Researchers at Kaspersky Lab have come across a new Android Trojan that hacks routers and changes their DNS settings in an effort to redirect traffic to malicious websites.
Dubbed “Switcher,” the malware has been disguised as an Android client for the Chinese search engine Baidu, and a Chinese app for sharing Wi-Fi network details. Once users install one of these apps, the malware attempts to guess the username and password of the Wi-Fi router the infected Android device is connected to.
Switcher includes a list of more than two dozen username and password combinations that could allow it to access the router’s web administration interface, such as admin:admin, admin:123456, or admin:00000000.
If the web administration interface can be accessed, the Trojan replaces the device’s primary and secondary DNS servers with IP addresses pointing to rogue DNS servers. These addresses are 18.104.22.168, 22.214.171.124 and 126.96.36.199 – one is the default option, while the other two are set for specific ISPs.
“The code that performs these actions is a complete mess, because it was designed to work on a wide range of routers and works in asynchronous mode,” Buchka noted.
With the router’s DNS settings pointing to a machine controlled by the attackers, traffic gets redirected to malicious websites instead of the legitimate site the victim is trying to access. According to Kaspersky, the cybercriminals claim to have compromised nearly 1,300 websites, mainly in China.
“The Trojan targets the entire network, exposing all its users, whether individuals or businesses, to a wide range of attacks – from phishing to secondary infection,” said Buchka. “A successful attack can be hard to detect and even harder to shift: the new settings can survive a router reboot, and even if the rogue DNS is disabled, the secondary DNS server is on hand to carry on.”