- March 23, 2020
A new cyber attack is hijacking router’s DNS settings so that web browsers display alerts for a fake COVID-19 information app from the World Health Organization that is the Vidar information-stealing malware.
For the past five days, people have been reporting their web browser would open on its own and display a message prompting them to download a ‘COVID-19 Inform App’ that was allegedly from the World Health Organization (WHO).
After further research, it was determined that these alerts were being caused by an attack that changed the DNS servers configured on their home D-Link or Linksys routers to use DNS servers operated by the attackers. Top articles1/5READ MOREWindows Defender Fix For Windows 10: Enable Network Scanning
As most computers use the IP address and DNS information provided by their router, the malicious DNS servers were redirecting victims to malicious content under the attacker’s control.
Hijack Windows NCSI active probes
At this time, it is not known how the attackers are gaining access to the routers to change their DNS configuration, but some users state that they had remote access to the router enabled with a weak admin password.
Once the attackers gained access to the router, they would change the configured DNS servers to 18.104.22.168 and 22.214.171.124, which would also be configured on most computers that connect to the router.
When a computer connects to a network, Microsoft utilizes a feature called ‘Network Connectivity Status Indicator (NCSI)‘ that is used to periodically run probes that check whether a computer is actively connected to the Internet.
In Windows 10, one of these active probes will be to connect to the http://www.msftconnecttest.com/connecttest.txt site and check if the returned content contains the string ‘Microsoft Connect Test’.
If it does, then the computer is connected to the Internet and if it isn’t, Windows warns that the Internet is not accessible.
For victims of this attack, when Windows performs this NCSI active probe, instead of being connected to the legitimate 126.96.36.199 Microsoft IP address, the malicious DNS servers send you to a web site located at 188.8.131.52.
As this IP address is under the attacker’s control, instead of sending back a simple text file, they display a page prompting the victim to download and install a fake ‘Emergency – COVID-19 Informator’ or ‘COVID-19 Inform App’ from the WHO as shown below.
If a user downloads and installs the application, instead of receiving a COVID-19 information application they will have the Vidar information-stealing Trojan installed on their computer.
When launched, this malware will attempt to steal the following information from the victim’s computer:
- browser cookies
- browser history
- browser payment information
- saved login credentials
- cryptocurrency wallets
- text files
- browser form autofill information
- Authy 2FA authenticator databases
- a screenshot of your desktop at the time of infection, and more.
This information will then be uploaded to a remote server so that it can be collected by the attackers and used to perform further attacks on your online accounts.
This could be to steal money from bank accounts, perform identity theft, or further spear phishing attacks.
What you should do if affected by this attack
If your browser is randomly opening to a page promoting a COVID-19 information app, then you need to login to your router and make sure you configure it to automatically receive its DNS servers from your ISP.
As every router has a different way of configuring DNS servers, it is not possible to give a specific method on how to do this.
In general, you will want to follow these steps:
- Login to your router
- Find the DNS settings and make sure there are no servers, especially 184.108.40.206 and 220.127.116.11, manually configured. If they are, set the DNS servers setting to ‘Automatic’ or ISP assigned.
- Then save your configuration.
You should now be able to reboot your mobile devices, game consoles, and computers so that they use the correct DNS settings from your ISP.
As people are reporting that they think their settings were changed because of a weak password and that remote administration was enabled, it is important to change your password to something stronger and to disable remote administration on the router.
Finally, if you downloaded and installed the COVID-19 app, you should immediately perform a scan on your computer for malware.
Once clean, you should change all of the passwords for sites whose credentials are saved in your browser and you should change the passwords for any site that you visited since being infected.
When resetting your passwords, be sure to use a unique password at every site.
Lawrence Abrams is the creator and owner of BleepingComputer.com. Lawrence’s area of expertise includes malware removal and computer forensics. Lawrence Abrams is a co-author of the Winternals Defragmentation, Recovery, and Administration Field Guide and the technical editor for Rootkits for Dummies.