Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email firstname.lastname@example.org
Re: [Full-disclosure] Drive-by Pharming
From: James Matthews (nytrokissgmail.com)
Date: Thu Feb 15 2007 - 20:11:21 CST
SO we are screwed what else! Wait till this has a big effect on the end user
then people will care But for us how can we defend against it!
On 2/15/07, Oliver Friedrichs <oliver_friedrichssymantec.com> wrote:
> I'm posting this on behalf of Zulfikar Ramzan who isn't subscribed to this
> We discovered a new potential threat that we term "Drive-by Pharming". An
> attacker can create a web page containing a simple piece of malicious
> into the user's home broadband router and attempts to change its DNS server
> settings (e.g., to point the user to an attacker-controlled DNS server).
> Once the user's machine receives the updated DNS settings from the router
> (e.g., after the machine is rebooted) future DNS request are made to and
> resolved by the attacker's DNS server.
> The main condition for the attack to be successful is that the attacker
> can guess the router password (which can be very easy to do since these home
> routers come with a default password that is uniform, well known, and often
> never changed). Note that the attack does not require the user to download
> any malicious software – simply viewing a web page with the malicious
> We've written proof of concept code that can successfully carry out the
> steps of the attack on Linksys, D-Link, and NETGEAR home routers. If users
> change their home broadband router passwords to something difficult for an
> attacker to guess, they are safe from this threat.
> Additional details on the attack can be found at:
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/