GhostDNSbusters
Tracking and Responding to a Large Scale
DNS Hijacking Campaign
Josh Hopkins
Manabu NisekiWho are we?
● Josh Hopkins○

Threat Researcher, Team Cymru● Manabu Niseki - @ninoseki○

CSIRT Engineer & Analyst

Introducing GhostDNSIntroducing GhostDNSPoints to Cover●

What is G[h]ostDNS?

●

Targets / victims●

Attribution (or not)●Why is this relevant?

●Presentation goals

Introducing GhostDNSWhat is GhostDNS?
●DNS hijacking toolkit●

Sold on the darkweb (circa $450)●

Incorporates various open source elements○ For example - https://github.com/robertdavidgraham/masscan●

Vulnerable SOHO routers compromised - 100,000+

Introducing GhostDNSTargets / victims●Residential Internet users○ Default router passwords, outdated firmware●

Focused on South American users○ Mainly Brazilian, some Argentinian●

Credential harvesting○ Banking, e-commerce, email, Netflix●

Credentials sold at scale (darkweb)

Introducing GhostDNSAttribution (or not)●Flavour of targets / victims - Brazil●

Portuguese language within artefacts●Our work continues ;)Introducing GhostDNS
Why is this relevant?
●This threat is neither new nor sophisticated○ Still hugely successful●

The way we work is changing○ SOHO routers = very attractive targets●

Are we prepared for new and/or sophisticated threats?

Introducing GhostDNS
Presentation goals●

Explain how we hunt for GhostDNS○ Various techniques●

Describe how we map out infrastructure●

Outline how victims are phished●

Discuss how we engaged with a national CERT
○ Both good and bad examples

How to hunt the infrastructure

How to hunt the infrastructure
Hunting methodologies●

Passive approach○ Use search engines●

Active approach○ Use scanners

How to hunt the infrastructure
Passive approach: Use search engines●●Sometimes a DNS changer is located in an open directory
Open directories can be found by using search engines○e.g. "Index of /" AND "Name" AND "Last modified" AND "Size" AND"Description"

How to hunt the infrastructure
Passive approach: Use search engines●

Combine a basic query for open directory & unique GhostDNS
file/directory names

How to hunt the infrastructure
Passive approach: Use search engines
●
●
●
●
●
●
●
●
●
●
●
●
●
●

104.214.88.65
104.214.95.26
107.155.132.167
107.155.132.186
107.155.152.19
132.148.148.78
137.135.82.150
162.216.152.58
18.188.60.191
198.50.212.232
20.37.240.180
200.98.134.184
23.98.158.59
3.134.79.167

●
●
●
●
●
●
●
●
●
●
●
●
●
●

3.86.24.220
34.230.16.95
34.73.48.65
34.83.129.246
35.199.98.107
35.200.186.172
35.204.103.135
35.207.28.174
35.231.52.239
35.243.195.131
63.33.48.220
68.183.24.48
70.37.165.226
93.188.161.184

●
●
●
●
●
●

Azure
AWS
GCP
OVH
Hostingeretc.

How to hunt the infrastructure
Passive approach: Use search engines●●Phishing websites can be found via X509 hash / serial number lookup
Censys:○●8b447d14b3a9ae83cbc84d2ec575873cbf75ddcd2dc41a7697a39d22ee0b35c1

Shodan:○ssl.cert.serial:14436824970603823171

How to hunt the infrastructure
Active approach: Use scanners● Find phishing website(s) from a rogue DNS server:○○

https://github.com/ninoseki/rogue_one■ A tool to detect a rogue DNS server■ It also extract landing pages from a rogue DNS server
https://github.com/projectdiscovery/dnsx■ A fast and multi-purpose DNS toolkit allow to run multiple DNS queriesof your choice with a list of user-supplied resolvers.

How to hunt the infrastructure

How to hunt the infrastructure

How to hunt the infrastructure
Active approach: Use scanners● Find phishing page(s) in a specific IP range:○

https://github.com/projectdiscovery/httpx■ httpx is a fast and multi-purpose HTTP toolkit allow to run multipleprobers○

https://github.com/ninoseki/rangescan■A CLI tool to scan websites on a specific IP range

How to hunt the infrastructure
Active approach: Use scanners● Note that you should manipulate the host header○○$ curl 70.37.165.155■ Returns an empty response$ curl -H "Host: caixa.gov.br" 70.37.165.155■ Returns a phishing HTMLHow to hunt the infrastructure
Active approach: Use scanners● Thus you should set a specific host to hunt○Traffic analysis techniquesTraffic analysis techniques
Starting Point - Collaboration :)●Analysis of recovered artefacts○ Focused on ‘DNS changer’ element●Exploits for numerous router types identified○ DSLROUTER.py●Query for ‘/dnscfg.cgi?dnsPrimary=’ (and others…)

