New Android 'Switcher Trojan' infects Wi-Fi routers by changing DNS settings

A new Android OS virus has been discovered by cybersecurity firm, Kaspersky Lab, and the same is being termed as ‘Switcher Trojan’. The virus infects Android OS powered devices and uses them as tools to infect a user’s Wi-Fi router. It then changes the DNS settings of the router and starts redirecting traffic from the Wi-Fi connected devices to websites controlled and operated by attackers, making users vulnerable to malware, phishing and adware attacks.

What happens is that when an IP address is assigned to a web address, the Switcher Trojan hijacks the process and gives the attackers complete control over the network activity.  This works because Wi-Fi routers usually change the DNS settings of all the devices connected to them, and reconfigure them to their own settings.

According to Kaspersky, “The infection is spread by users downloading one of two versions of the Android Trojan from a website created by the attackers. The first version is disguised as an Android client of the Chinese search engine, Baidu, and the other is a well-made fake version of a popular Chinese app for sharing information about Wi-Fi networks.” The company adds that the rogue DNS planted by attackers also has a secondary DNS as a backup, just in case the ongoing rogue DNS goes down. “The Switcher Trojan marks a dangerous new trend in attacks on connected devices and networks. It does not attack users directly. Instead, it turns them into unwilling accomplices: physically moving sources of infection. The Trojan targets the entire network, exposing all its users, whether individuals or businesses, to a wide range of attacks - from phishing to secondary infection. A successful attack can be hard to detect and even harder to shift: the new settings can survive a router reboot, and even if the rogue DNS is disabled, the secondary DNS server is on hand to carry on. Protecting devices is as important as ever, but in a connected world we cannot afford to overlook the vulnerability of routers and Wi-Fi networks,” said Nikita Buchka, mobile security expert, Kaspersky Lab.

The company warns that all users should check their DNS settings and search for the following rogue DNS servers:

• 101.200.147.153
• 112.33.13.11
• 120.76.249.59

If any of these servers are found in DNS settings, then it is recommended that users contact their Internet Service Providers and change login IDs, passwords.

January’s Android Distribution Numbers Show Marshmallow Passing 29%, Froyo Pushed Off the Chart

We’re close to half way through January, and Google has just published the Android distribution numbers for the 7-day period ending on January 9, 2017. The big news this month is that Froyo has finally been pushed off the chart completely.

This doesn’t mean it’s 100% dead, as Google reminds us that they simply remove any versions with less than 0.1% distribution for that particular time frame.

Oddly enough, this means that Froyo could reclaim it’s 0.1% share next month if enough devices check the Play Store during the designated time. This is unlikely to happen but there it’s still a possibility. This month we also learn that Android 7.x Nougat is close to reaching the 1% mark, with 0.5% using 7.0 and 0.2% using 7.1. Then we have the Android 6.0.x Marshmallow release which was able to reach a total of 29.6% of the active devices this month.

Going further back we can see all of Lollipop has now reached 33.5%, making it the most used version of Android today. This is split up between Android 5.0 with 10.1% of the market and Android 5.1 with 23.3%. Right behind that is Android 4.4.x KitKat, as it is currently used by 22.6% of the market. This is actually down from 24% last month, so it seems like KitKat is currently on the decline in terms of active devices.

As we wrap things up, Jelly Bean is still being used by 11.6% of the active smartphones and tablets right now, which is down from 12.8% last month. Ice Cream Sandwich is holding strong at 1.1% and we also have Gingerbread with 1% of the total active devices too. It will be interesting to see if Ice Cream Sandwich and Gingerbread are able to stay alive as long as Froyo did. We saw these two distributions drop 0.1% and 0.2% respectively, so next month could bring us closer to their demise as well.