A new Android Trojan can redirect traffic to malicious websites after it gets into routers and changes their DNS settings.
The malware, called “Switcher,” looks like an Android client for the Chinese search engine Baidu, and a Chinese app for sharing WiFi network details, said researchers at Kaspersky Lab.
Once users install one of these apps, the malware attempts to guess the username and password of the WiFi router of the infected Android device.
“This Trojan is quite unique. Instead of attacking a user, it attacks the WiFi network the user is connected to, or, to be precise, the wireless router that serves the network,” said Nikita Buchka, mobile security researcher at Kaspersky Lab.
Switcher includes a list of more than two dozen username and password combinations that could allow it to access the router’s web administration interface, such as admin:admin, admin:123456, or admin:00000000.
If the web administration interface can end up accessed, the Trojan replaces the device’s primary and secondary DNS servers with IP addresses pointing to rogue DNS servers. These addresses are 184.108.40.206, 220.127.116.11 and 18.104.22.168 — one is the default option, while the other two are set for specific ISPs.
“The code that performs these actions is a complete mess, because it was designed to work on a wide range of routers and works in asynchronous mode,” Buchka said.
With the router’s DNS settings pointing to a machine controlled by the attackers, traffic gets redirected to malicious websites instead of the legitimate site the victim is trying to access. The developers behind the Trojan said they have compromised nearly 1,300 websites, mainly in China, Kaspersky researchers said.
“The Trojan targets the entire network, exposing all its users, whether individuals or businesses, to a wide range of attacks — from phishing to secondary infection,” Buchka said. “A successful attack can be hard to detect and even harder to shift: The new settings can survive a router reboot, and even if the rogue DNS is disabled, the secondary DNS server is on hand to carry on.”