Slashdot Log In
Drive-By Pharming Attack Could Hit Home Networks
Posted by
Zonk
on Fri Feb 16, 2007 10:03 AM
from the dive-behind-the-router dept.
from the dive-behind-the-router dept.
Rob wrote in with a link to a CBR Online article discussing drive-by pharming, a new exploitation technique developed by Indiana University and Symantec Corporation. While it's not known if the technique is in use 'in the wild', the exploit could easily co-opt the web-browsing habits of a user that had not properly configured their router. "The attack works because most of the popular home routers ship with default passwords, default internal IP address ranges, and web-based configuration interfaces. The exploit is a single line of JavaScript loaded with a default router IP address, a default password, and an HTTP query designed to reconfigure the router to use the attacker's DNS servers." The article goes on to discuss several related and more advanced techniques related to this one, which security companies will have to keep in mind to guard against future attacks.
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Simple solution for this (Score:3, Interesting)
2. Browsers are modified to lookup these hashes in #1 to determine if the DNS servers it is talking to are ok.
The net needs to be more secure and there need to be more checks in place through authoritive sources.
This pharming attack reminds me of when I first installed the doorbell on my house, every once in a while it would go off and nobody was at our door, it turned out that the people across the street had the same doorbell set to the default settings.
Made a mistake, please don't publically flog me. (Score:3, Insightful)
Re:Simple solution for this (Score:5, Insightful)
2. Browsers are modified to lookup these hashes in #1 to determine if the DNS servers it is talking to are ok.
A simpler solution would be for the manufactures of these routers to have them refuse to act as routers with any of the default settings. i.e. with the default settings you could connect to it for configuration, but no Internet access until the password, SSID, etc had been changed.
Parent
Re: (Score:3, Insightful)
I know, I know. The people who write the manuals don't actually use the products they talk about* so the manufacturer will have to make
You haven't dealt with end-users much, have you? (Score:5, Funny)
Aha, aha, ahahaha. If you DO put it in the documentation, on the top of every page, in red 24 point bold all caps, you will get hundreds of calls from irate users. If you DON'T, the number will be approximately 99% of whatever your userbase actually is. The other 1% will, as usual, stick their tounge in the wall socket to see if it's live before plugging in the device, somehow poke both their own eyes out with the ethernet cable, or eat the packet that says "DO NOT EAT."
Parent
Re: (Score:2)
Then all people need is a 3.5 postcard(s) in the box telling them to plug their computer into the router and go to http://192.168.1.1/ [192.168.1.1] and follow the instruction.
I know, its not perfect, but its better - way better - than what's there
Re: (Score:3, Funny)
Dude, ATM machines don't even have futuristic features like that. Come back to reality.
http://it.slashdot.org/article.pl?sid=06/09/21/181 9242 [slashdot.org]
Re: (Score:2)
Cars ship with seatbelts and big fat warning signs in the glove box and the top side of the sun visors that tell you to use them, but an alarming number of people don't.
Yet, if your car failed to start if you weren't buckled up, p
Re:Simple solution for this (Score:5, Funny)
If they aren't buckled up, they are going ballistic anyways...it's just a matter of time.
Parent
Re: (Score:2, Funny)
Last time I checked. . . (Score:5, Insightful)
If you had all your personal papers in a safe, would you leave it set to the factory combination?
Re: (Score:2, Funny)
Exactly. The first thing I did on my router was change the password. A few months later, my forgotten password now locks me out. Does anyone have a safety pin?
Re: (Score:2, Interesting)
If you really can't remember, there is nothing wrong with taping the password to the bottom of your router. If the attacker can gain physical access to your router you have a much bigger problem that wireless security.
You shouldn't do this at your workplace, but at home it is acceptable...
I don't do this, I know the (strong) password of my Access Point
Re: (Score:3, Insightful)
You're right of course. But, part of the problem is simply consumer education.
