Rappy Veteran Posted February 16, 2007 Veteran Share Posted February 16, 2007 If you haven't changed the default password on your home router, let this recent threat serve as a reminder.Attackers could change the configuration of home routers using JavaScript code, security researchers at Indiana University and Symantec have discovered. The researchers first published their work in December, but Symantec publicized the findings on Thursday. The researchers found that it is possible to change the DNS, or Domain Name System, settings of a router if the owner uses a connected PC to view a Web page with the JavaScript code. This DNS change lets the attacker divert all the Net traffic going through the router. For example, if the victim types in "www.mybank.com," the request could be sent to a similar-looking fake page created to steal sensitive data. "I have been able to get this to work on Linksys, D-Link and Netgear routers," Symantec researcher Zulfikar Ramzan said. "You can create one Web site that is able to attack all routers. My feeling is that it is just a matter of time before phishers start using this." After a router's DNS setting is changed, all computers connected to the device will use the DNS server set up by the attacker to find their way on the Internet. DNS functions like the phonebook of the Internet, mapping text-based addresses such as www.news.com to actual numeric Internet Protocol addresses of a Web site. The attack works on any type of home router, but only if the default router password hasn't been changed, Ramzan said. The malicious JavaScript code embedded on the attacker's Web page logs into the router using the default credentials--often as simple as "admin" and "password"--and changes the settings. "One of the issues is that the set-up steps in the router don't prompt you to change the password," Ramzan said. As a result, many people never properly configure their networking gear, he said. In crafting their proof-of-concept attack code, Ramzan and researchers at Indiana University built upon earlier research that showed how JavaScript could be used for malicious purposes. Jeremiah Grossman, chief technology officer at WhiteHat Security, demonstrated how JavaScript let outside attackers target internal corporate networks. Grossman is impressed by the Symantec and Indiana University work. "This is very dangerous stuff and could be highly effective if used in the wild," he said. Router makers already know of the problems with default passwords as well as other security concerns, they said. Linksys, for example, recommends that customers change the default password during the installation procedure, said Karen Sohl, a representative for the company, a division of Cisco Systems. "We are aware of this," she said. On its Web site, Linksys warns users that miscreants are taking advantage of the default passwords. "Hackers know these defaults and will try them to access your wireless device and change your network settings. To thwart any unauthorized changes, customize the device's password so it will be hard to guess," the company states. Still, although Linksys' software recommends the password change, consumers can either plug in their router without running the installation disk or bypass the change screen, keeping the defaults. The company offers detailed information on how to change the router password on its Web site. Netgear and D-Link also recommend password changes. SOURCE Link to comment https://www.neowin.net/forum/topic/539405-hack-lets-intruders-sneak-into-home-routers/ Share on other sites More sharing options...
h3xis Posted February 16, 2007 Share Posted February 16, 2007 People have known this for years and it's just now making headway. Go figure. I've been beta testing dd-wrt v24 firmware for the La Fonera router for a while now and everytime I receive one to test I have to use a form to inject a script action into the router to get it to enable ssh so that I can have full access to it, since this is disabled by the manufacturer. Link to comment https://www.neowin.net/forum/topic/539405-hack-lets-intruders-sneak-into-home-routers/#findComment-588326530 Share on other sites More sharing options...
.Kompressor Posted February 16, 2007 Share Posted February 16, 2007 here's an example video of what one can do. WiFi Hustle Scam. http://www.techeblog.com/index.php/tech-ga...-scam#more-7617 Link to comment https://www.neowin.net/forum/topic/539405-hack-lets-intruders-sneak-into-home-routers/#findComment-588327102 Share on other sites More sharing options...
Berserk87 Posted February 17, 2007 Share Posted February 17, 2007 ummmmm........ *changes router pass :unsure: Link to comment https://www.neowin.net/forum/topic/539405-hack-lets-intruders-sneak-into-home-routers/#findComment-588327918 Share on other sites More sharing options...
simsie Posted February 18, 2007 Share Posted February 18, 2007 here's an example video of what one can do. WiFi Hustle Scam.http://www.techeblog.com/index.php/tech-ga...-scam#more-7617 Thats very very worrying, it seems really simple. Link to comment https://www.neowin.net/forum/topic/539405-hack-lets-intruders-sneak-into-home-routers/#findComment-588332403 Share on other sites More sharing options...
strekship Posted February 19, 2007 Share Posted February 19, 2007 Leaving the default password on these kinds of things is the same as leaving your car unlocked. Anyone can go look up what some common default passwords are. Link to comment https://www.neowin.net/forum/topic/539405-hack-lets-intruders-sneak-into-home-routers/#findComment-588332488 Share on other sites More sharing options...
morebaker Posted February 19, 2007 Share Posted February 19, 2007 Is that not the first thing you do Change the encryption to WPA2 and set the password too your own. Leaving anything at default is bad. Link to comment https://www.neowin.net/forum/topic/539405-hack-lets-intruders-sneak-into-home-routers/#findComment-588332568 Share on other sites More sharing options...
