Illuminating GhostDNS Infrastructure
This research was undertaken in collaboration with Manabu Niseki (@ninoseki on Twitter) and CERT.br (https://cert.br).
Manabu is a Tokyo-based researcher who has been tracking GhostDNS for a number of years. His leads and insight into GhostDNS assisted in confirming the findings documented in this blog post.
We will continue to collaborate with CERT.br on a shared goal of identifying the threat actors operating the infrastructure detailed in this blog.
Do you work for a national CERT? Are you interested in teaming up with Team Cymru on data research and threat assistance? Then join our CSIRT Assistance Program (CAP).
Before 2020 many companies may not have considered a mostly remote workforce when designing networks and network defenses. Similarly, most workers may not have considered the possibility of a “work from home” situation. The vulnerability of home network devices has probably never been more of a threat to information security.
Attackers continue to compromise vulnerable SOHO routers by taking advantage of default or weak user-defined passwords, as well as the use of publicly available exploits.
GhostDNS is a platform developed to help attackers find vulnerable routers and change the DNS settings of those that are exploitable. Most notably, attackers have used GhostDNS to target Brazilian financial institutions and their customers.
The attackers utilise two DNS servers – a primary ‘rogue’ server which redirects requests for specified websites of interest to phishing pages and a secondary server, generally Google’s public DNS server (8.8.8.8 or 8.8.4.4), which is used to handle all other requests.
This setup allows the attackers to remain undetected for long periods of time (we’ve observed this being several months in multiple cases) as, from a victim’s perspective, no discernible disruption to their normal browsing activity is encountered.
In this and future blog posts, we will examine what we have discovered and the methods used to hunt for the various elements of GhostDNS infrastructure within our Pure Signal™ threat hunting platform, Augury™.
INFRASTRUCTURE IDENTIFICATION
The starting point for this research was based on analysis of the GhostDNS source code, specifically changer scripts which contain URL strings used by the malware to alter an exploited router’s DNS settings. We extracted unique portions of these strings for testing against the URL dataset queryable within our platform:
DLINK routers = /dnscfg.cgi, /ddnsmngr.cmd, /Forms/dns_1
3COM routers = /Forms/dns
Secutech routers = /goform/AdvSetDns
Note: Some of these strings have appeared in previous research on generalized DNS hijacking attacks, with references made to the targeting of Brazilian banks and their customers[1]. Infrastructure identified using the above strings has shown correlation, via victim data, with other known GhostDNS infrastructure OR is associated with behaviour which matches the modus operandi of previous GhostDNS activity.
From the data obtained from Augury, the /dnscfg.cgi string was most commonly observed. An example of which is displayed below:
In this example, we identify 149.56.152[.]185 as the rogue DNS server, with one of Google’s public DNS servers being used for the secondary server (as previously discussed). The potential victims in this example have been obscured.
Focusing on the source of these connections, we were able to identify 21 distinct IP addresses being used by attackers in attempts to update the DNS settings of vulnerable routers, covering a period of 1st May 2020 to the time of publishing. We have categorized these as Changer IP addresses which are disclosed at the end of this blog.
From pivots on the URL strings and activity associated with the Changer IP addresses, 7 rogue DNS servers were identified:
107.155.132.186
107.155.152.17
111.90.159.53
149.56.152.185
192.169.7.38
51.81.27.247
80.82.77.163
A methodology was then established to identify further rogue DNS servers, based on potential victim interactions with the 7 servers already identified.
NetFlow queries were performed in Augury, filtered to examine inbound port 53 (commonly used for DNS) connections to the rogue DNS servers, thus identifying potential GhostDNS victims. Further queries were then performed on outbound connections to remote port 53, sourced from the potential victims identified in the first step.
Through repetition of this methodology, a further 13 rogue DNS servers were illuminated – all 20 identified rogue DNS servers are disclosed at the end of this blog and are also summarised in the timeline below:
Whilst a number of providers were utilized by the attackers for the hosting of the DNS servers, two providers in particular stood out in terms of the number of servers identified on each:
9 rogue DNS servers were identified being hosted on a /24 assigned to Nodes Direct Holdings, US.
5 rogue DNS servers were identified being hosted on a /24 assigned to Data City, CA.
Note: At this stage we have not ascertained whether the attackers are utilizing compromised or paid-for infrastructure for the hosting of rogue DNS servers.
PHISHING TARGETS
Passive DNS (PDNS) and DNS Query datasets from the Augury solution were utilized in order to provide further context around the nature of the requests being targeted by the attackers – for which their rogue DNS servers provide redirects to phishing pages.
Using 149.56.152[.]185 as an example again, the following websites were passively identified within Team Cymru’s data holdings as being targeted by attackers:
americanas.com.br
bb.com.br
bradesco.com.br
bradecocelular.com.br
caixa.gov.br
internetbanking.caixa.gov.br
msn.com
msn.com.br
netflix.com
shoptime.com.br
hotmail.com.br
paypal.com
This shows that as well as banking data, the attackers are also interested in obtaining possible email credentials, as well as account information for services like Netflix, PayPal and Shoptime – a Brazilian ecommerce website.
Pivoting on websites known to be targeted by the attackers, we are also able to close the loop on tying identified infrastructure into the wider GhostDNS threat activity.
VICTIMOLOGY
During the discovery exercise undertaken to illuminate rogue DNS servers, a total of more than 1,500 potential victim IP addresses* were identified.
The large majority of these IP addresses were assigned to providers in Brazil, however a small proportion of Argentinian assigned IP addresses were also observed.
It is plausible that the attackers maintain an interest in customers of Brazilian banks who reside within the wider South American region, this finding would appear to contradict previous reporting on GhostDNS, which has suggested that attacker activity is limited to Brazilian users only.
INDICATORS OF COMPROMISE
Changer IP addresses [21]
104.215.74.207
107.155.132.188
107.155.152.21
107.155.152.24
107.155.152.28
107.155.152.3
134.209.194.220
161.35.82.213
164.90.195.195
167.172.47.178
178.62.205.16
178.62.208.183
178.62.211.51
200.98.134.184
209.61.253.201
23.101.189.23
35.203.119.123
51.159.71.63
64.225.66.217
65.52.36.98
70.37.90.42
Rogue DNS servers [20]
107.155.132.186
107.155.132.189
107.155.152.13
107.155.152.14
107.155.152.15
107.155.152.17
107.155.152.27
107.155.152.28
107.155.152.5
111.90.159.53
149.56.152.185
162.248.164.36
192.169.7.38
45.62.198.242
45.62.198.243
45.62.198.73
45.62.198.74
45.62.198.89
51.81.27.247
80.82.77.163
PREVIOUS COMMUNITY REPORTING
Router exploit kits are very popular in Brazil, and late November we noticed a spike in the number of URLs blocked by Avast’s Web Shield. Taking a closer look, two landing pages, targeting Brazilians, hosting the GhostDNS router exploit kit used to carry out cross-site request forgery (CSRF) attacks, caught our attention. As we described … Continue reading
Router exploit kits are becoming more and more popular among cybercriminals, mostly targeting routers in Brazil, because many Brazilian routers are poorly secured with default and well known login credentials. Router exploit kits are usually distributed via malvertising webpages, and these campaigns appear in waves. A year ago (May 2019), our Avast Web Shield, a … Continue reading
* Team Cymru has provided any victim data to CERT.br.