Slashdot Mirror
Drive-By Pharming In the Wild
An anonymous reader writes "Symantec reported Tuesday that the first case of drive-by pharming, in which a hacker changes the DNS settings on a customer's broadband router or wireless access point and directs the link to a fraudulent Web site, has been observed in the wild. The first drive-by pharming attack has been observed against a Mexican bank: 'It's associated with an e-mail pretending to be from a legitimate Spanish-language e-greeting card company, Gusanito.com,' says Symantec Security Response principal researcher Zulfikar Ramzan. Inside the e-mail is an HTML image tag but instead of displaying images, it sends a request to the home router to tamper with it."
So, I suppose this "hack" fails entirely on any router which... well, either has a default password or (like any high end router) doesn't use HTTP basic authentication? No worries for me, my 3com is safe as houses.
For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
Was it a Linksys with default settings?
http://www.google.com/search?hl=en&q=default+router+passwords&btnG=Google+Search
It sounds like a simple captcha image on the router's login page would thwart this.
2Wire DSL routers to point the user's Web browser to a fraudulent bank site that mimics the site of one of the largest Mexican banks.
There is not much space to guess here, it is either Banamex or Bancomer...
Ubuntu is an African word meaning 'I can't configure Debian'
What does "drive-by" have to do with this kind of hack? Oh sure we've all logged into neighbors wireless routers and snickered because they've left the default password. Somehow I think "drive-by" part was coined by a guy who thought of exploiting unsecured wireless routers and changing DNS settings. Am I the only one who doesn't think "drive-by" applies to this kind of attack?
Anyone else notice that BT are taking this seriously - log on to the router's home page and it tells you they have changed the default admin password (well it will when you enter the unit's serial number as the admin password.
A thistle is a fat salad for an ass's mouth...
If Bioware can sell $30 software with unique CD-Keys printed on the inside of each jewel case, why can't Linksys sell $40 routers with unique admin passwords printed on each manual. Or better yet, make the default password the last 6 digits of the LAN side MAC address, that can't be terribly hard to manufacture.
Seriously, you could even honestly market them as "more secure."
Only this time it's between Mexican scammers and Nigerian ones. For years Nigerian scammers have exercised hegemony in the arena, but now Mexican scammers have upped the ante with this "pharming gap." This can only lead to a scams arms race with other nations as proxies and victims of the complex maneuvering of the two camps. As a helpless American I don't know how long I can stand being the play thing of two foreign powers duking it out for hegemony.
By the way I'm rooting for the Nigerians in this grand campaign, at least their scams provide a laugh once and awhile.
I got a catholic block.
Dude, gusanito means literally "little worm"; I personally would never open an email saying "hey, you got a postcard from a little worm!". I don't know who would...
...that this doesn't happen more often. I can drive through Seattle (and presumably any large city) with my laptop running a wireless network sniffer. After about 10 blocks, I could easily get into no less than 25 wireless routers. They are all configured with the default credentials. Of course, I don't. Sometimes, when it's a law firm, government agency, or some other organization with tons of [other peoples] personal information, I will even call them up and let them know about it, as a courtesy. They usually tell me to take a hike. Then I can show up at their door offering my services as a 'security consultant' (for $200/hr). 'Look here' I say. 'Look how I am easily changing the settings in your router.'. That's usually about the time they wet their $400 slacks and write me a check.
I judt got a nre Kinesis keybiartf so please excusr ant egregiou typos.
nothing to see here... move along, folks
I won't believe this till netcraft confirms it...
whois gawk date unzip strip find touch finger mount join nice man top fsck grep eject more yes exit umount sleep dump
who manages to get a home router to work out of the box with no configuration? And if you're doing configuration to get your router to work, why are you not setting the password to something other than the default? Seriously, some people need a good kick in the head before they realize they shouldn't stand behind the horse.
How we know is more important than what we know.
Langfeldt's DNS how-to
In the article about how the attack works, it says that you would need to use "malicious javascript code". I was wondering... Why is javascript so important, aside from the fact that it would be required to more closely mimic most modern web sites?
If you have a home network, there are several ways to secure it. Every router that I have ever owned have several characteristics. Look for the 'reset' key, make sure it is there and not like Asante where you have to short terminals 3 and 8 on the serial port...showin my age there folks. Make sure it is a real router and not a windows appendage. Do NOT use a PCI modem that you cannot disconnect fast. Use an external modem on a SERIAL port. Do not use a combination cable modem/router. This is foisted on many users, and as a default feature sets up remote administration from the outside. That remote admin 'feature' is 'supposed to allow customer engineers to help......' you out of all your money. Don't surf as administrator if microsoftintheheady or as root if a linux penguin. Thats just askin to get hosed. Yeah, I'm a ramblin old fart, but all these things I have picked up from experience. Definitely change the default password, 'admin' or whatever on the router to something realllly strange and long. Write that password down and put it in your wallet, your wife's ring box, or whatever. Do not even try to memorize it as you will forget it when you need it. Don't use 'DHCP' that routers and network vendors want you to do. This means that all home networks are on 192.168.1.0 or some predictable net address that all hackers try first. Use a REAL network with a real address like 192.168.205.89 or something. This forces hackers to really fail many many times in guessing your network setup. With a real network, hand out your own addresses and make them random in the third and fourth hex digits so that hackers will have to guess out each and every terminal on your net. Now add MAC security to your router so that the hacker not only has to correctly guess from a crore of non standard addresses to address it, but only those with the right computer NIC can even be qualified to guess the password! Having a switch available to shut down suspects in a hurry helps too. I could go on, but if you have followed all this rambling, print it out and do it.
