New Attack Type Targets Your Home Network

With trivial ease, a new type of attack can take over poorly set up home networks.

If you haven't changed the default password used on your broadband router (wired or wireless), then a few lines of javascript on any Web site can invisibly direct your browser to change your router's settings and send you to phishing sites.

The proof-of-concept code developed by Symantec and Indiana University in their joint research changed settings for DNS, which guides nearly all Internet traffic. In a real attack (of which there aren't yet any known, thankfully), the hijacked router could send anyone on that home network to their own phishing site instead of, say, bankofamerica.com. You'd end up at the phishing site even if you used best practices like using your own bookmark or typing the address in - and the browser address would display the supposedly real URL.

Or, as has happened in previous DNS attacks, the attacker might just redirect any connection to a poisoned Web site that tries to bust your browser and install a bunch of spyware.

Symantec has more details, along with links to instructions for changing the password on popular routers, in a new blog posting. Indiana University also has a report up.

In this case, the fix is even easier than the simple attack: Make sure you've changed your router password from the default. But this is just one application of a type of attack against internal networks that Jeremiah Grossman of White Hat security has been talking about for some time.

Comments

I was always suspecting so called security labs as a main source of all viruses. I think they are the most interested keeping business running

poltrang

February 17, 2007

1:09 AM PT