Android Trojan “Switcher” Hacks Routers and Hijacks Traffic

Researchers at Kaspersky Lab have come across a new Android Trojan that hacks routers and changes their DNS settings in an effort to redirect traffic to malicious websites.

Dubbed “Switcher,” the malware has been disguised as an Android client for the Chinese search engine Baidu, and a Chinese app for sharing Wi-Fi network details. Once users install one of these apps, the malware attempts to guess the username and password of the Wi-Fi router the infected Android device is connected to.

Switcher includes a list of more than two dozen username and password combinations that could allow it to access the router’s web administration interface, such as admin:admin, admin:123456, or admin:00000000.

“With the help of JavaScript it tries to login using different combinations of logins and passwords. Judging by the hardcoded names of input fields and the structures of the HTML documents that the trojan tries to access, the JavaScript code used will work only on web interfaces of TP-LINK Wi-Fi routers,” Nikita Buchka, mobile security expert at Kaspersky Lab, said in a blog post.

If the web administration interface can be accessed, the Trojan replaces the device’s primary and secondary DNS servers with IP addresses pointing to rogue DNS servers. These addresses are 101.200.147.153, 112.33.13.11 and 120.76.249.59 – one is the default option, while the other two are set for specific ISPs.

“The code that performs these actions is a complete mess, because it was designed to work on a wide range of routers and works in asynchronous mode,” Buchka noted.

With the router’s DNS settings pointing to a machine controlled by the attackers, traffic gets redirected to malicious websites instead of the legitimate site the victim is trying to access. According to Kaspersky, the cybercriminals claim to have compromised nearly 1,300 websites, mainly in China.

“The Switcher Trojan targets the entire network, exposing all its users, whether individuals or businesses, to a wide range of attacks – from phishing to secondary infection,” said Buchka. “A successful attack can be hard to detect and even harder to shift: the new settings can survive a router reboot, and even if the rogue DNS is disabled, the secondary DNS server is on hand to carry on.”