On Friday (5 April), it emerged that home routers such as those manufactured by D-Link were being targeted by DNS hijacking. Security researchers at Bad Packets identified three waves which took place between December last year and the end of March this year, detailed in a blog. But also on 5 April, researchers at Ixia identified a new wave of DNS hijacking and detected two additional rogue DNS servers: 195.128.124.150 and 195.128.124.181.
What is happening?
Hackers are orchestrating these attacks in the hope that users will be fooled by an unauthorized version of a well-known website. Once a person enters their details, they can subsequently be stolen by attackers. “The purpose of these attacks is to modify DNS settings in the routers to point to unauthorized webpages that skim user input data,” says Mihai Vasilescu senior security research engineer in a blog. “When end users try to access a targeted website, they will land on a webpage designed to look like the original but is controlled by the attacker.”
As Vasilescu points out, a malicious adversary able to intercept your requests could send faked DNS responses pointing you to a malicious server hosting a fake bank login page. “That server would then grab your credentials, giving the attacker access to your bank accounts.”
Which sites are being targeted?
According to Ixia researchers, the attackers seem to have three types of targets. Global internet-based enterprises, local hosting providers and financial intuitions based in Brazil.
To read the original article:https://www.forbes.com/sites/kateoflahertyuk/2019/04/07/gmail-netflix-and-paypal-users-targeted-in-dns-hijacking-campaign/#3c34b7413d3c