Slashdot Mirror

← Back to Stories (view on slashdot.org)

Pharming Attack Targets Home Router DNS Settings

Posted by samzenpus on from the protect-ya-neck dept.

msm1267 (2804139) writes Pharming attacks are generally network-based intrusions where the ultimate goal is to redirect a victim's web traffic to a hacker-controlled webserver, usually through a malicious modification of DNS settings. Some of these attacks, however, are starting to move to the web and have their beginnings with a spam or phishing email. Proofpoint reported on the latest iteration of this attack, based in Brazil. The campaign was carried out during a five-week period starting in December when Proofpoint spotted phishing messages, fewer than 100, sent to customers of one of the country's largest telecommunications companies.

39 comments

  1. Word Overloading: by Hartree · · Score: 3, Informative

    In the life sciences, "Pharming" is using genetically engineered animals, like goats, to produce proteins or other substances, (especially those with pharmaceutical applications).

    Example: Genetically engineered goats that produce spider silk proteins in their milk that can then be extracted from it.

    see: http://www.bbc.com/news/scienc...

    (Warning, possible auto-play)

  2. Passwords again... by houstonbofh · · Score: 5, Insightful

    "They also try to brute force the admin page for the router using known default username-password combinations."

    About time to force manufactures to not have "default" passwords. If 2wire can do it on their amazingly cheap crap, so can others.

    1. Re: Passwords again... by Anonymous Coward · · Score: 0

      Too many people complain when they don't have defaults to use and I have seen people unable to understand looking on the bottom of the router to read the sticker.

    2. Re: Passwords again... by Anonymous Coward · · Score: 1

      Then have a $3.99 per minute support line. They'll learn fast.

    3. Re: Passwords again... by SeaFox · · Score: 1

      Too many people consider this their ISP's job, regardless of where the router came from.

    4. Re: Passwords again... by Anonymous Coward · · Score: 0

      The randomized "default" password is written on the device, typically near the serial number. This is safe because if you have such intimate physical access to the device, you can just write new firmware on anyways. However, remote sites are unable to figure out what the password is. If you are "smart" enough to own a router, you are also smart enough to at least flip it over when you're confused about it.

    5. Re: Passwords again... by Anonymous Coward · · Score: 0

      Too many people are simply too stupid to be allowed anywhere near a computer, too.

  3. Sounds a lot like what I saw last week by msobkow · · Score: 4, Informative

    At the beginning of last week, I saw a number of fake emails "returned" to my ISP email account. A day or two later, I received a phishing email requesting me to change my password for that email account.

    Today, someone tried the same thing for my Microsoft account.

    It's more creative than usual, but it is still just a phishing attack, and you can easily spot it by the fake URLs in the phishing emails.

    --
    I do not fail; I succeed at finding out what does not work.
    1. Re:Sounds a lot like what I saw last week by Qzukk · · Score: 2

      The problem is that if they manage to get your DNS settings changed, they can use real URLs in the phishing emails.

      --
      If I have been able to see further than others, it is because I bought a pair of binoculars.
    2. Re:Sounds a lot like what I saw last week by Anonymous Coward · · Score: 0

      Any URL that begins with http:// is a phishing URL.

    3. Re:Sounds a lot like what I saw last week by Anonymous Coward · · Score: 0

      OK, how would that work? They send you a phishing email trying to get onto your router. You spot the fake URLs. They can't use real URLs until AFTER they control your DNS. Classic catch-22.

    4. Re:Sounds a lot like what I saw last week by Anonymous Coward · · Score: 0

      The problem is that if they manage to get your DNS settings changed, they can use real URLs in the phishing emails.

      If they get control of your DNS, they don't need to send you a phishing email.

      As for this article, this sums it up nicely: "Pharming attacks are generally network-based intrusions where the ultimate goal is to redirect a victim's web traffic to a hacker-controlled webserver, usually through a malicious modification of DNS settings."
      The word you are looking for is MiTM which stands for Man in The Middle. I've been around a long time and 'pharming' isn't Lingo for anything other than someone trying to sound all tecchy and smartlike.

