Full Report
Criminals are hacking into public Wi-Fi devices—at hotels, conference centers, and so on—around the world and changing their DNS settings. The goal is to redirect users to fake login pages and steal their credentials.
Analysis Summary
# Tool/Technique: DNS Hijacking (Public Wi-Fi Infrastructure)
## Overview
This technique involves the unauthorized access and reconfiguration of networking hardware (such as routers and access points) in public venues. Attackers modify the device's DNS settings to point to attacker-controlled DNS servers. When users connect to the Wi-Fi and attempt to visit legitimate websites, they are redirected to fraudulent clones designed to harvest sensitive credentials.
## Technical Details
- **Type:** Technique / Infrastructure Manipulation
- **Platform:** Network Hardware (Routers, Gateways); affects Windows, macOS, iOS, Android, and Linux clients.
- **Capabilities:** Traffic redirection, credential harvesting, Man-in-the-Middle (MitM) facilitation.
- **First Seen:** DNS hijacking is a long-standing technique; however, large-scale campaigns targeting hospitality Wi-Fi have seen significant resurgences in recent years.
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- **T1133 - External Remote Services:** Exploiting vulnerabilities or weak credentials in router management interfaces.
- **TA0006 - Credential Access**
- **T1557 - Adversary-in-the-Middle:** Redirecting traffic to capture authentication data.
- **T1557.002 - ARP Poisoning:** (Related) Though DNS hijacking is the primary method here, it achieves similar redirection results.
- **TA0007 - Discovery**
- **T1046 - Network Service Discovery:** Finding vulnerable router interfaces.
## Functionality
### Core Capabilities
- **Unauthorized Configuration Change:** Modifies the primary and secondary DNS server entries on the router.
- **Traffic Redirection:** Resolves legitimate domains (e.g., `microsoft365[.]com`) to malicious IP addresses.
- **Credential Harvesting:** Hosts "look-alike" login pages to capture usernames, passwords, and MFA tokens.
### Advanced Features
- **Targeted Redirection:** Only redirecting high-value domains (banking, enterprise mail) while letting other traffic pass through normally to avoid detection.
- **SSL Stripping/Proxying:** Attempting to downgrade HTTPS connections or using stolen/fraudulent certificates to bypass browser warnings.
## Indicators of Compromise
- **File Hashes:** N/A (Infrastructure-based attack).
- **Network Indicators:**
- `8[.]219[.]158[.]114` (Example of a defanged malicious DNS server IP)
- `64[.]225[.]48[.]31` (Example of a defanged phishing host)
- **Behavioral Indicators:**
- Router administrative logs showing logins from unexpected geographical locations.
- Mismatched SSL certificates when visiting common sites.
- Unusual latency in DNS resolution.
## Associated Threat Actors
- **Roaming Tiger** (Historically associated with hospitality targeting).
- **DarkHotel** (Known for targeting high-profile guests at luxury hotels).
- various financially motivated cybercriminal groups.
## Detection Methods
- **Signature-based detection:** Monitoring for known malicious DNS IP addresses in network traffic.
- **Behavioral detection:** Identifying "impossible travel" in router administrative logins or detecting unexpected DNS setting changes via SNMP monitoring.
- **Canary Queries:** Periodically resolving a known domain from within the network and verifying the resulting IP against a trusted source.
## Mitigation Strategies
- **Infrastructure Hardening:** Disable remote management interfaces on public Wi-Fi routers or restrict access to specific management IPs/VPNs.
- **Strong Authentication:** Use complex passwords and MFA for all network infrastructure administrative accounts.
- **Client-Side Protection:** Encourage the use of "DNS over HTTPS" (DoH) or "DNS over TLS" (DoT) on end-user devices to bypass local network DNS settings.
- **VPN Usage:** Use a trusted VPN to encrypt all traffic, rendering DNS hijacking ineffective for redirection.
## Related Tools/Techniques
- **DNS Spoofing / Cache Poisoning:** Localized methods of achieving the same redirection.
- **Evil Twin AP:** Setting up a fake access point rather than hacking the existing one.
- **RouterSploit:** A framework often used by actors to find and exploit vulnerabilities in embedded network devices.