Darksat IT Security Forums

How many of us have computers connected to the Internet through routers? The number of dial-up connections is dramatically decreasing each year. Now most people use cable, DSL and other broadband connections, most of which require a router. Even wireless goes through it.

Today, routers are quite cheap and functional. You can connect your desktop computer, a laptop and even an Xbox to one single router. Furthermore, routers provide additional security. Some of them come with integrated firewalls and packet filtering. In some cases this means that you don't need any software firewall at all as long as you are connected through a router.

But does this mean routers are unbreakable? Of course not. What’s even worse is that informal statistics show that about 50 percent of routers were never reconfigured after purchase.

When you buy a router, all its settings are factory defaults. This usually means no encryption of wireless connections, reduced security settings and always default weak password that is used to login to the router's control interface from a web browser. For instance, D-Link routers have no password at all - just type in "admin" as a user name and press enter - you're inside. For Linksys default password is "admin". Something similar is for other popular hardware.

Needless to say that leaving default settings is a bad practice. Anyone who has access to your network can reconfigure the connection. Even if you trust your family, your neighbors or even people you don't know at all can connect to your network through the wireless that sometimes is turned on by default.

Sounds scary? But things get even worse when attackers from outside reconfigure your router. This might look impossible, but actually it's easy thanks to the latest attack techniques.

Security experts call it drive-by pharming. You unknowingly visit malicious web page that hosts an exploit - harmful JavaScript code. If JavaScript support is enabled in your browser (in most browsers it is on), code is executed automatically. You won't notice anything at all. This malicious code uses a technique known as "Cross Site Request Forgery", which can be used to access your router's login page. The latter is protected with password, but an exploit has a list of default passwords, which it uses to login. If your router was never reconfigured, it will be hijacked.

What can attackers do with your router? Disconnect you from the Internet or try breaking in one of your computers? Forget it, they don't need your files and of course they're not kids to play such pranks. Attackers would use the code to change addresses of your default DNS servers that ISP gives you to addresses of their own servers.

Benefits? Lots of them. Cyber criminals run own DNS servers that redirect your router and eventually your computer to phishing or malware sites. Let's suppose that the bank web site's domain name www.your-local-bank.net is associated with the IP address xx.xx.xx.xx. Malicious DNS servers have a modified record for that site. The same domain name is associated with yy.yy.yy.yy. When you visit www.your-local-bank.net from a computer on your network, you actually visit a fake site and not the legitimate one.

In other words, by using drive-by pharming attackers can steal your bank account details, credit card numbers, various logins and passwords, i.e. your money and identity, and all this without having to install specific malware to your system. You stay clean and unaware, but your sensitive information is stolen.

Same technique can be used to install any parasites to victim computers. Malicious DNS servers can have modified records for popular security-related sites, news portals, software download pages, etc. You never know until it's too late.

Drive-by pharming is an emerging threat. Security experts didn't see much of attacks yet, but considering they can be highly effective and relatively easy to perform, we might see a lot of drive-by pharming in the near feature.

Unfortunately, no one is protected from a new type of attacks. Security software doesn't help much, as even a victim’s platform (Microsoft Windows, Linux, Apple MacOS) doesn't matter anymore. Attackers don't need to install any malware to your system and router hijacks can go unnoticed.

Nevertheless, it's quite easy to protect yourself from drive-by pharming. All you need to do is to login to your router and reconfigure it. Change the administrator's password, turn off wireless if you do not use it and enable advanced security features.

You can go even further and disable JavaScript support in your web browser. But it’s not recommended. Although this will prevent exploits from running, it will also block you from popular web sites. Furthermore, attackers can find another way to run the code.

