HITCON CMT 2019 - Roaming Mantis: An Anatomy Of A DNS Hijacking Campaign
Channel: HITCON
Date: 2020-07-23

In March 2018, thousands of home routers were potentially compromised by a criminal campaign called "Roaming Mantis" in Japan to overwrite DNS settings to use a rogue DNS. This criminal has strong financial motivation. Devices under the compromised router, such as Android, iOS, PC were targeted. They have been rapidly improving their malicious contents for each platform. In addition, the attacker implemented their malicious contents which support 27 languages for targeting around the world.

According to a report by CNA(中央通訊社), South Korea, Japan and Taiwan are the top three targeted countries.

他指出，「少爺」的來源為中國與北韓邊界，主要攻擊目標是南韓。目前全球有55個國家受害，遭「少爺」入侵的家用wifi分享器約20多萬台，韓國、日本與台灣為前三名，台灣約有500台；遭植入惡意APP的Android手機有6000多支，約百萬筆個資遭竊，其中韓國就占了5000多支，台灣排名第6，有將近100支手機受害。(source: https://www.cna.com.tw/news/afe/201806070059.aspx)

Based on our research, we would like to disclose the details of this campaign such as the mind of the criminals, the details of malicious contents and how they compromised routers to share with researchers and CERTs. In addition, we discovered several new activities during Feb and Apr 2019 as follows:

400+ routes were compromised in April 2019;
Malicious DNS changer for overwriting routers’ setting;
65,000+ detections of DNS changer were observed during Feb and May 2019;
Stealing iOS device info using .mobileconfig;
42,000+ detections of MoqHao were monitored during Feb and May 2019;
Technical updates and bugfix (or wrong design) in MoqHao and its uses web services such as instagram, twitter, googledocs, youtube, vk and so on.
These criminals still very active. Their tools and malware have been improving as well. We strongly believe other new findings will be added above list by our presentation.

This Android malware (MoqHao) uses loader module to run a decrypted payload (core module) as anti analysis and anti security products like packer. We will show our demonstration about how to analysis for extracting encrypted payload from the package using a flesh sample if it is possible. This will help the researchers who are wishing to track Roaming Mantis campaign can use this information to help reversing.

As our conclusion, we will provide the procedures how to protect your devices from this kind of cyber threats.