It used to be that only people who knew a fair amount about computers used them. They were a self educating populace. The adoption of computers and home networks by a lot of people has actually happened faster than the corresponding education of people about
Re: (Score:3, Informative)
When I switched from DSL to Verizon's FIOS, I got an Actiontec MI424WR [actiontec.com] router. By default, it was configured with a randomly generated SSID and
Re: (Score:3, Insightful)
Then hitting the reset on the router just caused this to happen again with a newly created password.
Viola, no more default passwords.
Re: (Score:3, Funny)
President Skroob: Great. Now we can take every last breath of fresh air from planet Druidia. What's the combination?
Dark Helmet: 1 2 3 4 5.
President Skroob: 1 2 3 4 5? That's amazing! I've got the same combination on my luggage! Prepare Spaceball 1 for immediate departure!
Dark Helmet: Yes, sir!
President Skroob: And change
Legal issues (Score:5, Informative)
Right now she has a client that is being sued for quite an amount of money by the music industry for downloading lots of music through P2P services. He claims he never did this, that he never listens to music on his computer.
It turns out that he lives in an apartment block, knows very little about computers in general, but thought that this things with wireless network was really fancy. I think you can figure out the rest of that story, my sister has quite a few troubles convincing the music industry what is obvious, I don't know what the outcome of this case is and if it has been taken to court yet.
According to Danish law he probably has some responsibility and will, even if my sister successfully proves that he did not do the illegal downloading, still somehow get punished for this.
I think there are many interesting legal issues in this.
Re: (Score:2, Informative)
Re: (Score:2)
Re: (Score:3, Insightful)
I'm not sure that's relevent. I can't speak for Danish law, but there are a lot of laws in Britain you can break with no ill-intent or action on your part. As a general rule, you are responsible for your Internet connection there and the laws are worded such that you're responsible on the basis of the end result and chain of responsibility, not bad faith actions on your part.
I've heard of people (as in my mother is a lawyer and has assisted them, this is not friend-of-a-friend stuff) being arrested after
Show your sister this article! (Score:4, Interesting)
Earlier this month the inability to prove who actually did the file sharing caused the RIAA to drop a case in Oklahoma and now it looks like the same defense has worked in a California case as well. In both cases, though, as soon as the RIAA realized the person was using this defense, they dropped the case, rather than lose it and set a precedent showing they really don't have the unequivocal evidence they claim they do.
Parent
Re: (Score:2)
Re: (Score:2)
The reason I don't know about the outcome of this case could be because it is somehow not public information, perhaps it will be at some point, I don't know.
not with my 2wire router (Score:5, Interesting)
Comcast (Score:4, Insightful)
Re: (Score:2)
Could some elaborate on this? My understanding was always that cable and DSL providers provide modems to their customers. Do cable ISPs now manufacture, sell, rebrand or distribute "routers", or is the poster talking about Linksys, Netgear et al. consumer NAT boxes purchased by the user?
Re: (Score:2)
Re: (Score:2)
So, how do you tell your clueless neighbors? (Score:3, Interesting)
Like this.... (Score:5, Insightful)
[YOU] "Do you have a [brand] router?'
[NEIGHBOR] "Yes, I do."
[YOU] "My computer keeps detecting it, thinking it can log on - did you set a password, WEP ect.?"
[NEIGHBOR] "What's that?"
[YOU] "It how you keep anyone other than yourself from being able to access your internet connection,
if it's not secure, anyone within your routers range can log in....I can help you if you'd like"
Parent
The sequel (Score:5, Funny)
(Later)
[NEIGHBOR]
[COP] Sadly, this is what happens when you invite someone you hardly know into your house and put them in charge of configuring your security. How could you possibly have imagined that would be a good idea? But the people who sold you the router are just as much to blame. Nice work, selling a router that the customer then has to ask potentially untrustworthy third parties to configure because the defaults don't work and are hard to change.
[NEIGHBOR] An idiot is me.
[COP] Yes. Yes, an idiot is you.
Parent
Re: (Score:2)
I have one such neighbor, and I have considered logging into their wide-open AP and rebooting it or setting WEP keys or some such, but such measures would of course fail, since they are clueless.
