January 24, 2008 9:10 AM PST
Symantec warns of router compromise
- Related Stories
Secunia: CA backup product 'inherently insecure'January 16, 2008
If you thought 'Security '07' was hairy, just waitJanuary 3, 2008
Year in review: Botnet gains, Web 2.0 painsDecember 31, 2007
Symantec: Virtualization can ease data center woesOctober 31, 2007
Symantec, Microsoft cooperate on securityOctober 23, 2007
- Related Blogs
Symantec releases online cyber-security quiz
January 8, 2008
Two old-time tech companies ripe for picking?
January 17, 2008
The security company said this was the first time it had seen such an attack "in the wild," although the concept had been discussed a year ago by Symantec researchers, according to a Symantec blog post.
In the attack, which targeted users of an undisclosed Mexican bank, the intended victims received a spam e-mail claiming they had received an e-card, directing them to gusanto.com, a Spanish-language e-card site. However, the e-mail also had embedded HTML image tags that contained an HTTP get-request to the router to change its Domain Name System settings, according to Symantec's U.K. manager of quality assurance, Thomas Parsons.
The HTTP get-request redirects traffic flowing over the router to a specific IP address when the user attempts to access six domain names that are banking-related. Symantec requested that ZDNet UK not publish the IP address.
The attack is made possible by a cross-site scripting vulnerability in routers made by broadband-equipment company 2Wire that was reported in August last year, according to Symantec. Parsons said this was "a simple hack" and advised small to medium-size businesses to change default security settings on routers and educate users about clicking on suspicious links.
Tom Espiner of ZDNet UK reported from London.
2 commentsJoin the conversation! Add your comment