Massive Attack on Polish Wi-Fi Routers (Pharming)

As Niebezpiecznik.pl (polish IT security blog) informs – there is massive attack on polish Wi-Fi Routers, which exploit this security hole.

● What does it mean ?

Simplifying: it mean that someone wrote a script that allows him to access your router and change default (set by you or your ISP) DNS to the malicious ones. It also mean that from now on, not only your activity on Internet may be monitoring, but also you may be a victim of fraud – the attackers may present you a bogus site of your bank, and simply strip you off your money.

● How to check if you’re a victim ?

Please log into your Router control panel (please contact your customer support, or check the manual), and check if your DNS are still unharmed – make sure that they are not one of those:

► 5.45.75.36
► 5.45.75.11
► 95.211.241.94
► 95.211.205.5

♦ Also please make sure that your OS do not use one of the above.
To do this:

go to
START > Run
then type
cmd.exe
then type
ipconfig /all

OR
START > Accessories > Command Prompt
then type
ipconfig /all

and check under the DNS Servers

♦ Another resolution is to use DNS Leak test to see what DNS you’re using. Simply go to:

https://www.dnsleaktest.com
then choose
Extended Test
and wait for resoults

● How to change DNS ?

If you want to change your DNS use your Router control panel (as you did to check them) and/or modify them from under your OS.

Under Windows Vista/7 go to

Control Panel > Network and Sharing Center > Change Adapter Settings (on the left menu)
OR
Control Panel > Network and Internet > Network Connections

and follow image instruction:

Ps. Sorry for such a short Press note, more complete articles will be soon, I just have some stuff going on, so be patient ;)

Please make sure that you visit:

★ Niebezpiecznik.pl
★ ROOT@NASRO

.end