Users of the Chinese keyboard application Sogou have once again fallen victim to malware campaigns, with the latest attacks leveraging DNS hijacking to deliver malicious code, according to researchers at ESET.
The software, one of the most widely used input method editors for entering Chinese characters on Windows, is estimated to have hundreds of millions of users worldwide. On 1 July researchers observed infections among users in Hong Kong, Thailand, Japan, Vietnam, Sri Lanka and Oman. Further investigation revealed that attackers were performing DNS hijacking to intercept the application’s HTTP-based update requests and redirect them to malicious servers.
Because Sogou communicated over plain HTTP, the attackers could modify the responses and instruct the software to download and execute malware. The delivered payload collects system information and is capable of installing additional malicious components. ESET noted that the exact method of DNS hijacking remains unknown but could involve compromised routers or manipulation at the internet service provider level.
The security firm alerted developer Tencent on 11 September. Seven weeks later, on 30 October, Tencent released version 16.10 of Sogou, which converts all requests to HTTPS and applies certificate pinning to prevent similar interception attacks.
This marks the third publicly reported campaign against Sogou users. In September a separate vulnerability was exploited to install a backdoor, while two years earlier ESET documented a man-in-the-middle attack that also delivered malware through the application’s update mechanism.
