Malware adding code to ga.js opens up random ads/websites?

Question

A friend of mine just handed me his tablet saying that everytime he open a webpage the browser redirects to several advertisement page (or, it "adds" advertisements on the page).

This happens both on Chrome and the stock browser.

I used USB debugging to look at the browser request and I think I found the culprit. When the browser loads http://www.google-analytics.com/ga.js the actual code is different. See this screenshot (the green line is where ga.js should terminate):

(and the added code goes on...)

I initially thought that some malware changed the hosts file and assigned a different IP to the google-analytics website, but this is not the case since when I visit the above link directly I see the correct JS code.

How can I track which app is doing this?

Answer 1

I've encountered the above situation yesterday. After lots of digging, got to this thread, and it led me to the solution.

Apparently, that one of the computers on the network I've visit, was exposed to a malware that modified the router settings. The router was a D-Link 2760U/E with default Admin / Admin login details.

Using the above credentials, the above malware has changed the "static routing tables" adding their servers to be a man in the middle. All non SSL traffic had passed through their service which injected js into the page. I've found a GitHub page who shows the modifications and additions.

It took me a while to understand that all the traffic is coming from a DNS change attack - I have checked and verified that the computer is totally clean and no unknown process / services are running before and while the test.

One of the things they have done is to redirect all google-analytics.com traffic to their server, keeping them under the radar.

So how to resolve it:

Quick way:

Reset you router to factory settings - note it will erase all existing settings.

Long way:

1. Login into the routers web UI
2. Remove all unknown entries from the static routing tables
3. Change your login password for the router
4. Reboot your router.

I hope this post will assist someone.

Regards,
Liron

Answer 2

This might be caused by DNSChanger malware but that's dead now so it's possible that it's caused by some other kind of malware that messes with a computer's (or router's) DNS settings. Or maybe the router was exposed to the web (see remote management) and someone was able to hijack it and change its DNS settings.

If the same problem affects all devices (PCs included) connected to the Wi-Fi network, then I guess a router reset is in order in addition to doing a malware scan on all PCs connected to the network. You may use Malwarebytes Anti-Malware for that.

On the Android device, clear Google Chrome's data and cache after the router has been reset and the malware scan is complete. This thread on Google Product Forums might be relevant to the issue.

To test whether or not this is indeed a DNS hijack problem, try running nslookup google-analytics.com from the infected computer (or Android device if BusyBox is installed) and compare the results for the same command run from another computer that you know is clean.

Check if they both return the same IP addresses or in the case of Google, IP addresses controlled by Google. You can verify whether a given IP is Google's or not by doing a WHOIS lookup here: http://whois.domaintools.com/X.X.X.X (x.x.x.x being the IP address)

Answer 3

In the end I found out that the router was vulnerable to the rom-0 vulnerability (to test if your router is vulnerable, use this).

So, the issue was most likely caused by someone (or something) who had complete access to the admin interface of the router. I've now updated the firmware (and the test is now negative).