By using this site, you agree to the Privacy Policy and Terms of Use.
Accept
10alert.com10alert.com10alert.com
  • Threats
    • WordPress ThreatsDanger
    Threats
    A cyber or cybersecurity threat is a malicious act that seeks to damage data, steal data, or disrupt digital life in general. Cyber threats include…
    Show More
    Top News
    Kaspersky Internet Security for Android wins independent anti-virus testing
    12 months ago
    DEF CON 23: Tell me who you are and I will tell you your lock screen pattern
    12 months ago
    Adwind malware-as-a-service infecting hundreds of thousands devices
    11 months ago
    Latest News
    Wordfence Intelligence Weekly WordPress Vulnerability Report (September 11, 2023 to September 17, 2023)
    5 days ago
    Exploring Winrar Vulnerability (CVE-2023-38831) | McAfee Blog
    6 days ago
    Two PHP Object Injection Vulnerabilities Fixed in Essential Blocks
    7 days ago
    Agent Tesla’s Unique Approach: VBS and Steganography for Delivery and Intrusion
    1 week ago
  • Fix
    Fix
    Troubleshooting guide you need when errors, bugs or technical glitches might ruin your digital experience.
    Show More
    Top News
    Windows 10 build 19044.1947 (KB5016688) outs as preview
    12 months ago
    How to disable WiFi or Ethernet network adapter on Windows 11
    12 months ago
    How to get help on Windows 10
    12 months ago
    Latest News
    How automatically delete unused files from my Downloads folder?
    7 months ago
    Now you can speed up any video in your browser
    7 months ago
    How to restore access to a file after EFS or view it on another computer?
    8 months ago
    18 Proven Tips to Speed Up Your WordPress Site and Improve SEO | 2023 Guide
    8 months ago
  • How To
    How ToShow More
    Switching to Cloudflare can cut your network carbon emissions up to 96% (and we’re joining the SBTi)
    Switching to Cloudflare can cut your network carbon emissions up to 96% (and we’re joining the SBTi)
    17 hours ago
    Cloudflare account permissions, how to use them, and best practices
    Cloudflare account permissions, how to use them, and best practices
    17 hours ago
    Announcing Cloudflare Incident Alerts
    Announcing Cloudflare Incident Alerts
    17 hours ago
    Welcome to Birthday Week 2023
    Welcome to Birthday Week 2023
    2 days ago
    A new wave of innovation with Edge, your AI-powered browser
    3 days ago
  • News
    News
    This category of resources includes the latest technology news and updates, covering a wide range of topics and innovations in the tech industry. From new…
    Show More
    Top News
    GOOGLE Suspicious Site Reporter
    12 months ago
    Display All Products Purchased by User
    11 months ago
    Change “Add to cart” text if has_term
    11 months ago
    Latest News
    How to use image layers on Paint for Windows 11
    6 days ago
    How to disable Copilot on Windows 11 (completely)
    2 weeks ago
    How to blur image background in Photos for Windows 11
    2 weeks ago
    How to hide text from screenshots on Snipping Tool for Windows 11
    2 weeks ago
  • Glossary
  • My Bookmarks
Reading: The Switcher Trojan hacks Wi-Fi routers, switches DNS
Share
Notification Show More
Aa
Aa
10alert.com10alert.com
  • Threats
  • Fix
  • How To
  • News
  • Glossary
  • My Bookmarks
  • Threats
    • WordPress ThreatsDanger
  • Fix
  • How To
  • News
  • Glossary
  • My Bookmarks
Follow US
Threats

The Switcher Trojan hacks Wi-Fi routers, switches DNS

Tom Grant
Last updated: 13 October
Tom Grant 12 months ago
Share
5 Min Read

One of the most important pieces of advice on cybersecurity is that you should never input logins, passwords, credit card information, and so forth, if you think the page URL looks weird. Weird links are sometimes a sign of danger. If you see, say, fasebook.com instead of facebook.com, that link is weird.

Contents
Hijacking and then switching DNS requestsHow Switcher worksHow to protect against these attacks

But what if the fake Web page is hosted on the legitimate page? It turns out this scenario is actually plausible — and the bad guys don’t even need to hack the server that hosts the target page. Let’s examine how it works.

Hijacking and then switching DNS requests

The trick here is in the way our normal-looking Web page addresses are an add-on to real the IP addresses the Internet works with. This add-on is called DNS — the Domain Name System. Every time you enter a website address in the browser’s address bar, your computer sends a request to a designated DNS server, which returns the address of the domain you need.

For example, when you enter google.com, the respective DNS server returns the IP address 87.245.200.153 — that is where you are effectively being directed. This is how it happens, in a nutshell:

That's how DNS normally works

The thing is, malefactors can create their own DNS server that returns another IP address (say, 6.6.6.6) in response to your “google.com” request, and that address might host a malicious website. This method is called DNS hijacking.

That's how hijacked DNS works

Now, the success of the venture depends on having a method that makes a victim use a malicious DNS server, which will direct them to a fake website, instead of a legitimate one. Here is how the creators of the Switcher Trojan solved this problem.