Traffic analysis techniques
DNS Changer●Three Modules:○ Shell - password brute force○ JavaScript - web inject >> brute force○ PHP / Python - brute force / dnscfg.cgi exploit●dnscfg.cgi exploit appeared most prominently○ Bypasses the need for brute force○ Credential list is limited to defaults e.g. admin:admin○ Identifiable in URI strings

Traffic analysis techniques
Changer Infrastructure - Query for ‘/dnscfg.cgi…’●Connections to potential victims - updating DNS settings●‘Primary’ - rogue DNS server●‘Secondary’ - legitimate DNS server (Google or Cloudflare)●

Persistence - victim unaware

Traffic analysis techniques
Pivoting on Victims●

Examine UDP/53 connections●

Identify candidate rogue servers - confirmation●

Example - two rogue servers hosted on OVH infrastructureTraffic analysis techniques
Repeatable Process●

Victim IPRogue
Server

Proactive hunting of indicators
Victim IP●

Victim IP addresses <> attacker infrastructure●50 changer IPs observed September - November 2020●

4 new rogue DNS servers identified in November 2020

●Thousands of victims

RogueServerVictim IP

Traffic analysis techniques
Passive DNS data
●Monitoring brands known to be targeted●Brazilian company >> foreign IP space●

Phishing pages!

How the phishing works

How the phishing works
A tale of two phishings●●

GhostDNS has 2 types of phishing websites
Type-A:○○○●

Target brands: Brazilian banks, PayPal, Netflix, Hotmail/Outlook, etc.
Navigated by: a malicious DNS server (it works like a webinject)
Injects: N/A

Type-B:○○○

Target brands: Brazilian banks
Navigated by: an email(?)
Injects: JS DNS changers

Type-ACDD

EDATOSDDSODA

banco.bradesco
bancobrasil.com.br

americanas.com.br
banco.bradesco

americanas.com.br
banco.bradesco

americanas.com.br
banco.bradesco

banco.bradesco
bradescocelular.com.br

bb.com.brbb.com.brbancobrasil.com.br

bb.com.brbradesco.b.br

bradesco.com.br

bradesco.b.br

bb.com.brbradescocelular.com.br

bradesco.com.br

bradesconetempresa.b.
brbradescoprime.com.br

bradescocelular.com.br

bradesco.b.br

bradescopj.com.br

caixa.gov.br

bradescopj.com.br

bradesco.com.br

bradescoprime.com.br

caixa.gov.br

cef.com.br

bradescoprime.com.br

bradescopj.com.br

caixa.gov.br

itau.b.br

citibank.com

caixa.gov.br

bradescoprime.com.br

cef.com.br

itau.com.br

hotmail.com

cef.com.br

caixa.gov.br

itaupersonnalite.com.br

itau.com.br

citibank.com

cef.com.br

santander.com.br

itaupersonnalite.com.br

citibank.com.br

citibank.com

santandernet.com.br

live.com

itau.com.br

citibank.com.br

santandernetibe.com.br

msn.com

itaupersonnalite.com.br

itau.com.br

sicredi.com.br

netflix.com

netflix.com

itaupersonnalite.com.br

outlook.com

paypal.com

santander.com.br

paypal.com

santander.com.br

santandernet.com.br

...

...

...

Type-A
Return 192.95.59.135
for the following domains:●cef.com.br●
bradescocelular.com.br●
bradesco.b.br●
bradescopj.com.br●
bradesco.com.br●
bradescoprime.com.br●
caixa.gov.br●
banco.bradesco

Query a domain

149.56.152.185(ODA)
Return a legitimate addressfor other domains

Type-AType-B●

Phishing + JS DNS changer.

Type-B

Type-B

api.ini.php injects 542 iframes

Type-B

Type-B570+ payloads & 1,100+ requests

Liaising with CERTLiaising with CERT●

Apart from the technical point of views, coordination plays an importantrole to mitigate the threat●

You have to make “good” communication with a national CERT or LEA

Bad example●

Sharing information without:○ Any background context○ Any commitments●

It caused a no reaction from a national CERT●

Sharing is caring but the way of sharing matters

Good example●

Good existing relationship with the CERT●

Working to a shared objective and giving the CERT primacy●

Making the main motivation of your analysis non-commercial●PatienceQuestions?
Slack Channel:#1st_josh_hopkins-manabu_niseki

CYMRU.COM | 847-378-3300© 2020 TEAM CYMRU, INC. ALL RIGHTS RESERVED.