    5. Re:Sounds a lot like what I saw last week by Anonymous Coward · · Score: 0

      Someway,somehow they exploit person X and have control of their computer.

      They send an email to everyone on person X's address book. Repeat for every victim.

      Finally, someone you know is exploited, and you get an email from your friend/brother/coworker. You open it and it's a legitimate link to a legitimate website with a lot of periods below it. You click the link and the site starts trying to pwn your browser. What happened?

      Many clients show images in emails by default. Of the ones that don't, most only block them if the sender isn't in your addressbook. So you opened an HTML email consisting of hundreds of <img src="http://admin:admin@192.168.0.1/setdns?ip1=54.22.88.19&ip2=54.22.88.19" alt="."> tags covering all the major routers and default accounts, one of which happened to be yours and the nameserver at 54.22.88.19 is redirecting requests to that site to a malware host.

      or... it doesn't work and you're not infected. The average botnet herder doesn't care about you personally.

    6. Re:Sounds a lot like what I saw last week by CaptainDork · · Score: 1

      It's obvious to those who do, that you don't know what the hell you are talking about.

      --
      It little behooves the best of us to comment on the rest of us.
    7. Re:Sounds a lot like what I saw last week by CaptainDork · · Score: 1

      I sure agree with the, "pharming," term. How silly.

      --
      It little behooves the best of us to comment on the rest of us.
    8. Re:Sounds a lot like what I saw last week by tlhIngan · · Score: 1

      At the beginning of last week, I saw a number of fake emails "returned" to my ISP email account. A day or two later, I received a phishing email requesting me to change my password for that email account.

      Today, someone tried the same thing for my Microsoft account.

      It's more creative than usual, but it is still just a phishing attack, and you can easily spot it by the fake URLs in the phishing emails.

      Actually, the first is a standard joe-job where they fake the From address. Obviously your ISP isn't using SPF to whitelist the servers that could send the email allowing spammers to use your email as the From address and you're seeing the bounces. Just be lucky most servers don't actually obey the RFC anymore and don't send bounces or other error failed messages because a joe-job like that could easily net you 1000+ bounce replies.

      The second I get a lot around the new years and september - basically when school gets back in session so it appears spammers phish the freshmen into giving up their email information. I know they're spam because they're sent to a few email addresses I've never used other than as a honeypot. Oddly, my legit email address gets far less spam than the honeypots

    9. Re:Sounds a lot like what I saw last week by msobkow · · Score: 1

      Ah, yes, my ISP with over 25 years experience servicing hundreds of thousands of customers with over five million email addresses clearly doesn't know what they're doing.

      It couldn't possibly be that the people behind the phishing attacks are custom-crafting the address chains in the fake "delivery failure" messages. Oh, no, it's clearly my ISP at fault because this is the only time this has happened in over 15 years of using them.

      I sure hope you aren't responsible for securing anything more important than your home PC...

      --
      I do not fail; I succeed at finding out what does not work.
  4. Not even by Billly+Gates · · Score: 4, Insightful

    Just Compromise an adserver with A flash exploit and You Can 0wn Tens Of thousands within hours.

    Whoever thought to run executables on random websites was a good idea? More proof adblock not user education is needed for security. Gone are the days of not clicking meant secure

    --
    http://saveie6.com/
    1. Re:Not even by Anonymous Coward · · Score: 0

      Remove the proprietary software and disable jabvascript. You may also need to disable a few other things like png files.

    2. Re:Not even by Anonymous Coward · · Score: 0

      Just install Scissors and be done with it... http://www.dumbentia.com/pdflib/scissors.pdf

    3. Re:Not even by Anonymous Coward · · Score: 0

      More Proof that NoScript is the better solution as AdBlock has sold out and become a Commercial Product

    4. Re:Not even by Anonymous Coward · · Score: 0

      Doesn't work on wireless though.

