This document discusses DNSchanger malware incidents from 2007 to 2014. It provides the following key details: - DNSchanger 2007 infected over 4 million computers from 2007-2011, generating $1.4 billion in profits through online ads, spam and scams. In March 2012 the servers were taken down. - DNSchanger 2014 infected over 300,000 home routers by changing their DNS settings to proxy traffic and install malware. This potentially exposed over 1.5 million computers to improper ads, pornography and malware. - The malware exploited vulnerabilities in home router administration interfaces, typically accessed through a web browser. It could change DNS settings remotely to direct traffic without the owner's knowledge. Updating router firmware, using a trusted

1. DNSchanger 2014
Alfons Tanujaya

2. DNSchanger 2007
• Aktif 2007 - 2011Infeksi lebih dari 4 juta komputer
PC dan MacOnline adv, spam, scamKeuntungan 140
milyar8 Maret 2012, server bring down, kiamat
kecil internet ?

3. DNSchanger 1

5. DNSChanger 2014

6. What is this ?
• Antivirus merek apapun tidak bisa mengatasi
malware ini.Tidak hanya berdampak pada Windows
tetapi pada Linux, Mac dan Android
phone.Sekalipun komputer di format, akan
kembali lagi terjadi.Sea-surf =
CSRF

8. CSRF Cross Site Request Forgery
A type of malicious exploit of a website whereby
unauthorized commands are transmitted from a user
that the website trusts. Unlike cross-site scripting
(XSS), which exploits the trust a user has for a
particular site, CSRF exploits the trust that a site has
in a user's browser.Attack is blind. Not good for
credential stealing.But ordinary weapon in a smart
criminal can be deadly.

9. get
Login
form
Session Cookie
UN
PS
Post Cookie
get
Auto submit form
Post Cookie

10. DNSChanger 2014
Changing DNS of vulnerable routers.Log all traffic →
proxy, credential leak.Lead to install malware.Lead
to forgery website, can lead to leak of
credential.Improper advertisement, porn, malware
etc.How many victims ? 300.000 routers x 5 users =
1,5 million computers.

11. How it happen
http://192.168.1.1/userRpm/LanDhcpServerRpm.htm
?dhcpserver=1&ip1=192.168.1.100&ip2=192.168.1.199
&Lease=120&gateway=0.0.0.0&domain=&dnsserver=1
62.248.99.162&dnsserver2=199.85.127.10&Save=%B1%
A3+%B4%E6

12. List of vulnerable routers
TP LinkD-LinkMicronetTenda

13. Solution
Sea SurfSEA MONKEY

14. SOLUSI
Upgrade firmware ← Tidak selalu sukses→ OpenWRT
(WiT ?)Solusi, set dns di client dgn DNS isp / google,
local DNS overpower router, kecuali dipaksa routerT-
FA Challenge tokenTidak gunakan web based
administrationGunakan httpsGunakan browser
berbeda khusus untuk administrasi router
berbeda dengan browsing

15. Resource
http://cxsecurity.com/issue/WLB-2012100027