60% of Global Routers Targeted? Unveiling DNS Security Flaws Through the TP-Link Hack

The IT security industry has been abuzz lately. News broke that the Russian military intelligence unit (GRU) launched a massive hacking campaign targeting TP-Link routers spread across the globe. According to official statements from U.S. intelligence agencies and the FBI, they exploited router vulnerabilities to build a vast botnet and use it for espionage.

TP-Link is, in fact, a giant in the router market, commanding over 60% of global share. Consequently, conspiracy theories have long shadowed the company, such as claims of "backdoors due to Chinese investment" or the ability to "monitor the entire world at will."

Of course, I don't fully buy into these cinematic conspiracy theories. The reason is clear, even without them. Just as hackers target Windows rather than expending effort on viruses for low-market-share Linux distributions, it's overwhelmingly cost-effective for router hackers to focus on exploiting a single vulnerability in the best-selling TP-Link. In short, it's simply a 'big target' that's ripe for exploitation.

Router Security Check Poster

The Core of the Attack: DNS Hijacking

In this incident, the hackers employed a classic yet devastating technique: 'DNS Hijacking.' By exploiting TP-Link vulnerabilities, they gained administrator privileges for thousands, even tens of thousands, of routers, then changed the configured DNS addresses to fake DNS servers they had prepared.

Users connect to Google or YouTube as usual, but their traffic is actually routed through the hacker's server. During this process, their IDs, passwords, and even session tokens are completely stolen. It's like the key to your front door ending up in a hacker's hands.

๐Ÿ’ก What is DNS (Domain Name System)?
Simply put, it's the internet's 'phone book.' When we type text like google.com into a web browser, the computer doesn't understand it directly. So, it asks a DNS server, "What's Google's address?" and receives a numerical IP address like 142.250.xxx.xxx.

But what if a hacker manipulated this phone book? If you asked for 'my home,' and the hacker gave you the address to 'a thief's house,' you would unknowingly go there.

The FBI's Response: Hacking Back?

What's interesting is the FBI's response. They announced that, with court authorization, they used so-called 'advanced techniques' and 'special commands' to restore the victims' router settings.

While they used the fancy word 'restore,' to be frank, it means the FBI also exploited TP-Link vulnerabilities to illegally access (hack) users' routers and change their settings. It was, in essence, a lawful 'reverse hack' carried out under the guise of a state agency, a truly peculiar spectacle.

Is Your Router Secure?

The issue extends to countries like South Korea and Japan. It's highly unlikely that government agencies in these nations, sensitive to privacy and authorization issues, would 'kindly (?)' access your router to fix settings, as the FBI did. It's even questionable whether they have the capability or systems in place to do so.

Ultimately, you can only rely on yourself. Unless you live in the U.S., you, the reader of this article, must directly access your router's administration interface and check its status. It doesn't matter if it's not a TP-Link. Check it right now.

3 Immediate Actions You Should Take

  1. Check DNS Server Settings: Access your router's administration page and verify the DNS addresses. If you find unfamiliar IPs that you didn't set, correct them immediately. If you're unsure, simply use the public DNS servers below; it's the easiest solution.

    • Cloudflare: 1.1.1.1
    • Google: 8.8.8.8

  2. Update Firmware (Essential): While you're in the administrator mode, hit the firmware update button. The latest patches released by manufacturers are the only way to plug the holes in your router's security. Many people probably haven't paid attention to this before, so now is a good opportunity to update your router's firmware.

  3. Change Your Password (Basic but Crucial): I can guarantee that some people still have their administrator password set to admin or haven't even configured one at all. That's like leaving your front door wide open and hoping no one breaks in. Please, set up a strong password immediately.

Concluding Thoughts

Hacking isn't just something from movies. The moment you own an internet-connected device, you become a 24/7 target. Routers, in particular, are the 'gateways' through which all your home's traffic passes.

There's nothing more foolish than blaming corporations or the government after your personal information is stolen because you didn't even follow basic security protocols. I believe we must at least take care of our own 'front door keys.' I hope more people become interested in hacking and security. This way, even profit-driven companies would invest in security out of fear of losing consumers, ultimately leading to safer services for all of us, wouldn't it?