How Switcher works

The Switcher developers created a couple of Android apps, one of which mimics Baidu (a Chinese Web search app, analogous to Google), and another that poses as a public Wi-Fi password search app, which helps users to share passwords to public hotspots; this type of service is also quite popular in China.

Once the malicious app infiltrates the target smartphone connected to a Wi-Fi network, it communicates to a command-and-control (C&C) server and reports that the Trojan has been activated in a particular network. It also provides a network ID.

Then Switcher starts hacking the Wi-Fi router. It tests various admin credentials to log in to the settings interface. Judging by the way this part of the Trojan works, right now the method is functional only if TP-Link routers are used.

If the Trojan manages to identify the right credentials, it goes to the router’s settings page and changes the legitimate default DNS server address to a malicious one. Also, the malware sets a legitimate Google DNS server at 8.8.8.8 as the secondary DNS, so that the victim doesn’t notice anything if the malicious DNS server is down.

Switcher hacks Wi-Fi routers, switches DNS

On the majority of wireless networks, devices get their network settings (including the address of a DNS server) from routers, so all users who get connected to a compromised network will use the malicious DNS server by default.

The Trojan reports its successes to the C&C server. Our experts, who found it, were lucky to discover stats of successful attacks, carelessly left lying around in the public part of the website.

Networks hijacked by Switcher Trojan: statistics from the website

If Switcher’s numbers are accurate, in less than four months, the malware has managed to infect 1,280 wireless networks, with all user traffic from those hotspots at the disposal of the culprits.

How to protect against these attacks

1. Apply the right settings to the router. First of all, change the default password to a more sophisticated one.

2. Don’t install suspicious apps on your Android smartphone. Stick with the official app store — although unfortunately, at times Trojans find their way to them, official app stores are still far more reliable than unofficial ones.

3. Use a robust antivirus on all of your devices for maximum protection. If you’ve been putting that off, you can install one right now: Here is a link to the free version of Kaspersky Antivirus & Security for Android. Our security solution detects this malware as Trojan.AndroidOS.Switcher and keeps your Wi-Fi network safe from it.


Source: kaspersky.com

Translate this article

TAGGED: Facebook, Malware, Security, Software, Threats, Trojan
Tom Grant October 13, 2022 October 7, 2022
Share This Article
Facebook Twitter Reddit Telegram Email Copy Link Print

STAY CONECTED

24.8k Followers Like
253.9k Followers Follow
33.7k Subscribers Subscribe
124.8k Members Follow

LAST 10 ALERT

Switching to Cloudflare can cut your network carbon emissions up to 96% (and we’re joining the SBTi)
Switching to Cloudflare can cut your network carbon emissions up to 96% (and we’re joining the SBTi)
Apps 17 hours ago
Cloudflare account permissions, how to use them, and best practices
Cloudflare account permissions, how to use them, and best practices
Apps 17 hours ago
Announcing Cloudflare Incident Alerts
Announcing Cloudflare Incident Alerts
Apps 17 hours ago
Welcome to Birthday Week 2023
Welcome to Birthday Week 2023
Apps 2 days ago
A new wave of innovation with Edge, your AI-powered browser
Windows 3 days ago

You Might Also Like

Switching to Cloudflare can cut your network carbon emissions up to 96% (and we’re joining the SBTi)
Apps

Switching to Cloudflare can cut your network carbon emissions up to 96% (and we’re joining the SBTi)

17 hours ago
Cloudflare account permissions, how to use them, and best practices
Apps

Cloudflare account permissions, how to use them, and best practices

17 hours ago
Announcing Cloudflare Incident Alerts
Apps

Announcing Cloudflare Incident Alerts

17 hours ago
Welcome to Birthday Week 2023
Apps

Welcome to Birthday Week 2023

2 days ago
Show More

Related stories

How to upgrade to Windows 11 23H2 with Installation Assistant
Critical Vulnerability in Forminator Plugin
How to blur image background in Photos for Windows 11
How to download official Windows 11 23H2 ISO file
PHP Object Injection Vulnerability in Flatsome Theme
How to download Windows 11 22H2 ISO after 23H2 releases
Previous Next

10 New Stories

Curator can help you with PC Game Pass picks
Cloudflare Email Security now works with CrowdStrike Falcon LogScale
Wordfence Intelligence Weekly WordPress Vulnerability Report (September 11, 2023 to September 17, 2023)
Exploring Winrar Vulnerability (CVE-2023-38831) | McAfee Blog
How to use image layers on Paint for Windows 11
New! Rate Limiting analytics and throttling
Previous Next
Hot News
Switching to Cloudflare can cut your network carbon emissions up to 96% (and we’re joining the SBTi)
Cloudflare account permissions, how to use them, and best practices
Announcing Cloudflare Incident Alerts
Welcome to Birthday Week 2023
A new wave of innovation with Edge, your AI-powered browser
10alert.com10alert.com
Follow US
© 10 Alert Network. All Rights Reserved.
  • Privacy Policy
  • Contact
  • Customize Interests
  • My Bookmarks
  • Glossary
Go to mobile version
adbanner
AdBlock Detected
Our site is an advertising supported site. Please whitelist to support our site.
Okay, I'll Whitelist
Welcome Back!

Sign in to your account

Lost your password?