Home / Blogs

Dynamic DNS Customers, Check Your Router Settings!

There have been quite a few news stories released over the last 24 hours regarding a wide-scale compromise of 300,00 Internet gateway devices. Here's the executive summary of what happened, how to check if you are vulnerable, and what you can do to fix it.

What's The Big Deal?

Security researchers Team Cymru have discovered a set of compromised servers which suggest at least 300,000 home routers, firewalls, and Internet connection devices have been compromised by attackers. Note that this problem could actually be much larger, as it appears this was only a single set of malicious actors. There could be other nefarious groups that are using the same techniques, but were not detected during Team Cymru's study.

What's Effected?

Team Cymru has identified hardware from the following vendors as being compromised:

  • D-Link
  • Micronet
  • Tenda
  • TP-Link
  • Other unnamed vendors

If you use any of these devices, you should check it to ensure your device has not been compromised.

How Did The Attackers Break In?

It appears the attackers have been using a combination of known exploits and configuration issues. This is helpful as it means that if you install all security patches and properly configure your device, you will most likely be safe from attack.

How Do I Check My Device?

Once a device is compromised, the attackers change the DNS settings on the device so that all requests for Internet hosts run through servers they control. This permits them to hijack sessions as their whim. So the key here is to identify if your DNS settings have been changed.

The best way is to log on to your device via the administrative interface and check the DNS settings. How to do this and where the settings are located will vary from device to device. The malicious actors in this attack were redirecting all DNS to the IP addresses and So if you see these addresses, you have a problem.

However, what you really want to verify is whether your DNS settings have been changed at all, because a different set of malicious actors may be using different IP addresses. Most people set this value to whatever their Internet Service Provider (ISP) tells them to use. If you are unsure what this should be, contact your ISP's support group.

But I Don't Know How To Log On To My Router!

The router is the best place to check these settings and if you have a problem, you will ultimately need to gain access. Try doing a Google search on your device's make and model with a keyword such as "administrative access" or similar. That should produce some useful information.

However, when the DNS on your router gets changed, it will usually change the DNS info on your local systems as well. So you may be able to check one or more of your local systems to see if they are properly configured. For example on a Windows system, run the command:

ipconfig /all | more

Look through the output for the "DNS Servers" setting. If you have Linux or Mac based systems, open a command prompt and run the command:

cat /etc/resolv.conf

Again, check to see if the value is set to the proper IP addresses.

By Chris Brenton, Director of Security at Dyn

CircleID Newsletter The Weekly Wrap

More and more professionals are choosing to publish critical posts on CircleID from all corners of the Internet industry. If you find it hard to keep up daily, consider subscribing to our weekly digest. We will provide you a convenient summary report once a week sent directly to your inbox. It's a quick and easy read.

I make a point of reading CircleID. There is no getting around the utility of knowing what thoughtful people are thinking and saying about our industry.

Co-designer of the TCP/IP Protocols & the Architecture of the Internet


 Be the first to post a comment!

Add Your Comments

 To post your comments, please login or create an account.



New TLDs

Sponsored byAfilias


Sponsored byThreat Intelligence Platform


Sponsored byVerisign

DNS Security

Sponsored byAfilias


Sponsored byWhoisXML API

Domain Names

Sponsored byVerisign

Brand Protection

Sponsored byAppdetex