      Captcha: dialup

  5. Pharming? by Anonymous Coward · · Score: 1

    "Pharming attacks are ..." yet another stupid buzzword that some guy with a marketing degree thought was cute. For fuck's sake, just call it what it is, traffic redirection, or perhaps traffic hijacking. Everyone will understand just fine. "Pharming" (or farming) doesn't even make any sense in this context. If you insist on coming up with a new name for everything, I heard The Weather Channel is hiring.

    1. Re:Pharming? by arth1 · · Score: 1

      Incidentally, I thought this feeble exploit attempt was called "pharming" just so the author could feel justified in calling the next and bigger one "pharmageddon".

      I'm personally glad for all these fishing attacks and exploits relying on a human element. With the lack of other predation lately, they're sorely needed to cull the human genome. Presumably enough idiots will lose enough on this that it allows for a mild selection for those with more sense.

    2. Re:Pharming? by Dutch+Gun · · Score: 1

      "Phishing" actually makes a bit of sense, as in an attempt to snare victims with a false lure of sorts, such as a phony website. "Spear phishing" is a logical extension of this, a very directed phishing attack made at a particular company, or even a specific person, used to gain corporate access. I thought those were sort of clever, and gave us an accurate way to describe those very common attacks.

      This one... yeah, not so much.

      According to Wikipedia:

      The term "pharming" has been controversial within the field. At a conference organized by the Anti-Phishing Working Group, Phillip Hallam-Baker denounced the term as "a marketing neologism designed to convince banks to buy a new set of security services". Scott Chasin, a former CTO of McAfee and founder of email security firm MX Logic, coined the term in 2005.

      Let's just call it what it is: a specific type of phishing attack.

      --
      Irony: Agile development has too much intertia to be abandoned now.
    3. Re:Pharming? by Anonymous Coward · · Score: 0

      Let's just call it what it is: a specific type of phishing attack.

      It's known as DNS hijacking and/or a Man In the Middle attack, depending on the methods employed.

    4. Re:Pharming? by CaptainDork · · Score: 1

      Totally.

      --
      It little behooves the best of us to comment on the rest of us.
  6. Check HOSTS For Security Vendors by Guy+From+V · · Score: 2, Interesting

    Just make sure your hosts file isn't populated with a random bunch of known security software vendors' names like eset, trendmicro, kaspersky, avira or some shit with a loopback to your local before them. I've seen some really screwed up hostfiles on my friends' PCs that look like that. I just trash them in favor of one of the well-known complete hostfiles that some dudes keep updating around the web ...I forget the names of the websites and authors...so...y'know...this advice is a big help lol. I'm sure someone remembers on here...

    1. Re:Check HOSTS For Security Vendors by Anonymous Coward · · Score: 0

      Oh great, you've summoned him.

      P.S.=>

    2. Re:Check HOSTS For Security Vendors by Anonymous Coward · · Score: 0

      hosts mvps: Blocking Unwanted Connections with a Hosts File

    3. Re:Check HOSTS For Security Vendors by Guy+From+V · · Score: 1

      Yes, this is one of 'em. Word.

    4. Re:Check HOSTS For Security Vendors by BitZtream · · Score: 1

      your computer thinks 0.0.0.0 is itself

      Yea, that's a good site to trust to tell me about networking ... One that has no idea what so ever what it's talking about.

      --
      Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
  7. JS with net access behind the firewall by Anonymous Coward · · Score: 0

    hmm, if a web page's JS asks to visit the gateway's home page, then it can log in with the default pass.
    Note to self, put an actual pass there.
    My bad.
    As ususal, bugs are obvious after you see them.

    GIven a gatway log in, the web page can pretty do whatever it wishes.
    Adjust DNS to a more hacker frienly sequence, sure.
    Permit remote configuration, sure.
    Update the code to a more friendly codebase, sure.
    Mirror my traffic to Utah, sure.

    One doesn't usually think about protecting things behind the firewall, but if useful web pages include the ability to run code with net acccess, then things behind the firewall are not necessarily friendly. Seems like, for Joe six pack, this web secure thing is fundamentally broke. For someone with a clue, fixable, but broke out of the box.

