Skip to main content

New JavaScript attack infects your phone and changes your router's DNS settings

javascript malware mobile theater smartphone
Loganban/123RF
Security firm Trend Micro has discovered an attack on home routers that involves malicious JavaScript, a mobile website, and a mobile device such as a smartphone. This attack has been taking place since December 2015, and so far focuses on Taiwan, Japan, and China. However, the United States is fourth on the attack list, so be prepared.

According to the report, a compromised mobile website can contain JavaScript that downloads another JavaScript with DNS changing routines to the visiting mobile device. Although this JavaScript can also be downloaded on a computer, the infection depends on the user’s medium — for example, JS_JITONDNS only infects mobile devices and triggers the DNS changing routine, while the JITON infection is triggered only if the user has a ZTE modem.

An examination of the code reveals that hackers are targeting routers sold by well known manufacturers such as D-Link, TP-LINK, and ZTE. The report points out that TP-LINK currently owns 28 percent of the router market while D-Link is in the top 10 with a seven percent market share. Given D-Link is based out of Taiwan and TP-LINK is in China, Trend Micro isn’t surprised by the high number of attacks in those regions.

“Cybercriminals behind this incident employ [an] evasive mechanism to go off the radar and continue the attack without arousing any suspicion from affected users. Such tactics include regularly updating the JavaScript codes to fix errors and constantly changing targeted home routers,” the report states. “The compromised websites are difficult to pinpoint due to the lack of any suspicious behavior.”

The DNS settings of a router can be overwritten thanks to the JavaScript code containing more than 1,400 login combinations, including a list of common passwords. There is also code in the JavaScript that can overwrite DNS settings by exploiting a specific vulnerability that currently exists in ZTE-based routers. Ultimately, hackers can remotely send any arbitrary command with administrator privileges to the router when it has been compromised.

However, Trend Micro specifically points out that the DNS changes can only be made if the victim accesses a compromised website on their mobile device. To prevent hackers from gaining control of their routers, all consumers need to do is to keep their home networking router’s firmware up to date, and to avoid using the default ID and password provided with the device when it shipped (like “admin” and ‘password”).

“Often times, people overlook the importance of keeping the firmware updated,” the report adds. “Administrative devices especially in the age of IoT are vulnerable to attacks that may pose risks to both user privacy and security. It is best to know how these smart devices operate and what kind of personal identifiable information these devices may collect.”

The list of countries affected by this mobile attack also includes France, Canada, Australia, Korea, Hong Kong, and the Netherlands, as Trend Micro reveals in a chart.

Attacks on home routers aren’t anything new although this version seems to be surfing the mobile trend in an emerging Internet-of-Things (IoT) world. Hackers can do all sorts of things with compromised routers including establishing a botnet, and programming specific DNS settings that send clueless victims to malicious websites. Unfortunately, most smartphones and tablets aren’t protected like desktops, so this new mobile JavaScript-based hack is certainly alarming to say the least.

Kevin Parrish
Former Digital Trends Contributor
Kevin started taking PCs apart in the 90s when Quake was on the way and his PC lacked the required components. Since then…
How to deactivate your Instagram account (or delete it)
A person holding a phone with the Instagram app open on it.

Oh, social media. Sometimes it’s just too much, folks. If you’re finding yourself in a position where shutting down your Instagram account for a period of time sounds good, Meta’s powers that be have made it pretty simple to deactivate your Instagram account. It’s also quite easy to completely delete your Instagram, although we wouldn’t recommend this latter option if you plan on returning to the platform at a later date.

Read more
How to clear cookies
A person uses a tablet with an HP laser printer in an office.

Cookies are a convenient way to experience the parts of the internet you frequently visit. One can think of these non-edible artifacts as digital breadcrumbs for info you may not want to remember every time. But when your computer is tasked with remembering too many of these trail-markers, it can really slow down your machine. Regardless of the browser you’re using, it’s a good idea to clear your cookies every once in a while.

Read more
Best Buy Memorial Day sale: early TV, laptop, and appliance deals
Digital Trends Best Buy Prime Day Deals Alt

While Memorial Day is still several days away, there are a lot of excellent early Memorial Day deals you can pick up right now from Best Buy. That includes everything from the best TVs, the best Phones, the best Air Fryers, and even the best smart home devices out there, so you have a huge variety of deals to pick from. Of course, there is an overwhelming number of options out there, which is why we've scoured Best Buy for our favorite deals in various categories and collected them all below, so be sure to check out everything in detail.

Best Best Buy Memorial Day TV Deals

Read more