1. Home
  2. Chat
  3. New COVID-19 Attack on HOME ROUTERS

New COVID-19 Attack on HOME ROUTERS

In the News

New COVID-19 attack on HOME ROUTERS sends users to spoofed sites that push malware

A recently discovered hack of home and small-office routers is redirecting users to malicious sites that pose as COVID-19 informational resources in an attempt to install malware that steals passwords and cryptocurrency credentials, researchers said on Wednesday.

A post published by security firm Bitdefender said the compromises are hitting Linksys routers, although BleepingComputer, which reported the attack two days ago, said the campaign also targets D-Link devices.

It remains unclear how attackers are compromising the routers. The researchers, citing data collected from Bitdefender security products, suspect that the hackers are guessing passwords used to secure routers’ remote management console when that feature is turned on. Bitdefender also hypothesized that compromises may be carried out by guessing credentials for users’ Linksys cloud accounts.

Not the AWS site you’re looking for

The router compromises allow attackers to designate the DNS servers connected devices use. DNS servers use the Internet domain name system to translate domain names into IP addresses so that computers can find the location of sites or servers users are trying to access. By sending devices to DNS servers that provide fraudulent lookups, attackers can redirect people to malicious sites that serve malware or attempt to phish passwords.

The malicious DNS servers send targets to the domain they requested. Behind the scenes, however, the sites are spoofed, meaning they’re served from malicious IP addresses, rather than the legitimate IP address used by the domain owner. Liviu Arsene, the Bitdefender researcher who wrote Wednesday's post, told me that spoofed sites close port 443, the Internet gate that transmits traffic protected by HTTPS authentication protections. The closure causes sites to connect over HTTP and in so doing, prevents the display of warnings from browsers or email clients that a TLS certificate is invalid or untrusted.

Domains swept into the campaign include:

aws.amazon.com

https://developers.googleblog.com/2018/03/transitioning-google-url-shortener.html

https://bitly.com/

washington.edu

imageshack.us

ufl.edu

disney.com

pubads.g.doubleclick.net

tidd.ly

redditblog.com

winimage.com

The IP addresses serving the malicious DNS lookups are 109.234.35.230 and 94.103.82.249.

The malicious-sites users land on claim to offer an app that provides “the latest information and instructions about coronavirus (COVID-19).”

garygemmell
2 months ago
What do you think of this?
garygemmell
garygemmell
Original Poster
2 months ago

My advice as an IT Security analyst is always:-

Login to your home router and SWITCH OFF REMOTE ACCESS!

Disable UPNP

Disable WPS

Enable firewall (Max) Mode!

Make sure your wireless is set for WPA2 authentication and use AES encryption and not TKIP.

This is all particularly relevant for LINKSYS routers!!!

AND CHANGE THAT ADMIN PASSWORD!

Like
Reply
2
lilyflower
lilyflower2 months ago

Gosh you have been busy and I thought all you did was chat to us females - mostly. Thanks for the info.

Like
Reply
mso
mso2 months ago

Thank you for your advice, I will try to look into those settings but wow that sounded so complicated ☺️ I barely manage to set up my router in a first place let alone changing the settings 🤣

Like
Reply
Dennab
Dennab2 months ago

mso Don't worry it's fairly straightforward. Just be careful to not change unnecessary settings.

Like
Reply
2
lilyflower
lilyflower2 months ago

Are you ok? Been quiet over weekend, missed the banter.

Like
Reply
shadowcat
shadowcat2 months ago

Thats some scary stuff, going to have a look at the setting

Like
Reply
1
Dennab
Dennab2 months ago

Wow, some really have no limit on how they will go. Thanks for the top advice Gary.

Like
Reply
1
One of the UK's largest deal hunting communities

Join for free to get genuine deals, money saving advice and help from our friendly community

Kelsey, Tom
& Deepak
Founders
Founders of Latest Deals
We use cookies (e.g. personalisation, analytics, social media). Find out more.