    1. Re: JS with net access behind the firewall by Anonymous Coward · · Score: 0

      Unless you have one of the recent Netgear routers that hand over your admin password to anything on your network that asks for it. No matter what you set your password to, the JS can get into your router and change your DNS settings. And still no firmware update to fix it.

  8. I make sure of that by Anonymous Coward · · Score: 0

    "Just make sure your hosts file isn't populated with a random bunch of known security software vendors' names like eset, trendmicro, kaspersky, avira or some shit with a loopback to your local before them." - by Guy From V (1453391) on Sunday March 01, 2015 @02:35PM (#49159449) Homepage

    By whitelisting in APK Hosts File Engine 9.0++ SR-1 32/64-bit http://start64.com/index.php?o... vs. adding these as FALSE POSITIVES:

    1.) AntiVirus vendors
    2.) AntiMalware vendors
    3.) AntiSpyware vendors
    4.) Firewall vendors
    5.) Search Engines
    6.) Security Blogs &/or websites
    7.) OS Updaters
    8.) Program Updaters (per the 1st 4 above)
    9.) AntiSpam sites
    10.) AntiPhishing sites
    11.) Developer pages
    12.) Email login pages
    13.) Major Portals

    (etc. - et al)

    * It just works vs. blocking them erroneously...

    APK

    P.S.=> It's one of the features I added in the "SR-1" (service release 1) this round... apk

  9. AdBlock = Inferior + 'Souled-Out'... apk by Anonymous Coward · · Score: 0

    APK Hosts File Engine 9.0++ SR-1 32/64-bit:

    http://start64.com/index.php?o...

    FREE & adds speed, security, + reliability, doing more with less, more efficiently vs. addons + fixes DNS' redirect security issues:

    ---

    A.) Hosts do more than:

    1.) AdBlock ("souled-out" 2 Google/Crippled by default http://techcrunch.com/2013/07/... & ABP too http://finance.yahoo.com/news/... )
    2.) Ghostery (Advertiser owned) - "Fox guards henhouse" http://en.wikipedia.org/wiki/G...
    3.) Request Policy -> http://yro.slashdot.org/commen...

    B.) Hosts add reliability vs. downed/redirected dns (& overcome site redirects e.g. /. beta).

    C.) Hosts secure vs. malicious domains too -> http://tech.slashdot.org/comme... w/ less "moving parts" complexity

    D.) Hosts files yield more:

    1.) Speed (adblock & hardcodes fav sites - faster than remote dns)
    2.) Security (vs. malicious domains serving malcontent + block spam/phish & trackers)
    3.) Reliability (vs. downed, Kaminsky redirected (99% ISP DNS' = unpatched vs. it), DGA, Fastflux, & dynDNS botnets)
    4.) Anonymity (vs. dns request logs + dnsbl's).

    ---

    * Hosts do more w/ less (1 file) @ faster levels (ring 0) vs redundant inefficient addons (slowing slower ring 3 browsers) via filtering 4 the IP stack (coded in C, loads w/ os, & 1st net resolver queried w\ 45++ yrs.of optimization).

    * Addons = more complex + slow browsers in messagepassing (use a few concurrently & see) & are nullified by native browser methods - It's how Clarityray's destroying Adblock.

    * Addons slowup slower usermode browsers layering on more - & bloat RAM consumption + excessive cpu use too (4++gb extra in FireFox https://blog.mozilla.org/nneth...)

