New malware that infects devices not built on Windows

New malware that infects devices not built on Windows

According to The Register, Internet security experts are alarming about the new rush of malicious software attacks that can come over the security settings of a wide variety of devices on a local area network, even when they are hardened or don't run on Windows operating systems.

The trojan sets up a defective dynamic host configuration protocol (DHCP) being activated just once. Therefore other devices that use the same LAN are also hurt, undergoing the influence of a malicious domain name system server, instead of the one set up by the network administrator. Importantly, the defective DNS server sends the devices to fraudulent websites that in the majority of cases can be hardly identified as cheaters. 

Johannes Ullrich, CTO of the SANS Internet Storm Center warns that a new type of Trojan.Flush.M is making the rounds. It offers several improvements over its predecessor, which was discovered in early December. The new strain no longer specifies a DNS domain name, making the defective DHCP server harder to be recognized. He also told The Register that this newest kind of malware is definitely dangerous because it affects systems that themselves are not vulnerable.

One of the ways is to defense from the attack is to hardwire DNS server settings into your iPhone, computer or other net-connecting device. This supposed to direct it to bypass the defective DNS server even if the device is unfortunate enough to get its internet connection from the impostor DHCP server.

Ullrich advises administrators monitor connections to all DNS servers other then the one that's approved for the networks with thousands of machines. And the last effective way of protection is to blacklist 64.86.133.51 and 63.243.173.162, which are the DNS servers, used by the most recent variant.