Android Malware Attacks Routers on Any WiFi network

Forum Moderators: bakedjake

Message Too Old, No Replies

Android Malware Attacks Routers on Any WiFi network

Switcher malware WiFi App

engine

3:33 pm on Jan 5, 2017 (gmt 0)

In the never-ending stream of malware development, there's a new one for Android that once on an infected device uses any WiFi network it's on to attack the router and change the DNS to a rogue DNS server. Apparently, it's not actually affecting the Android device. Users are fooled into downloading the apps thinking that its a Baidu app, and a WiFi network sharing app.

Of course, users of the apps would do better by avoiding downloads from places other than official app stores.

This server fools the devices into communicating with websites controlled by the attackers, leaving users wide open to either phishing or further malware-based attacks.

The attackers claim to have successfully infiltrated 1,280 wireless networks so far, mainly in China. Android Malware Attacks Routers on Any WiFi network [theregister.co.uk]

keyplyr

8:45 pm on Jan 5, 2017 (gmt 0)

Of course, users of the apps would do better by avoiding downloads from places other than official app stores.

That's it. There's a setting that defaults to only letting the device user download/install apps from the Google Play Store. These apps have been scrutinized & their developers vetted to be safe.

engine

9:23 am on Jan 6, 2017 (gmt 0)

These apps have been scrutinized & their developers vetted to be safe

I would use the words, much safer, but not 100%. There have been instances of unscrupulous developers, but they tend not to get away with it for long. Out in the wild-west of the Internet you take your chances.

I often see ads for apps outside of the store, but i'd never install an app direct from the Net. Not only could it be developers with a mission, but it could have been hacked.

The culture of downloading any app from anywhere ought to be moved towards a safer, more secure way of thinking.

keyplyr

9:29 am on Jan 6, 2017 (gmt 0)

I know of only 2 instances where a Google Play Store app was compromised.

One was also available at download locations other than Google & the other app had changed ownership as I remember.

RE: routers.
In a conversation with my cable guy, he shared an interesting fact that almost everyone is ignorant.

We always protect our computers with AV and passwords, but very few of us use any defense on our WiFi routers.

We think that because we password the WiFi LAN that's enough protection, but it doesn't protect the router itsrlf. These remain vulnerable and are often compromised into botnets without anyone taking notice.

engine

9:41 am on Jan 6, 2017 (gmt 0)

We think that because we password the WiFi LAN that's enough protection, but it doesn't protect the router itsrlf.

I'd be interested to find out more. The fact that I hide my broadcast name can help, but a decent sniffer will find it. Perhaps, let's have another thread on securing WiFi.