Todd and Tyler Unauthorized Forums

ob1

Whenever you type an address into an Internet browser, that address is instantly resolved into the site's numerical Internet address by a DNS server located somewhere in the world. On Tuesday, Symantec announced that online criminals have started to remotely redirect your home network router's DNS server so that whenever you type in a financial institution or other trusted site, your browser will instead be redirected to a bogus or phishing Web site.

The practice, called pharming, usually attacks the DNS servers directly, but this latest attack brings it all home (if you are using broadband connectivity). Fortunately, the routers and institutions affected by this current attack are limited to one country, Mexico, but Symantec warns that word of this real-world attack could bring similar attacks elsewhere.

Last year, researchers at Symantec and the University of Indiana reported that remotely changing a home router's DNS server was theoretically possible. The theoretical attack used Javascript on a specially crafted Web page, and affected only wireless routers. The attack in use today uses e-mail, and it can affect non-wireless routers as well.

According to a blog by Zulfikar Ramzan, a researcher at Symantec, "the attackers embedded the malicious code inside an e-mail that claimed it had an e-card waiting for you at the Web site gusanito.com.

Unfortunately the e-mail also contained an HTML IMG tag that resulted in an HTTP GET request being made to a router (the make of which is a popular router model in Mexico). The GET request modified the router's DNS settings so that the URL for a popular Mexico-based banking site (as well as other related domains) would be mapped to an attacker's Web site."

The best way to prevent becoming a victim is to change your network router's default password. Default router passwords are not a secret and are available on the Internet, so if you haven't ever changed your network router's password, now is a good time. Syamntec's Ramzan further recommends performing a hard reset of your router first, just in case you are already compromised.

If choosing a router password intimidates you, Ramzan also points out that if you ever do forget your new password, you can always do a hard reset on the box in the future (something a remote hacker can't do) and choose a new password later.

---

Original Article: Drive-by pharming attack hits home | Defense in Depth - computer security, hacking, crime, viruses - CNET News.com
News Source: Technology news - CNET News.com

Dave

Are you sure this isn't an urban legend? They have routers and banks in Mexico?

__________________
"Perverting the court of justice"
--------------------------------------------
Todd and Tyler Streaming
Questions, comments, concerns?
Contact the Empire

iwccgrad

That is good advice even without the threat of an attack. If you are going to take the time to lock down your router put in your own password. I realize there are a lot of lazy people or people who aren't sure what they are really doing, but come on.

__________________
"I popped one of my balls.....no one of my look balls" - Craig Peters

ob1

lilyvon schtupp

__________________
A man melts the sands so he can see the world outside.--U2, Lemon

Daphne

lilyvon schtupp

__________________
A man melts the sands so he can see the world outside.--U2, Lemon

mike

Nah, Lily you are much more attractive.

__________________
"Black Tony isn't salty, he's creamy"- Travis Justice

Thender

Oh, Lilly, Lilly, Lilly, Lilly.....

__________________
Two in the mouth is worth one in the bush.

4th place, 2008 TNTU.net college fantasy football... Bud came in 6th...