{"id":67709,"date":"2017-01-05T14:38:38","date_gmt":"2017-01-05T22:38:38","guid":{"rendered":"https:\/\/securingtomorrow.mcafee.com\/?p=67709"},"modified":"2025-08-06T06:47:00","modified_gmt":"2025-08-06T13:47:00","slug":"switcher-malware-2017","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/mobile-security\/switcher-malware-2017\/","title":{"rendered":"How \u2018Switcher\u2019 Malware Moves an Attack from Your Phone to Your Router"},"content":{"rendered":"

Why attack one device when you can get inside an entire network and manipulate every device connected to it? That\u2019s \u2018Switcher\u2019 malware\u2019s motto \u2013 the newest Android Trojan threat. It uses unsuspecting Android devices as tools to redirect all traffic from Wi-Fi connected devices<\/a> on a given network to one owned by a cybercriminal, putting those gadgets directly into the hands of attackers.<\/p>\n

The malware variant begins its attack by first infecting an unsuspecting phone by masking itself as a mobile app. Two masks have been seen in use so far: one in which the malware disguises itself as an app for Baidu (the search engine), and another where it appears within an app that locates and shares Wi-Fi information. \u00a0Once in, it then performs brute-force attacks on the router it\u2019s connected to in an attempt to crack its password. If it gets inside successfully, the malware changes the addresses of the DNS server<\/a> (an Internet service that translates\u00a0domain names\u00a0into IP addresses) in the router\u2019s settings. This then reroutes all DNS activity from devices in the attacked Wi-Fi network to the servers of the cybercriminals — such an attack is also known as DNS hijacking.<\/a><\/p>\n

If a cybercriminal can hijack a DNS server, all devices connected to it (think the mobile phone and laptop connected to your home Wi-Fi network) will unknowingly interact with the malicious server, making them openly susceptible to attack. Meaning, any device connecting to that network at any time could be compromised, leaving mounds of personal data vulnerable.<\/p>\n

The good news? Only 1,280 Wi-Fi networks have fallen victim to the attack. The bad news however, is that even if the attack is detected, it can be difficult to remove the infection, thanks to backup servers cybercriminals may have in place.<\/p>\n

So how exactly is this attack possible? Two words: default credentials. The \u2018Switcher\u2019 Trojan is said to succeed in its initial infiltration by using a long, predefined list of password and login combinations\u2014a task which is made far too easy if the router still uses easily hackable, default credentials.<\/p>\n

Tips to Fight DNS Attacks<\/h2>\n

So, what can you do to stay protected against router-based attacks like these? First off, it\u2019s crucial to change default router passwords so your network\u2014and all devices connected to it\u2014aren\u2019t susceptible to a breach. Remember: if hackers can get into a router, it\u2019s like giving them the keys to your entire, connected kingdom of devices. Here are a few more tips for fighting a DNS hijacking attack, to keep in your back pocket:<\/p>\n