Hackers Hijack Routers’ DNS to Spread Malicious COVID-19 Apps

[dave14305]

Another reason not to enable WAN access to your router’s management interface...

https://www.bleepingcomputer.com/ne...outers-dns-to-spread-malicious-covid-19-apps/

 

[RMerlin]

For victims of this attack, when Windows performs this NCSI active probe, instead of being connected to the legitimate 13.107.4.52 Microsoft IP address, the malicious DNS servers send you to a web site located at 176.113.81.159.

Can someone tell me why DNSSEC isn't more commonly implemented yet, especially on such critical domain names?

 

[thiggins]

Ars article about Linksys routers compromised if WAN admin is enabled.
https://arstechnica.com/information...nds-users-to-spoofed-sites-that-push-malware/

The Bitdefender blog post that originated both warnings.
https://labs.bitdefender.com/2020/0...-attacks-abuse-bitbucket-to-host-infostealer/