Malware News Malware Finds New Trick to Hide Rogue DNS Settings on Windows

[Jack]

Content source

http://news.softpedia.com/news/malware-finds-new-trick-to-hide-rogue-dns-settings-on-windows-504815.shtml

A Potentially Unwanted Application (PUA) named DNS Unlocker has found a new way to hide rogue DNS settings inside Windows installations that are invisible to the human eye at first glance.

Its method works on Windows XP, Vista, 7, 8, 8.1 and 10 (x86 and x64), and ESET reports seeing the first malware samples employing this technique in December 2015.

Named DNS Unlocker, this malware works by changing the user's DNS settings in order to inject its own set of ads inside Web pages where Google Analytics code is also loaded. The ads are easy to spot because they bear a watermark that reads "Ads by DNSUnlocker."

ESET reports seeing DNS Unlocker loads not only annoying ads here and there but sometimes tech support scams as well.

DNS Unlocker changes your DNS but you won't be able to spot it
What made this malware stand apart is how it manages to hijack DNS settings. Similar threats do this by manually setting custom DNS server IP addresses inside the user's network connection property section.

[Control Panel\Network and Internet\Network Connections -> right-click any connection -> choose "Properties" and then "Internet Protocol Version 4 (TCP/IPv4)"]

Regular DNS hijackers usually select the "Use the following DNS server addresses" in the window's interface and add their own DNS servers. A change here gets reflected in the computer's Windows Registry by two IP address with the following format:

IP,IP
DNS Unlocker is different because crooks make this change to the Windows Registry programatically by using another format with a "space" instead of a "comma" delimiter, like so:

IP IP
Windows is hotwired to read this list, search for a "comma" and append the values to theInternet Protocol Version 4 (TCP/IPv4) GUI window. Because it doesn't see the comma, the interface is left to its default value of "Obtain DNS server address automatically," even if in reality is running on custom DNS servers.

DNS Unlocker hides its rogue DNS servers from plain sight

Users can click the Advanced button and click on the DNS tab to see that even if the GUI says it will obtain the DNS IP addresses from a DHCP server, it does use two hard-coded values.

The interface shows two IPs on the same line, which should be impossible. Trying to add any two IPs at the same time yields an error.

Read more: Malware Finds New Trick to Hide Rogue DNS Settings on Windows