DNS Unlocker finds a way to hide hijacked DNS servers from human operators via one “special” character. A Potentially Unwanted Application (PUA) named DNS Unlocker has found a new way to hide rogue DNS settings inside Windows installations that are invisible to the human eye at first glance.
Its method works on Windows XP, Vista, 7, 8, 8.1 and 10 (x86 and x64), and ESET reports seeing the first malware samples employing this technique in December 2015.
Named DNS Unlocker, this malware works by changing the user’s DNS settings in order to inject its own set of ads inside Web pages where Google Analytics code is also loaded. The ads are easy to spot because they bear a watermark that reads “Ads by DNSUnlocker.”
ESET reports seeing DNS Unlocker loads not only annoying ads here and there but sometimes tech support scams as well.
DNS Unlocker changes your DNS but you won’t be able to spot it
What made this malware stand apart is how it manages to hijack DNS settings. Similar threats do this by manually setting custom DNS server IP addresses inside the user’s network connection property section.
[Control Panel\Network and Internet\Network Connections -> right-click any connection -> choose “Properties” and then “Internet Protocol Version 4 (TCP/IPv4)”]
Regular DNS hijackers usually select the “Use the following DNS server addresses” in the window’s interface and add their own DNS servers. A change here gets reflected in the computer’s Windows Registry by two IP address with the following format:
IP,IP
DNS Unlocker is different because crooks make this change to the Windows Registry programatically by using another format with a “space” instead of a “comma” delimiter, like so:
IP IP
Windows is hotwired to read this list, search for a “comma” and append the values to the Internet Protocol Version 4 (TCP/IPv4) GUI window. Because it doesn’t see the comma, the interface is left to its default value of “Obtain DNS server address automatically,” even if in reality is running on custom DNS servers.
Users can click the Advanced button and click on the DNS tab to see that even if the GUI says it will obtain the DNS IP addresses from a DHCP server, it does use two hard-coded values.
The interface shows two IPs on the same line, which should be impossible. Trying to add any two IPs at the same time yields an error.
Tech support experts are taught to test for DNS hijackers by going to the Internet Protocol Version 4 (TCP/IPv4) GUI window to see for custom IPs, and even add their own trusted DNS servers.
The problem is that if a user configures a static value, these IP addresses are added to the Windows Registry after the DNS Unlocker IP addresses as such: IP IP,IP,IP – meaning the hijacked DNS servers will remain primary DNS server values.
Since this practice is the default debug trick for detecting DNS hijacking, DNS Unlocker’s trick thwarts any debugging attempts.
The only way to remove it is for the user to click the Advanced button, go to the DNS tab, and remove them by clicking the Remove button on each line.
ESET says that crooks could also use the semicolon character instead of the space delimiter to obtain the same results, as: IP;IP
This trick works the same, but ESET says it hasn’t seen it used in real-world attacks yet.
The company also said it informed the Microsoft Security Response Center (MSRC), who declined to consider this as a security problem and issue a hotfix right away, instead redirecting the issue to other teams to be fixed in future Windows versions.
Working as a cyber security solutions architect, Alisa focuses on application and network security. Before joining us she held a cyber security researcher positions within a variety of cyber security start-ups. She also experience in different industry domains like finance, healthcare and consumer products.
