and even if the rogue DNS is disabled, the secondary DNS server is on hand to carry on.”



Leave a Reply

You must be logged in to post a comment.