Home Network Security Scrutinised

I found the following article on the BBC news website, which happens to be exactly what I had been talking about in my presentations this week. None of the findings is surprising to me, but I find many people I talk with are in the dark about digital security. Anyway, I thought I'd write this post about it and start my own blog.

Home computer users who leave default passwords on network hardware unchanged could be at risk from attack say security experts. Researchers created an attack that surreptitiously redirects a user to nefarious sites once they have visited a booby-trapped webpage.

The attack works by re-writing the address book in network hardware to point victims to the scam sites.

About 50% of users leave default passwords unchanged, suggests research.

The theoretical attack was explored in a paper written by researchers from the University of Indiana and security firm Symantec.

In the paper, the authors detail how to compromise the routers many people use to share broadband connections between machines in their home.

Making changes to a router's set-up requires the use of an administrative password, but the researchers said informal studies suggest that about half of router owners never change the default.

Their paper shows how a booby-trapped webpage could use these default passwords and JavaScript - a technology-enabled on 95% of computers - to change a router's DNS settings.

The Domain Name System (DNS) turns the web names that humans use the numeric form that computers prefer. By compromising the router malicious hackers could make it direct people to fake address books.

Phish Pharming

These fake DNS servers could redirect users to counterfeit banking, e-mail, or government sites which then collect sensitive details like account numbers, usernames, and passwords.

Phishing attacks, where users believe they are on a legitimate site when actually connected to a bogus one, are not new. However, these schemes are usually limited to individual pages.

This method would let hackers do wholesale phishing, called pharming, by redirecting every web address to illegitimate servers that either collect information or attempt to install malicious software.

"Fortunately, this attack is easy to defend against," one of the paper's authors, Zulfikar Ramzan, said on his blog.

To protect from a pharming attack of this sort, the paper recommends that users change the default administrative password on their router.

Alternatively, they can put other DNS information into each computer on their network. Source

BBC News 16 Feb 2007