Cybercriminals compromise home routers to attack online banking users

Attackers changed the DNS configuration of vulnerable home routers to mount man-in-the-middle attacks against users in Poland

Attackers configure rogue DNS servers on compromised home routers to intercept online banking traffic

Attackers configure rogue DNS servers on compromised home routers to intercept online banking traffic

Attacks recently observed in Poland involved cybercriminals hacking into home routers and changing their DNS settings so they can intercept user connections to online banking sites.

Researchers from the Polish Computer Emergency Response Team (CERT Polska) believe attackers will likely target users from other countries as well in the future using similar techniques.

"The attack is possible due to several vulnerabilities in home routers that make DNS configuration susceptible to unauthorized remote modifications," the Polish CERT researchers said Thursday in a blog post. "In the resulting man-in-the-middle attack content of several e-banking websites was altered to include JavaScript injects that tricked users into giving up their usernames, passwords and TANs [transaction authentication numbers]. Effectively, money is stolen from users' bank accounts."

Unless intentionally configured otherwise, devices connected to a local network will typically use the DNS server provided by the network's router to resolve domain names to IP (Internet Protocol) addresses. If attackers compromise the router and configure it to use a DNS server under their control, they can respond with rogue IP addresses to DNS queries for the domain names they wish to target.

In the recent attacks in Poland, the hackers used a DNS server that responded with rogue IP addresses for the domain names of five Polish banks. Those IP addresses corresponded to a server that acted as a proxy, providing attackers with a man-in-the-middle position to intercept, inspect and modify traffic between users and the online banking websites they wanted to target.

The problem for the hackers was that those sites used HTTPS -- HTTP with SSL encryption -- making it impossible to impersonate them without a valid digital certificate issued by a certificate authority. Because of this, they decided to use a less sophisticated technique known as SSL stripping.

Many banks use SSL encryption for their online banking systems, but not their entire websites. In most cases, users first connect to the bank's main website over plain HTTP and then click on a button or link to access the log-in page for the secure part of the site where SSL is enabled.

It is at this point that attackers prevented the secure connection from being established. Their rogue proxy server established an encrypted connection with the online banking site, but kept the connection between the user and itself unencrypted.

When such an attack is in progress, the visual indicators for secure SSL connections are missing from the browser. However, it's hard for the victims to notice since they clicked on a URL from the bank's real website so they have no reason to suspect an attack, said Przemyslaw Jaroszewski, the head of incident response at CERT Polska.

The attackers went even further and rewrote the URLs seen by users in their browser's address bar to have "ssl-." in front of the domain name.

While none of the individual techniques used in the attacks were new, Jaroszewski said that as far as he knows this is the first time when attackers used them together in a mass attack targeting online banking users.

Polish IT security outfit linked the attacks to a vulnerability reported last month in ZyNOS, a router firmware created by ZyXEL Communications that's apparently also used in some router models from other manufacturers including TP-Link, ZTE, D-Link and AirLive.

The vulnerability allows attackers to download a file containing the router's configuration without authentication. The file can then be unpacked and parsed to extract the password for the router's administrative interface.

CERT Polska couldn't definitively link a particular vulnerability to the DNS attacks, Jaroszewski said. While the ZyNOS vulnerability looks like a strong candidate, some of the attacks date back to late December, before the vulnerability was publicly disclosed, he said.

"There are many ways to modify DNS entries in home routers, some of them known for years," Jaroszewski said. "It is actually surprising that it's the first time we see it exploited for profit on a mass scale."

Many vulnerabilities that allowed remote access to the administration interface of home routers were found over the years, including in models supplied by various ISPs to their customers.

Three vulnerabilities were found last month in a router called EE BrightBox that's provided by British broadband provider EE to customers as standard equipment. One of those vulnerabilities could potentially allow attackers to change the router's DNS configuration.

Jaroszewski believes that it's likely DNS attacks like those in Poland will be used against online banking users in other countries in the future. However, for now he wasn't aware of any reports of similar attacks outside Poland.

While routers configured for remote administration over the Internet are obviously more likely to be targeted, Jaroszewski said that he knows of cases where malicious JavaScript code loaded from a website was used to instruct visitors' browsers to send rogue commands to their home routers over the local networks using default credentials. This is known as a cross-site request forgery attack.

"In order to protect a home routers from the attack, any type of remote administration access from the Internet should be disabled," the Polish CERT researchers said. "Default usernames and passwords should be changed to unique ones, not revealed publicly."

Join the CSO newsletter!

Error: Please check your email address.

Tags online safetysecurityCERT PolskaAccess control and authenticationZyXEL CommunicationsencryptionscamsExploits / vulnerabilitiesfraudintrusion

More about CERT AustraliaComputer Emergency Response TeamD-Link AustraliaTP-LinkZTEZyXEL

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Lucian Constantin

Latest Videos

  • 150x50

    CSO Webinar: Will your data protection strategy be enough when disaster strikes?

    Speakers: - Paul O’Connor, Engagement leader - Performance Audit Group, Victorian Auditor-General’s Office (VAGO) - Nigel Phair, Managing Director, Centre for Internet Safety - Joshua Stenhouse, Technical Evangelist, Zerto - Anthony Caruana, CSO MC & Moderator

    Play Video

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

More videos

Blog Posts

Market Place