Last Updated on August 29, 2018 by Dave Farquhar
I’ve long recommended hard-coding your DNS settings as a performance and reliability enhancement–here’s my guide for that–but it turns out it can be a security enhancement too.
Botnets targetting routers aren’t new at all, but there’s a particularly nasty one named Moose running around right now. Among other things, it changes routers’ DNS settings to point to rogue DNS servers that allow the attackers to steal your social media credentials, furthering the bot.
But if you hard-code your DNS, the DNS settings on your router don’t matter. Someone can change them all they want, but your machines will keep using the servers you selected. The bot can still infect your router, but by overriding the router’s DNS settings, you limit the damage the bot can do. I recommend Cleanbrowsing.org’s DNS servers.
And, while I don’t know for certain if it helps against Moose, it’s a good practice to move your network off 192.168.0.x and 192.168.1.x, since so much malware assumes routers live at 192.168.0.1 or 192.168.1.1. Finding the router complicates the code, and since more than 90% of home routers live at those two addresses, it’s easiest to just try those two addresses and keep the code compact, simple, and fast. If you’re not the low-hanging fruit, you’re less likely to get infected.
A full mitigation, of course, is to run DD-WRT on your routers. Or better yet, run DD-WRT on your access points and set up Pfsense as your router. An Asrock D1800M makes an ideal Pfsense box, since it consumes very little power and has three PCI Express expansion slots to hold extra network cards. Team it up with a surplus Intel Pro/1000 card off Ebay if you need multiple ports–just make sure you’re getting a PCIe card, not a PCI or PCI-X card. Of course, these two things are more complex, and potentially more costly, than changing a few network settings.
David Farquhar is a computer security professional, entrepreneur, and author. He started his career as a part-time computer technician in 1994, worked his way up to system administrator by 1997, and has specialized in vulnerability management since 2013. He invests in real estate on the side and his hobbies include O gauge trains, baseball cards, and retro computers and video games. A University of Missouri graduate, he holds CISSP and Security+ certifications. He lives in St. Louis with his family.