Malvertising Campaign Infects Your Router Instead of Your Browser

[LASER_oneXM]

...unfortunately i dont know no AV software that is able to scan my router....

...some quotes from the article above:

Malicious ads are serving exploit code to infect routers, instead of browsers, in order to insert ads in every site users are visiting.

The way this entire operation works is by crooks buying ads on legitimate websites. The attackers insert malicious JavaScript in these ads, which use a WebRTC request to a Mozilla STUN server to determine the user's local IP address.
Based on this local IP address, the malicious code can determine if the user is on a local network managed by a small home router, and continue the attack. If this check fails, the attackers just show a random legitimate ad and move on.

Attackers use compromised routers to replace ads in the user's normal traffic

Once the attack has gained control over the router, he can use it to replace legitimate ads with his own, or add advertisements on websites that didn't feature ads. While previous malvertising campaigns usually targeted users of Internet Explorer, this campaign focused on Chrome users, on both desktop and mobile devices. Ad replacement and insertion also takes place on traffic to mobile devices, not just desktops.

Researchers haven't yet managed to determine an exact list of affected router models, but some of the brands targeted by the attackers include Linksys, Netgear, D-Link, Comtrend, Pirelli, and Zyxel.

 

[Svoll]

O wow, just when i barely start to learn how to secure my PC, Malware Dev's come up with ideas to infect you. I hope DDWRT is safe from it and hoping AV software creates something to scan your router......

 

[tim one]

I've not well understood as this attack works but presumably it uses exploits like XSS router vulnerabilities: an application takes in charge the data received by the input and sends them to the web browser without validation or input without hard-coding it. Take advantage of flaws in XSS means to run malicious scripts through the browser by subtracting the data of the authentication by invoking also the download of malware.

 

[Azure]

@Svoll
ESET and I believe also Avast have home network scan feature