Rogue DHCP malware strikes again, now harder to detect

A new variant of the DNS-changing Trojan.Flush.M malware has been spotted, security researchers said this week.

Johannes Ullrich, chief research officer of the SANS Institute, said in a blog post Monday that the malware resembles a December outbreak, which attempted to install a rogue DHCP (Dynamic Host Configuration Protocol) server. DHCP automates the assignment of IP addresses in an organisation's network.

If an attacker is able to install the malicious DHCP, he or she can monitor traffic and hijack request packets from other machines on the network, forcing them to visit malicious websites, with the goal of infecting all machines in the network, researchers said.

"The main goal of the DCHP server is to spread a bad DNS server IP address," Ullrich wrote.

The new variant better hides the fake DHCP than the previous version did, Ullrich said. Also, the latest variant does not specify a DNS domain name.

"Monitor connections to DNS servers other than the approved one pushed out by your DHCP server," Ullrich recommended. "This should help you spot this kind of malware."

See original article on scmagazineus.com