Cisco routers threatened by drive-by pharming

News Analysis

Cisco routers threatened by drive-by pharming

Bill Brenner, Senior News Writer
Cisco Systems is advising customers to change the default user names and passwords on their routers to guard against a new attack technique Symantec Corp. and Indiana University warned about last week.

Symantec and the university said millions of broadband users are at risk for a new kind of attack called drive-by pharming, which targets password weaknesses in the victim's router. Cisco released its own advisory saying that 77 of its routers are susceptible to the attack.

"To help mitigate the risks associated with the type of attack presented in the Symantec paper, Cisco recommends that any default credentials shipped with the device (username/password combinations) be completely removed," the company said.

Router related security:
How to protect against port scans

Router Expert: Why you need a network services audit

What tools can limit users' acess to applications and network resources?

Zully Ramzan, senior principal researcher for Symantec Security Response, said last week that the threat is greatest for those who don't change their default passwords after using them to bring the router online. According to an informal study by Indiana University, up to 50% of home broadband users fail to reset the password after installing their router.

"What worries me if that it's so simple for people to fall for this kind of attack," Ramzan said. "Most people connect to the Internet through broadband today, but they don't adequately protect their routers."

Attackers use this technique by luring the victim to a malicious Web site. Once the user is on that site, the attacker is able to use JavaScript to change the DNS settings on the router.

"This gives the attacker complete discretion over which Web sites the victim visits on the Internet," Ramzan said. "For example, the user may think they are visiting their online banking Web site but in reality they have been redirected to the attacker's site."

Such fraudulent sites are an almost exact replica of the actual site so the user won't likely notice the difference. Once the user is directed to the pharmer's "bank" site and enters their user name and password, the attacker can steal the information and access the victim's account to transfer funds, create new accounts and write checks.

While the threat affects mostly home users, Ramzan said enterprise environments are also at risk.

"A lot of people take their laptops home and work off their home router," he said. "One of the ways people break into networks is by stealing credentials from a compromised laptop."

His advice to users is to reset their router passwords at least once -- the day it is hooked up to the home or office computer system. If the password is changed every few months, that's even better.

Email Alerts

Register now to receive IT-related news, guides and more, delivered to your inbox.
By submitting your personal information, you agree to receive emails regarding relevant products and special offers from TechTarget and its partners. You also agree that your personal information may be transferred and processed in the United States, and that you have read and agree to the Terms of Use and the Privacy Policy.

COMMENTS powered by Disqus  //  Commenting policy