The security firm Proofpoint is writing about a new and “improved” version of DNSChanger, an exploit kit that attacks home routers in order to serve malicious advertisements to anyone connecting through the Internet using that router. From the Proofpoint analysis: Since the end of October, we have seen an improved version of the “DNSChanger EK” [1] used in ongoing malvertising campaigns. DNSChanger attacks internet routers via potential victims’ web browsers; the EK does not rely on browser or device vulnerabilities but rather vulnerabilities in the victims’ home or small office (SOHO) routers. Most often, DNSChanger works through the Chrome browser on Windows desktops and Android devices. However, once routers are compromised, all users connecting to the router, regardless of their operating system or browser, are vulnerable to attack and further malvertising.The router attacks appear to happen in waves that are likely associated with ongoing malvertising campaigns lasting several days. Attack […]
Tag: malware
NETGEAR Pushes Emergency Patch, Finds More Routers Vulnerable
In-brief: NETGEAR has issued an emergency software patch for a serious vulnerability in its home routers, even as the company expands the list of affected hardware, adding five more models to the list of affected products.
Update: Vulnerability Prompts Warning: Stop Using Netgear WiFi Routers
In-brief: A serious security hole in the software that runs certain models of wifi routers made by the firm Netgear prompted warnings to customers to stop using them until a fix can be found. (Editor’s Note: updated with comment from Netgear. PFR 12/12/2016)
Report: Millions (and Millions) of Devices Vulnerable in latest Mirai Attacks
In-brief: Attacks that took 900,000 broadband routers offline in Germany have hit other countries as well, as security experts warn that the number of devices vulnerable to attack could number in the millions.
Ransomware Used Against Muni Known As Harsh, Virulent
San Francisco’s Municipal Transportation Agency (MTA) was hit with a ransomware attack over the weekend, disrupting a number of agency computer systems including email, the MTA said in a statement on Sunday. And security experts say that the ransomware used has a reputation for virulence. Computer terminals observed at MTA (or “Muni”) stations displayed a message that read, in part, “You Hacked. All Data Encrypted” over the weekend, paralyzing toll collection operations and forcing the MTA to open its turnstiles and let the public ride for free. According to a report by The San Francisco Examiner claims that the ransomware thieves have infected more than 2,000 of the agency’s 8,000 computers, affecting not only fare collection, but also systems that assign routes to bus drivers. The thieves are demanding $73,000 in ransom, paid in bitcoin. In a statement on Sunday, San Francisco MTA said that the attack “disrupted some of our […]