    (Instead, work w/ a more capable native kernelmode part you already have - hosts (An integrated part of the ip stack))

    APK

    P.S.=> "The premise is quite simple: Take something designed by nature & reprogram it to make it work for the body rather than against it..." - Dr. Alice Krippen: "I am legend"

    ...apk

  10. Ask yourselves these questions... apk by Anonymous Coward · · Score: 0

    Can adblock do 16 things hosts do for speed, security, & reliability:

    1.) Protect vs. malicious sites/servers (beyond malicious ads: See 2-10 next)
    2.) Protect vs. fastflux botnets + stop communication to C&C servers
    3.) Protect vs. dynamic dns botnets + stop communication to C&C servers
    4.) Protect vs. DGA botnets + stop communication to C&C servers
    5.) Protect vs. downed DNS (adds reliability)
    6.) Protect vs. DNS redirect poisoned dns
    7.) Protect vs. trackers
    8.) Protect vs. spam
    9.) Protect vs. phishing
    10.) Protect vs. bandwidth caps
    11.) Get you past a dnsbl
    12.) Keep you off dns request logs
    13.) Speed up websurfing by adblocks & hardcoded fav. sites
    14.) Work on ANY webbound app (think stand-alone email programs) multiplatform.
    15.) Give you easily texteditor controlled data for the above
    16.) Do all that & block ads (better than addons) more efficiently in cpu cycles + memory usage

    * ANSWER ="NO" to each above on AdBlock doing it as well or at all!

    APK

    P.S.=> AdBlock does FAR less than hosts do & FAR less efficiently - hosts by way of comparison, do MORE w/ less + Hosts start w/ the IP stack before REDUNDANT inefficient addons BEGIN to operate (as 1st resolver queried):

    AdBlock's 4++gb & 100% CPU usage flooring inefficiency -> https://blog.mozilla.org/nneth... + ClarityRay defeats it + it 'souled-out' & is crippled by default paid off to not do its job http://techcrunch.com/2013/07/... & ABP too http://finance.yahoo.com/news/...

    AdBlock adds complexity/room for breakdown/exploit + from a slower mode of operations (usermode = more messagepassing overheads vs. hosts in kernelmode).

    For the BEST hosts file?

    APK Hosts File Engine 9.0++ SR-1 32/64-bit -> http://start64.com/index.php?o...

    MalwareBytes' hpHosts Admin (MalwareBytes employee) hosts & recommends it -> http://hosts-file.net/?s=Downl... & MalwareBytes = BEST antivirus http://www.av-test.org/en/news...

    ... apk

  11. I asked AdBlock's creator those questions... apk by Anonymous Coward · · Score: 0

    Result? W. Palant RAN after he wrote me by email 1st saying "hosts are a shitty solution" to which I replied:

    "Show us adblock can do more for added speed, security, reliability, & anonymity than hosts can, + that adblock does it more efficiently than hosts"

    Which on my latter 'point-in-challenge' on efficiency AdBlock's proven by research to be MASSIVELY inefficient -> https://blog.mozilla.org/nneth... & adblock does FAR less than hosts (especially crippled by default).

    I sent Wladimir Palant that challenge in response to his statement from 2 different email addresses I use!

    Result = Still no answer from him in regard to my challenge put to him to this very day MONTHS later - that tell you anything? It did me!

    He knows his addon is less efficient & features laden by FAR vs. hosts - Wladimir Palant RAN like a scared rabbit!

    ClarityRay's also DESTROYING AdBlock - via native browser methods to DUMP what addons you use (it can't DO THAT to hosts files).

    I only tell it how it is on hosts' superiority vs. AdBlock - Funny part is, Wladimir Palant running does too!

    Especially considering "Almost ALL Ads Blocked" has 'souled-out' -> Google & Others Pay Adblock Plus To Show You Ads Anyway: http://news.slashdot.org/comme... & ABP too http://finance.yahoo.com/news/...

    APK

    P.S.=> Bottom-Line: Hosts = a superior solution that also fixes DNS redirect security issues (vs. browser addons & their inefficiencies + messagepassing overheads as well as myriad lack of abilities hosts have from 1 file that's part of the IP stack itself - faster, more efficient, & less redundant as well, since TCP/IP has 45++ yrs. of refinement & optimization in it, & runs in a higher CPU serviced ring of privelege & operations in kernelmode vs. slower usermode layering over browsers slowing them more, & hosts = 1st resolver queried by the OS itself also)... apk