Will these terrible names, which apparently attempt to draw an analogy between a computer-related misdemeanor and some agricultural pastime, never end? I'm just waiting for some guy from F-Secure to call porn 'phucking'.
== Jez ==
Do you miss Firefox? Try Pale Moon.
Somebody must be buying from these companies, or they wouldn't be trying such abusive advertisement tactics. Who are these people? Are they smart enough to breed? And if so, what argument is there against sterilizing them?
Not a typewriter
Linksys would have to write in the cost of supporting all those users who have lost/misplaced the passwords or their technical support.
Quack, quack.
If you change the proxy settings on routers that have them, you could wreak all kinds of havoc, as you'd have access to all traffic, not just dns requests. Or, you could update the firmware to something custom, with all kinds of sneaky badness hidden within, including blocking future clean firmware updates.
It's a little extra work, but the companies that make these things should have unique passwords per device, or at least have logging into the admin interface wirelessly off by default. In an attempt to make things "just work" or "work right out of the box" security has suffered greatly.
Also, if people need to read one page of detailed instructions to make their new device work, it will give them at least some tiny education about security. If they can't handle that, then they can pay someone to set it up for them. There's really no excuse for openly offering up security holes this big.
--Not to be worried, Pitr fix.
LAN side MAC address, that can't be terribly hard to manufacture.
My guess: it would cost $50K in R&D, $200K in equipment costs, $0.40 in parts and $0.60 in labor/time for each unit to make this happen.
A beancounter somewhere would see that $1 as "cost we could get out of the unit".
Seriously, you could even honestly market them as "more secure."
Yes, but beancounters are called that because they can't see the big picture. Many times CEO's fit this bill.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
It seems pretty appropriate that the fake e-mail appears to come from a company called Gusanito, which literally means "little worm".
I live in Mexico, and yes, the bank name is Banamex (owned by Citibank) and this is how the hack works:
The most prominent ISP in Mexico (Telmex) uses 2wire gateway modems, most of them wireless enabled. Security is turned on by default using serial numbers so no one from outside can login "easily".
However, there is no default security from the inside, so the gusanito.com postcard contains a malicious flash program that sends a special URL to the modem that adds a DNS entry to its local name resolution table pointing www.banamex.com to a pharming site.
Next time you open IE or any other browser and open www.banamex.com you'll get redirected to the other site.
This easily solved putting a user password on the modem configuration, but not all people care to do that.
The attack can only be made within the range of the router. The infiltrator will log into the router with the default password that was NEVER changed and than setup the default location of what the user might look for. In other words, this is a planned attack, and the packet sniffing will need to watch where the user goes for online banking, shopping, or bill paying. From there, they would need to reconstruct ALL the pages just to collect the necessary data to "steal" their identity. For someone who does view the online shops frequently will notice any difference to the web pages.
Is this a new type of threat? Yes, where is it more likely to happen? In a city or dense community.
As I understand it, even with this so-called pharming technique, the bad guys still cannot correctly spoof an "https:" page... at least not without compromising the private key used to secure the SSL connection, or compromising the private key of the certificate signing authority.
When I explain to people how to use the Web, I always tell them to look for the security indicators before doing anything involving money.
P.S. I wouldn't be surprised if the bad guys here added Javascript code to their fake bank site, to rewrite the address bar of the web browser to show the "https:". This is why I prefer to do all my online banking with Javascript disabled; thank you, NoScript.
steveha
lf(1): it's like ls(1) but sorts filenames by extension, tersely
He was Australian, you insensitive clod!
"Then I can show up at their door offering my services as a 'security consultant' (for $200/hr). 'Look here' I say. 'Look how I am easily changing the settings in your router.'. That's usually about the time they wet their $400 slacks and write me a check."
So you're gonna make 'em an offer they can't refuse, huh? That's called extortion.
Gangsta-geek?
We don't cotton to no foreigners 'round these parts.
This issue is a bit more complicated than you think.
They came with a big piece of yellow tape over the power terminal and the LAN cable ports, which said "STOP. Put the CD in first, and follow the instructions on the screen."
The instructions on the screen were, predictably, written so that you could understand them if you were six. One of them was "Pick a username and password". Presto-changeo, no need for a factory default.
I don't remember the makes and models of the routers, though. They're a commodity -- I went into Best Buy and, for the first time in my life, the magically appearing salesman was actually useful. "I need a wireless router." "Size of the house?" "Small." "Here." "Thanks. My, that was easy." Commodity appliances for the win.
Help poke pirates in the eyepatch, arr.
you insensitive clod!
Because "hackers" can't run a packet sniffer and have all of that info in 30 seconds.
Security by obscurity. Great policy.
But I think they jacked it the old fashion way not with these newfangled drive-bys
Sorry for posting this here but I don't know where else to go. I'm 13 and i need some advice. I know it's full of guys here and my parents would kill me if I go on sex sites D:
I have embarassing erections all the time! I get them waking up and going to bed and all the time at school like i was talking to this girl i like the other day and i got one and i think she may have noticed! What do i do slashdot? Help!!!!
http://en.wikipedia.org/wiki/Asymmetric_Digital_Subscriber_Line
-- for Phunny.
How can a post be modded "overrated" or "underrated" when it hasn't been rated yet?
...as 'gusanito' is Spanish for "little worm".
I am not a number - I am a free man!
Symantec needs to widen it's searching.
You are confusing static addressing (which doesn't help) with choosing a less obvious IP range (which does). It's fine to use DHCP, just change the address you use to something non-default - anything in 192.168.0.0/24 or 172.x or 10.x ranges (check RFC1918) is good. That way the malware on a PC will have to scan first to know what to attack, which raises the bar slightly, although at Ethernet speeds it wouldn't take very long to scan the whole 192.168.x address range.
BTW the 'third and fourth hex digits' doesn't make sense - I guess you mean the third and fourth octets e.g. 205 and 89 in your example IP address, or the lower 16 bits of the IPv4 address.
Incidentally, IPv6 will be more secure in this respect since it uses the MAC address (or a random number) for the lowest 64 bits of the 128 bit address.
Having said all that, I just did a test of "ping 192.168.x.255" for my home LAN, and I got a nice response from only one device - the home router (DD-WRT on WRT54G)... My Ubuntu box and a Windows box didn't respond, interestingly - apparently Windows never responds to broadcast pings. Pinging 192.168.255.255 proved only that my home router and ISP don't do bogon filtering as it reached the ISP's router. Oh well...
Since broadcast pings work fine, the only question becomes how to write malware that can do a ping for this simple network discovery - the answer is a signed ActiveX control or Java applet, which is how most spyware gets installed, so that isn't too hard.
Sky do the same. Kind of.
They give you a Netgear router, and it doesn't use admin:password. Hurrah for security improvements! Instead it uses admin:sky...
Yes, it really was that basic a change! As far as I've found they don't even let normal users know how to log in and change it, I just guessed it. They also leave their SSID as one that screams "I'm a sky box" so anyone scanning for networks can even see that your password will probably be "sky".
So.
Farewell then, Heath Ledger.
Seems you were
quite
popular
down under.
I mean that
you are or were
Australian.
But the other thing is
also true.
Topically, your name was an anagram
of
Death Helger
except Helger is not a word
unless you are Swedish
and
a girl.
(Age 17 1/2)
ADSL doesn't use the normal voice band, but uses an independent higher frequency band.
What was classically called a Modem in home computers was a specific device that did modulates digital data into sound that could be subsequently carried over phone lines, radio links or more exotic means.
In this perspective the GP poster is right : ADSL is NOT such a modem because it modulates using a different frequency band thus enabling the concurrent use of both voice AND internet (or voice/data and internet if the phoneline is an IDSN one)
Otherwise by your definition (MODEM = anything that modulates/demodulates), not only ADSL should be considered a modem, but also ethernet NICs with BNC connectors, Wifi antenas, DVB recievers, sound cards, tape and disk drives, etc.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
I've seen power outages reset the settings on a router. (Yes there is a backup battery, no it doesn't always work).
Problem is if people are using wired ethernet on it, they don't realize it has been reset (still works).
Gusanito means "little worm", or maybe "wormie". I'd have thought that was a name for a trojan download site. (I'm proud to say I learned this bit of Spanish vocabulary from the label on a bottle of tequila.)
"Who controls the past controls the future. Who controls the present controls the past." -- George Orwell
The router comes with no username/password, or blank password. The router firmware can detect if it has the default password, and if so redirects all dns queries to its own admin page which is a "change your password" wizard. You don't have to configure the whole modem, but it won't operate with a default password. You can always reset if if they forget what the password is, but they won't be able to make outbound DNS queries until the password is changed.
This is one of the most basic types of attacks, I can't believe people still write code with this vulnerability. NEVER accept a request to change critical information from a GET request. Better yet, never accept any data in a URL which is expected to come from a form POST instead. Check the referrer, if it's present.
The web interface of this device was obviously written by someone with absolutely no clue.
Thanks for the good laugh...I needed it this afternoon.