Slashdot Mirror
AT&T, 2Wire Ignoring Active Security Exploit [Updated]
An anonymous reader writes "2Wire manufactures DSL modems and routers for AT&T and other major carriers. Their devices suffer from a DNS redirection vulnerability that can be used as part of a variety of attacks, including phishing, identity theft, and denial of service. This exploit was publicly reported more than eight months ago and applies to nearly all 2Wire firmware revisions. The exploit itself is trivial to implement, requiring the attacker only to embed a specially crafted URL into a Web site or email. User interaction is not required, as the URL may be embedded as an image that loads automatically with the requested content. The 2Wire exploit bypasses any password set on the modem/router and is being actively exploited in the wild. AT&T has been deploying 2Wire DSL modems and router/gateways for years, so there exists a large vulnerable installed base. So far, AT&T/2Wire haven't done anything about this exploit." Update: 04/09 17:48 GMT by KD : AT&T spokesman Seth Bloom sends word that AT&T has not been ignoring the problem. According to Bloom: "The majority of our customers did not have gateways affected by this vulnerability. For those that did, as soon as we became aware of the issue, we expeditiously implemented a permanent solution to close the vulnerability. In fact, we've already updated the majority of affected 2Wire gateways, and we're nearing completion of the process. We've received no reports of any significant threats targeting our customers."
on how to walk my mom through changing her IP scheme and modify the hosts file? Do I have to go over there?
One of our competitors trademarked the term "hypothesis". From now on, we will call them "boneheaded ideas".
Me Chinese
Exploit SOCKS,
Me put malware
On your box!
my Hayes 300 laughs at you.
My roommate laughs at you through a cloud of smoke signals.
tell him to enjoy the blankets I sent
Because 300 BPS modems were TOTALLY invulnerable to attacks...
+++ATH0
I use a Speedstream 5100 too but no bloody a b or c.
Life's a tale told by an idiot, full of sound and fury, signifying nothing.
We don't care. We don't have to. We're the Phone Company.
upon the advice of my lawyer, i have no sig at this time
Perhaps if we're worried about security issues, administrating a local copy of BIND isn't the greatest plan.