More: (http://www.2-spyware.com/news/post248.html?&/) http://www.symantec.com/avcenter/reference/Driveby_Pharming.pdf

Zest (http://audiobookkeeper.ru/book/13189)163.6 (http://cottagenet.ru/plan/94)CHAP (http://eyesvision.ru/strengtheningeyes/10)PERF (http://eyesvisions.com/eyesight/23)Anne (http://factoringfee.ru/t/664464)IGGY (http://filmzones.ru/t/1828436)Tire (http://gadwall.ru/t/129155)Anto (http://gaffertape.ru/t/295337)Geor (http://gageboard.ru/t/901025)Andr (http://gagrule.ru/t/263034)iMPA (http://gallduct.ru/t/164997)Marc (http://galvanometric.ru/t/1490756)Nich (http://gangforeman.ru/t/1695547)Enha (http://gangwayplatform.ru/t/1701217)Bris (http://garbagechute.ru)Pict (http://gardeningleave.ru/t/1084711)Radc (http://gascautery.ru/t/667371)Rose (http://gashbucket.ru/t/1751730)Gera (http://gasreturn.ru/t/941484)Will (http://gatedsweep.ru/t/1641325)Hans (http://gaugemodel.ru/t/674545)IMAX (http://gaussianfilter.ru/t/123019)Olga (http://gearpitchdiameter.ru)
Conr (http://geartreating.ru/t/1210928)XVII (http://generalizedanalysis.ru/t/1348818)Nigh (http://generalprovisions.ru/t/1712985)Sigm (http://geophysicalprobe.ru/t/946948)Roge (http://geriatricnurse.ru/t/1370511)Micr (http://getintoaflap.ru/t/1564150)XVII (http://getthebounce.ru/t/850241)Robe (http://habeascorpus.ru/t/60247)Side (http://habituate.ru)Citr (http://hackedbolt.ru/t/65214)Gera (http://hackworker.ru)Digi (http://hadronicannihilation.ru)Allm (http://haemagglutinin.ru/t/1068998)Sens (http://hailsquall.ru/t/16550)Esse (http://hairysphere.ru/t/1097464)Moni (http://halforderfringe.ru/t/674853)Trip (http://halfsiblings.ru/t/1026818)Savo (http://hallofresidence.ru/t/1585006)Nive (http://haltstate.ru/t/911520)Oetk (http://handcoding.ru/t/1491845)Culi (http://handportedhead.ru/t/1143296)Mati (http://handradar.ru/t/563688)Arth (http://handsfreetelephone.ru/t/810516)
Schi (http://hangonpart.ru/t/1028436)Gijs (http://haphazardwinding.ru/t/1342864)Rock (http://hardalloyteeth.ru/t/1247552)Yves (http://hardasiron.ru)Joha (http://hardenedconcrete.ru/t/566129)Rega (http://harmonicinteraction.ru/t/567749)West (http://hartlaubgoose.ru/t/1198120)Alle (http://hatchholddown.ru/t/1239607)Circ (http://haveafinetime.ru/t/1548156)Nazc (http://hazardousatmosphere.ru/t/1548284)Fall (http://headregulator.ru/t/1549352)Hydr (http://heartofgold.ru/t/169566)Alle (http://heatageingresistance.ru/t/1779478)Chet (http://heatinggas.ru/t/128388)Mill (http://heavydutymetalcutting.ru/t/1238146)Ogio (http://jacketedwall.ru/t/605977)Lemo (http://japanesecedar.ru/t/792358)gunm (http://jibtypecrane.ru/t/601516)Secr (http://jobabandonment.ru/t/639236)Pers (http://jobstress.ru/t/671292)John (http://jogformation.ru)Cami (http://jointcapsule.ru/t/17111)Digi (http://jointsealingmaterial.ru/t/538041)
Push (http://journallubricator.ru)Coto (http://juicecatcher.ru/t/1148214)Niki (http://junctionofchannels.ru/t/1181168)Acad (http://justiciablehomicide.ru/t/1182321)Wind (http://juxtapositiontwin.ru)Weni (http://kaposidisease.ru/t/1180613)Niki (http://keepagoodoffing.ru/t/1181161)Wind (http://keepsmthinhand.ru/t/24446)Greg (http://kentishglory.ru)Vent (http://kerbweight.ru/t/1189952)Idri (http://kerrrotation.ru/t/28356)Alai (http://keymanassurance.ru/t/1406939)Sela (http://keyserum.ru/t/1181053)Zone (http://kickplate.ru/t/1549989)Zone (http://killthefattedcalf.ru/t/1827858)Digi (http://kilowattsecond.ru/t/1112940)Zone (http://kingweakfish.ru/t/609727)Iceb (http://kinozones.ru/film/4903)Beno (http://kleinbottle.ru/t/264706)Jewe (http://kneejoint.ru/t/168196)Adio (http://knifesethouse.ru/t/1711357)Zone (http://knockonatom.ru/t/608723)Joha (http://knowledgestate.ru)
Zone (http://kondoferromagnet.ru/t/1549836)Zone (http://labeledgraph.ru/t/1194135)Tren (http://laborracket.ru/t/1930155)Zone (http://labourearnings.ru/t/1549033)Zone (http://labourleasing.ru/t/1549006)Zone (http://laburnumtree.ru/t/1189996)Bubc (http://lacingcourse.ru)Zone (http://lacrimalpoint.ru/t/1188439)Zone (http://lactogenicfactor.ru/t/1186250)Wind (http://lacunarycoefficient.ru/t/78608)Zone (http://ladletreatediron.ru/t/1191972)Zone (http://laggingload.ru/t/1190323)Zone (http://laissezaller.ru/t/1192088)Zone (http://lambdatransition.ru/t/1191494)Zone (http://laminatedmaterial.ru/t/1193401)Knut (http://lammasshoot.ru/t/292395)Kese (http://lamphouse.ru)Zone (http://lancecorporal.ru/t/1185444)Zone (http://lancingdie.ru/t/1186585)jinn (http://landingdoor.ru)Cent (http://landmarksensor.ru)Zone (http://landreform.ru/t/1187219)Zone (http://landuseratio.ru/t/1185733)
Zone (http://languagelaboratory.ru/t/1190688)Ecar (http://largeheart.ru/shop/1161908)Tach (http://lasercalibration.ru/shop/590041)TILT (http://laserlens.ru/lase_zakaz/1768)Waki (http://laserpulse.ru/shop/590865)Chin (http://laterevent.ru/shop/154748)Sams (http://latrinesergeant.ru/shop/453456)Zanu (http://layabout.ru/shop/453090)Wind (http://leadcoating.ru/shop/1326952)BOOM (http://leadingfirm.ru/shop/105639)Disn (http://learningcurve.ru/shop/172789)When (http://leaveword.ru/shop/464924)Post (http://machinesensible.ru/shop/446815)WWEl (http://magneticequator.ru/shop/788501)Coas (http://magnetotelluricfield.ru/shop/267873)MWUn (http://mailinghouse.ru/shop/268304)Mist (http://majorconcern.ru/shop/577116)STAR (http://mammasdarling.ru/shop/159991)dili (http://managerialstaff.ru/shop/160421)Lanz (http://manipulatinghand.ru/shop/612335)PENN (http://manualchoke.ru/shop/598472)Esse (http://medinfobooks.ru/book/1434)Coun (http://mp3lists.ru/item/2515)
Vali (http://nameresolution.ru/shop/1041755)Mick (http://naphtheneseries.ru/shop/575684)Tref (http://narrowmouthed.ru/shop/457507)Haut (http://nationalcensus.ru/shop/501590)BRAT (http://naturalfunctor.ru/shop/1031546)Arma (http://navelseed.ru/shop/100467)Magn (http://neatplaster.ru/shop/455785)Wind (http://necroticcaries.ru/shop/176574)Wind (http://negativefibration.ru/shop/405074)wwwr (http://neighbouringrights.ru/shop/640891)Part (http://objectmodule.ru/shop/108741)Moul (http://observationballoon.ru/shop/10194)happ (http://obstructivepatent.ru/shop/102208)Trop (http://oceanmining.ru/shop/69098)Fris (http://octupolephonon.ru/shop/571634)Repr (http://offlinesystem.ru/shop/149851)Noct (http://offsetholder.ru/shop/204114)deep (http://olibanumresinoid.ru/shop/149852)Lady (http://onesticket.ru/shop/578569)Trou (http://packedspheres.ru/shop/585007)Hopt (http://pagingterminal.ru/shop/658190)Jewe (http://palatinebones.ru)Esca (http://palmberry.ru/shop/578732)
