-3

I had a problem with my router (in the question Same popup on my devices, is there a malware? I wasn't able to reply) it was infected with malware.I checked the problem by changing the router and the popups disappeared.

That was the first time facing this kind of malware, how is it possible to infect a router!

Is there any level of security in the firmware ?

The router model is Level one.

3 Answers 3

1

How is it possible to infect a router?

There are many possible infection vectors.

  • In one such infection the malware is used to tamper with the router and its DNS settings. This malware infects the router from the local network (DNS Changer Malware Sets Sights on Home Routers).

    The malware would redirect users to malicious versions of pages. This allows criminals to steal account credentials, PIN numbers, passwords, etc.

    As pointed out in another answer, the DNS can also be used to redirect requests via ad servers.

  • In another infection the malware infects the router from the internet using a flaw in the router remote access code (Bizarre attack infects Linksys routers with self-replicating malware).

  • Many other router malware variants can be found by searching for "router malware".


DNS Changer Malware Sets Sights on Home Routers

Home routers can be used to steal user credentials, and most people just don’t know it yet. Bad guys have found ways to use Domain Name System (DNS) changer malware to turn the most inconspicuous network router into a vital tool for their schemes.

We already know that routers sometimes ship with malicious DNS server settings. In this scenario, the malware is used to tamper with the router and its DNS settings. In the event that users try to visit legitimate banking websites or other pages defined by the bad guys, the malware would redirect users to malicious versions of the said pages. This would allow cybercriminals to steal users’ account credentials, PIN numbers, passwords, etc.

We’ve seen a growing number of related malicious sites in Brazil (nearly 88% of all infections), the United States, and Japan. These sites run a browser script that performs a brute-force attack against the victim’s router, from the internal network. With access to the administration interface through the right credentials, the script sends a single HTTP request to the router with a malicious DNS server IP address. Once the malicious version replaces the current IP address, the infection is done. Except for the navigation temporary files, no files are created in the victim machine, no persistent technique is needed and nothing changes.

Modified DNS settings mean users do not know they are navigating to clones of trusted sites. Users that don’t change the default credentials are highly vulnerable to this kind of attack.

Source DNS Changer Malware Sets Sights on Home Routers


Bizarre attack infects Linksys routers with self-replicating malware

The attack begins with a remote call to the Home Network Administration Protocol (HNAP), an interface that allows ISPs and others to remotely manage home and office routers. The remote function is exposed by a built-in Web server that listens for commands sent over the Internet. Typically, it requires the remote user to enter a valid administrative password before executing commands, although previous bugs in HNAP implementations have left routers vulnerable to attack. After using HNAP to identify vulnerable routers, the worm exploits an authentication bypass vulnerability in a CGI script. (Ullrich isn't identifying the script because it remains unfixed on many older routers, and he doesn't want to make it easier for attackers to target it.) Ullrich said he has ruled out weak passwords as the cause of the Linksys infections.

Source Bizarre attack infects Linksys routers with self-replicating malware

3

It’s not actually an infection in the traditional sense. Instead, it just changes your router’s DNS settings so that requests are made to special DNS servers. These servers are configured to redirect you to fake sites and/or malware-infected versions of real sites.

For example, they could create a copy of your bank’s web site. The next time you try to access online banking, they could obtain your credentials and, depending on how secure your bank’s website is, even steal your money.

3
  • After changing the router is it going to disappeare from my devices?
    – AyS
    Jun 4, 2015 at 15:59
  • Your devices may(!) be really infected by now, for example from programs you downloaded while the router was compromised. The problem really is how your router was attacked in the first place; this kind of manipulation is only possible if your router suffers from security vulnerabilities. You should check for firmware updates or even replace the device completely.
    – Daniel B
    Jun 4, 2015 at 16:03
  • @AyS You don't have to change the router, just undo the DNS settings change and secure your router properly. First step is to change the default password.
    – gronostaj
    Jun 7, 2015 at 12:33
2

DanielB is not wrong, but your question is more along the lines of "how".

Routers typically are set up to not allow remote administration from outside of your LAN. But they will accept remote administration access from computers within their own LAN.

Your malware probably used your computer to access the admin pages, so the router accepted an admin connection from within the LAN. The malware may have done it entirely from within a browser session, but more likely it just dropped a trojan onto your system that then inspected the router and tried a list of known vulnerabilities (like simply using the default factory password) and then made configuration changes to the DNS to route all your requests through their ad servers where they proxy all your pages and inject code into them.

You should probably do a hard factory reset on it (check the manual, but usually something like: turn off, press and hold the reset button for 90 secs while turning it back on) and then reconfiguring it. Change the password.

Note that it is possible to upload new firmware in this manner, so it is possible it is more than just a user configuration change.

You also need to inspect your computers for any program droppers and/or trojans which will simply re-edit your router settings.

2
  • If a trojan is successfully deployed, you might as well skip the whole router thing. ;) It's so popular exactly because it doesn't involve getting malware to run, because that's a huge obstacle.
    – Daniel B
    Jun 4, 2015 at 23:16
  • well, the advantage of doing the router is that it can reinject malware onto the computer after a new OS install. Kind of a distributed robin hood/friar tuck ( csd.uwo.ca/~magi/personal/humour/Computer_Folklore/… ) Additionally the malware poses as cover for the real vector. Note I never said that was the vector since I don't know, but it doesn't require cross site scripting etc.
    – Yorik
    Jun 5, 2015 at 15:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .