0

I want to verify that router was not affected by DNS changer virus. Router provided by local Internet provider, runs custom firmware with web admin which does not contain DNS settings, no telnet/ssh/upnp. Is it possible to verify that it does not configured to use malicious DNS servers? Is it possible to do that just by performing some analysis with DNS queries from inside local network?

2

DNSChanger works be forcing you to use a DNS server managed by a malicious party, which thus can reply to your DNS queries with the wrong answers containing IP addresses in the control of the attacker. This way your systems connects to a different (and attacker controlled) system than you've intended and allows the attacker to hijack and man-in-the-middle your traffic.

To find out if your router is infected you thus need to find out what DNS server the router is using and compare it to your expectations. If you don't have access to the routers configuration you can use the help of some external service, which lets you visit a unique domain in control of the service and then shows you from where the DNS query for this domain came. If your router is not infected by DNSChanger then the source of the DNS query should be likely the DNS server of your ISP.

An external site which provides such service is Router Checker service offered by F-Secure. It shows you from where the DNS request came and if the DNS server in questions looks suspicious.

Note that this shows you the DNS server used by your browser. While this is the the DNS server provided by your router in most cases it does not need to be. For example your browser might be using DNS over HTTPS and thus is ignoring the setting provided by your router. Or you might have configured your system to use a different DNS server then the one provided by the router. This might have been done by manually, by using some privacy enhancing software or also by malware. In these cases this method will not show you if your router is infected since it does not use the DNS server offered by the router. But it shows you at least if connections done by your browser would have been hijacked, no matter if done by your router or somewhere else.

  • As far as I understood check strategy of Router Checker it will only detect problem if malicious DNS server is really used to resolve DNS request. What if malicious DNS server just not responding and router by timeout switches to secondary DNS server? Will it detect that request came from secondary DNS server? And what is the common scenario of such an attach - malicious DNS server resolves or requests or only for those it wants to hijack? – tegoo Jun 13 '18 at 7:27
  • @tegoo: if DNSChanger has configured multiple DNS servers and the first one will not reply it will probably use the next. But in this case you should see some delay when accessing a host first since it needs to switch to the second DNS server after a timeout. The usual case is that the malicious DNS server answers everything. – Steffen Ullrich Jun 13 '18 at 12:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.