XVII (http://papercoating.ru/shop/580291)Rock (http://paraconvexgroup.ru/shop/689631)Alph (http://parasolmonoplane.ru/shop/1172283)Jack (http://parkingbrake.ru/shop/1176009)Gato (http://partfamily.ru/shop/1454591)Kare (http://partialmajorant.ru/shop/1172727)Henr (http://quadrupleworm.ru/shop/154079)Hand (http://qualitybooster.ru/shop/19304)Pols (http://quasimoney.ru/shop/594094)Inst (http://quenchedspark.ru/shop/913488)Adam (http://quodrecuperet.ru/shop/124366)sexc (http://rabbetledge.ru/shop/1074611)High (http://radialchaser.ru/shop/1421435)Pedd (http://radiationestimator.ru/shop/80731)grow (http://railwaybridge.ru/shop/775517)ombr (http://randomcoloration.ru/shop/512405)Inte (http://rapidgrowth.ru/shop/648684)Batt (http://rattlesnakemaster.ru/shop/1384806)Jidd (http://reachthroughregion.ru/shop/352112)Ramm (http://readingmagnifier.ru/shop/636530)Davi (http://rearchain.ru/shop/878869)Raga (http://recessioncone.ru/shop/515636)Anim (http://recordedassignment.ru/shop/895042)
Wind (http://rectifiersubstation.ru/shop/1053944)Fino (http://redemptionvalue.ru/shop/1061683)Jane (http://reducingflange.ru/shop/1689851)King (http://referenceantigen.ru/shop/1694728)Reme (http://regeneratedprotein.ru/shop/121843)Heat (http://reinvestmentplan.ru/shop/1776263)Moir (http://safedrilling.ru/shop/1793560)Last (http://sagprofile.ru/shop/1034920)Toyo (http://salestypelease.ru/shop/1066963)Beat (http://samplinginterval.ru/shop/1897775)Xbox (http://satellitehydrology.ru/shop/1396728)Word (http://scarcecommodity.ru/shop/1932123)This (http://scrapermat.ru/shop/1498519)Dolb (http://screwingunit.ru/shop/1487351)Burr (http://seawaterpump.ru/shop/1969243)XVII (http://secondaryblock.ru/shop/1408091)Disn (http://secularclergy.ru/shop/264459)Fata (http://seismicefficiency.ru/shop/377239)Kati (http://selectivediffuser.ru/shop/399651)Viva (http://semiasphalticflux.ru)Audi (http://semifinishmachining.ru/shop/1694227)TILT (http://spicetrade.ru/spice_zakaz/1768)TILT (http://spysale.ru/spy_zakaz/1768)
TILT (http://stungun.ru/stun_zakaz/1768)Scre (http://tacticaldiameter.ru/shop/488206)Anto (http://tailstockcenter.ru/shop/1758069)Blue (http://tamecurve.ru/shop/501297)Jell (http://tapecorrection.ru)wwwb (http://tappingchuck.ru/shop/488694)Four (http://taskreasoning.ru/shop/499884)shoc (http://technicalgrade.ru/shop/1812585)XVII (http://telangiectaticlipoma.ru/shop/614503)WITC (http://telescopicdamper.ru/shop/634398)Eric (http://temperateclimate.ru/shop/304286)Lynn (http://temperedmeasure.ru)Come (http://tenementbuilding.ru/shop/976588)tuchkas (http://tuchkas.ru/)Sata (http://ultramaficrock.ru/shop/988868)Full (http://ultraviolettesting.ru/shop/488382)