Another year, another wave of home router hacks

CERT.PL reports an active criminal campaign that compromises home routers by brute-forcing administrative interfaces and changing DHCP DNS settings to attacker-controlled servers. The malicious DNS redirects users of Internet banking to an attacker proxy that downgrades HTTPS to HTTP to intercept credentials, while attacker traffic to banks is routed through other hacked routers to appear as normal consumer traffic; observed malicious DNS servers include 188.132.242.156 and 94.242.202.187. Recommended mitigation: disable WAN access to the router’s admin web panel and report occurrences.