Drive-by pharming attack hits home

Whenever you type an address into an Internet browser, that address is instantly resolved into the site's numerical Internet address by a DNS server located somewhere in the world. On Tuesday, Symantec announced that online criminals have started to remotely redirect your home network router's DNS server so that whenever you type in a financial institution or other trusted site, your browser will instead be redirected to a bogus or phishing Web site.

The practice, called pharming, usually attacks the DNS servers directly, but this latest attack brings it all home (if you are using broadband connectivity). Fortunately, the routers and institutions affected by this current attack are limited to one country, Mexico, but Symantec warns that word of this real-world attack could bring similar attacks elsewhere.

Last year, researchers at Symantec and the University of Indiana reported that remotely changing a home router's DNS server was theoretically possible. The theoretical attack used Javascript on a specially crafted Web page, and affected only wireless routers. The attack in use today uses e-mail, and it can affect non-wireless routers as well.

According to a blog by Zulfikar Ramzan, a researcher at Symantec, "the attackers embedded the malicious code inside an e-mail that claimed it had an e-card waiting for you at the Web site gusanito.com. Unfortunately the e-mail also contained an HTML IMG tag that resulted in an HTTP GET request being made to a router (the make of which is a popular router model in Mexico). The GET request modified the router's DNS settings so that the URL for a popular Mexico-based banking site (as well as other related domains) would be mapped to an attacker's Web site."

The best way to prevent becoming a victim is to change your network router's default password. Default router passwords are not a secret and are available on the Internet, so if you haven't ever changed your network router's password, now is a good time. Syamntec's Ramzan further recommends performing a hard reset of your router first, just in case you are already compromised.

If choosing a router password intimidates you, Ramzan also points out that if you ever do forget your new password, you can always do a hard reset on the box in the future (something a remote hacker can't do) and choose a new password later.

[Burrens]

Update to this article

I was victim of this attack last week. Apparently a family member received one of this suspicious emails while they were in my home, on my network. While the story is correct, there are two important discrepancies.

1 - This attack is not limited to foreign routers. AT&T uses 2WIRE routers for their DSL, and U-Verse service. I am living in the U.S., and using this brand or router/gateway with their U-Verse service.

2 - This attack changes changes DNS redirection on your router even if you have replaced the router's default password. This is a security flaw that 2Wire has not addressed yet, and to my understanding it has been known for a while. Hopefully this article will pressure them into fixing it.

You can read more on my experience with this issue here:

http://www.uverseusers.com/component/option,com_smf/Itemid,2/topic,5385.0/

[jpcastro]

http://blog.trendmicro.com/targeted-attack-in-mexico-dns-poisoning-via-mode

http://blog.trendmicro.com/targeted-attack-in-mexico-dns-poisoning-via-modems/

[nesmex]

The attack overrides the password in 2WIRE modems

This attack has been reported in several occasions since late last year. The are other reports in Trend Micro's blog: http://blog.trendmicro.com/targeted-attack-in-mexico-dns-poisoning-via-modems/
It is also documented at the UNAM-CERT site (spanish only):
http://www.seguridad.unam.mx/doc/?ap=articulo&id=196
More info can be found in the US-CERT
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-4389

In Mexico neither Prodigy (Telmex), nor BANAMEX, 2WIRE have issued an official statement or a solution

[top8]

What is drive-by about this attack?

From the story it seems that somebody needs to drive by in a car, but we are talking about web site or email propagation.

[krosavcheg]

It's "drive-by" becuase...

Malicious web sites that install software on your machine without your knowledge are said to do a "drive-by download" into your computer. I suspect the author of this article is using the term in the same way. You click on the wrong link, and it reprograms your router.

[jpcastro]

Targeted Attack in Mexico: DNS Poisoning via Modems

http://blog.trendmicro.com/targeted-attack-in-mexico-dns-poisoning-via-modems/

[eduardo_mx]

2wire authentication vulnerability

http://eduardomx.blogspot.com/2008/01/2wire-vulnerability-reaches-mainstream.html

[setibeta]

One observation: there is no such place as "University of Indiana." The name is INDIANA UNIVERSITY.