Well, being clueless, they will ask their most computer-savvy neighbor for advice. That would be you. You come over and "fix" their AP, and in the course of fixing it "discover" that it is also insecure. Then you advise them on how to properly secure it.
Re: (Score:3, Insightful)
you mean like for example *their* printer?
I did that to some AF guys once. I printed a page with orders to call me in giant letters. They were pretty good natured about it and actually appreciated that I was helping them.
The Ah-nold response (Score:2)
Ah, now if we could only invent a way of delivering a swift kick through the internet.
So let's set good passwords (Score:5, Funny)
A big part of the problem is poor documentation (Score:5, Informative)
I also needed to get this router configured on my Linux box...this required that I read some "outside documentation" - where I would learn of such things as passwords, WEP, etc.
Anyway, it turns out the Windows auto-install script set this thing up with no protection what-so-ever. It was only after I read the HOWTO's on the internet that I was able to go back and secure my router for both Linux and Windows.
I lived in a couple of neighborhoods since then and, when I fire up my laptop, there are usually one or two unsecured routers that get auto-detected.
I can only assume there are scores of "average users" with no idea they are sharing their internet access with their neighbors or anyone who "drives by".
Best security software in the world won't do much good if you don't tell the user what it is and how to use it.
Re: (Score:2, Informative)
Anyway, it turns out the Windows auto-install script set this thing up with no protection what-so-ever. It was only after I read the HOWTO's on the internet that I was able to go back and secure my router for both Linux and Windows.
I know it's always hip to bash Windows on slashdot, but to be fair: in Windows XP the applet that handles wireless connections says "unsecured wireless connection" right there in the dialog. The problem here is the software that comes with these access points: they are b
Re: (Score:3, Informative)
Re: (Score:3, Interesting)
After 30 days the number of default confuguration routers in my neighborhood dropped significantly. I forced them all t
how nice of symantech to develop this (Score:2)
)80qws()8FAWEJ
SPAM
SPAM
SPAM
SPAM
SPAM
Re: (Score:2)
This isn't about wireless access! (Score:5, Informative)
This attack also applies to non-wireless routers and routers with properly secured or disabled wireless LANs. The critical flaw is to leave a default password on the configuration interface. The interface is not safe from external attacks just because it's firewalled on the external interface.
What the Phudge? (Score:2)
Re: (Score:2)
It's part of a culture that goes back to The Beginning.
What's the saying from roots? If you don't know where you came from you wont know where you're going.
Re: (Score:2)
These days, it's just idiot reporters who don't bother to actually do their research, coupled with idiot kids who think that misspelling words makes them sound cool. A Hacker is somebody who takes thi
Enough with the goofy terms for this crap (Score:4, Insightful)
The security community is completely pathetic, the #1 motivation of all of this crap are consultants who want to go around and say that they coined the phrase "pharming", or were able to drum up panic over every obscure flaw in Powerpoint 97.
Seen this and it's scary (Score:5, Insightful)
In my street, there are at least three wireless networks with default passwords. When my friends come around with their wireless laptops, they get a good connection. It most definitely isn't through mine, because my LAN is all wired (in fact, it's still got one length of co-ax in it!) On two of them, the network name was the model of the router. One quick Google later and I had the default password. And it worked -- I had the configuration page up! I almost changed their network name to "uRpWn3d" and setting a new password, just for a laugh and maybe to teach them a lesson, but decided against it; there are ways of pointing out something loose that look less like vandalism than breaking it off.
The real, long-term solution is for routers to be designed not to route packets as long as the password is set to the factory default -- if the password hasn't been changed, then the router should not allow you to connect to anything except its own configuration page. If you do a full factory reset and find yourself able to connect to web sites straight away without deliberately changing the password, then that must mean one of your machines has already been compromised. Then it's better that you stay off the Net until your computers are fixed.
Re:Moo (Score:4, Informative)
They can be configured that way, but usually by default, they are not. I know that Linksys has the option, but Wireless management of the router is not disabled by default.
Beside that, the title was a bit misleading with the term "drive-by". This exploit has nothing at all to do with a wireless LAN.
Basically:
Parent
Re: (Score:3, Interesting)