14 DAY TRIAL // A Potentially Unwanted Application (PUA) named DNS Unlocker has found a new way to hide rogue DNS settings inside Windows installations that are invisible to the human eye at first glance.
Its method works on Windows XP, Vista, 7, 8, 8.1 and 10 (x86 and x64), and ESET reports having seen the first malware samples employing this technique in December 2015.
Named DNS Unlocker, this piece of malware works by changing the user's DNS settings in order to inject its own set of ads inside Web pages where Google Analytics code is also loaded. The ads are easy to spot because they bear a watermark that reads "Ads by DNSUnlocker."
ESET reports seeing DNS Unlocker loading not only annoying ads here and there but sometimes also tech support scams.
DNS Unlocker changes your DNS, but you won't be able to spot it
What made this malware stand apart is how it manages to hijack DNS settings. Similar threats do this by manually setting custom DNS server IP addresses inside the user's network connection property section.
[Control Panel\Network and Internet\Network Connections -> right-click any connection -> choose "Properties" and then "Internet Protocol Version 4 (TCP/IPv4)"]
Regular DNS hijackers usually select the "Use the following DNS server addresses" in the window's interface and add their own DNS servers. A change here gets reflected in the computer's Windows Registry by two IP address with the following format: IP,IP.
DNS Unlocker is different because crooks make this change to the Windows Registry programmatically by using another format with a "space" instead of a "comma" delimiter, like this: IP IP.
Windows is hotwired to read this list, search for a "comma" and append the values to the Internet Protocol Version 4 (TCP/IPv4) GUI window. Because it doesn't see the comma, the interface is left to its default value of "Obtain DNS server address automatically," even if in reality it is running on custom DNS servers.
Users can click the Advanced button and click on the DNS tab to see that even if the GUI says it will obtain the DNS IP addresses from a DHCP server, it does use two hard-coded values.
The interface shows two IPs on the same line, which should be impossible. Trying to add any two IPs at the same time yields an error.
Tech support experts are taught to test for DNS hijackers by going to the Internet Protocol Version 4 (TCP/IPv4) GUI window to see for custom IPs, and even add their own trusted DNS servers.
The problem is that, if a user configures a static value, these IP addresses are added to the Windows Registry after the DNS Unlocker IP addresses as such: IP IP,IP,IP - meaning the hijacked DNS servers will remain primary DNS server values.
Since this practice is the default debug trick for detecting DNS hijacking, DNS Unlocker's trick thwarts any debugging attempts.
The only way to remove them is for the user to click the Advanced button, go to the DNS tab, and then click the Remove button on each line.
ESET says that crooks could also use the semicolon character instead of the space delimiter to obtain the same results, such as: IP;IP
This trick works in the same way, but ESET says it hasn't seen it used in real-world attacks yet.
The company also claims it informed the Microsoft Security Response Center (MSRC), who declined to consider this as a security problem and come up with a hotfix right away, instead redirecting the issue to other teams to be fixed in future Windows versions.