Tantawi Posted February 19, 2007 Share Posted February 19, 2007 I enjoy getting into routers with default passwords :D, and the beautiful thing is that most routers will show the model name in the login prompt, put that in Google and you get the default password :D I don't make any change though :) Another good tip is to change the web interface of your router to any other port, if it supports that feature, to anything instead of the default 80 or 8080. Link to comment https://www.neowin.net/forum/topic/539405-hack-lets-intruders-sneak-into-home-routers/#findComment-588332694 Share on other sites More sharing options...
+mrbester MVC Posted February 19, 2007 MVC Share Posted February 19, 2007 Is that not the first thing you doChange the encryption to WPA2 and set the password too your own. Leaving anything at default is bad. No, the first thing you do is turn off the WLAN as you should be connecting using the supplied cable. Then you change the password and reenable WLAN (with elevated security) if needed. Link to comment https://www.neowin.net/forum/topic/539405-hack-lets-intruders-sneak-into-home-routers/#findComment-588333484 Share on other sites More sharing options...
+Warwagon MVC Posted February 19, 2007 MVC Share Posted February 19, 2007 No, the first thing you do is turn off the WLAN as you should be connecting using the supplied cable. Then you change the password and reenable WLAN (with elevated security) if needed. first thing you do is disable wan and just connect via eithernet Link to comment https://www.neowin.net/forum/topic/539405-hack-lets-intruders-sneak-into-home-routers/#findComment-588334700 Share on other sites More sharing options...
1WayJonny Posted February 19, 2007 Share Posted February 19, 2007 why would you have not changed your default user password everyone is "admin" Link to comment https://www.neowin.net/forum/topic/539405-hack-lets-intruders-sneak-into-home-routers/#findComment-588334976 Share on other sites More sharing options...
+Warwagon MVC Posted February 21, 2007 MVC Share Posted February 21, 2007 why would you have not changed your default user passwordeveryone is "admin" now I can see why you would want to change the password, but some people might think just disable wireless or have wireless but disable being able to remote access the router over the wifi then they would think the admin password would just be used to access the router internally. Obviously this hack says otherwise. Or wait, what if you have remote access disabled, then it would be safe from this problem wouldn't it? Link to comment https://www.neowin.net/forum/topic/539405-hack-lets-intruders-sneak-into-home-routers/#findComment-588340273 Share on other sites More sharing options...
Rytis Posted February 21, 2007 Share Posted February 21, 2007 I was once sitting with my laptop nearby out city council. I tried to find a hotspot to use the net, and well, there was only one, at was named "saviv" (which is short for "city council" in Lithuanian. It of course was unsecured, so I was able to get in right away. I didn't do any damage except that I changed the default password :) Link to comment https://www.neowin.net/forum/topic/539405-hack-lets-intruders-sneak-into-home-routers/#findComment-588340292 Share on other sites More sharing options...
funkymunky Posted February 21, 2007 Share Posted February 21, 2007 Wow That video was coool what a simple but effective way. Link to comment https://www.neowin.net/forum/topic/539405-hack-lets-intruders-sneak-into-home-routers/#findComment-588340308 Share on other sites More sharing options...
thugilex Posted February 22, 2007 Share Posted February 22, 2007 video makes it look so easyyyy :) Link to comment https://www.neowin.net/forum/topic/539405-hack-lets-intruders-sneak-into-home-routers/#findComment-588341634 Share on other sites More sharing options...
+mrbester MVC Posted February 22, 2007 MVC Share Posted February 22, 2007 now I can see why you would want to change the password, but some people might think just disable wireless or have wireless but disable being able to remote access the router over the wifi then they would think the admin password would just be used to access the router internally. Obviously this hack says otherwise. Or wait, what if you have remote access disabled, then it would be safe from this problem wouldn't it? No, because the hack is run on a system inside the network. Remote access doesn't apply; in pretty much every config I've seen it is not on by default (as that's too insecure even for the router firmware suppliers to consider a Good Thing For Clueless Users To Have Automatically Enabled[tm]). Link to comment https://www.neowin.net/forum/topic/539405-hack-lets-intruders-sneak-into-home-routers/#findComment-588341645 Share on other sites More sharing options...
RuudJacobs.NET Posted February 22, 2007 Share Posted February 22, 2007 How can one turn a laptop into an accesspoint? You need more than just a simple wificard for that don't you? Link to comment https://www.neowin.net/forum/topic/539405-hack-lets-intruders-sneak-into-home-routers/#findComment-588341657 Share on other sites More sharing options...
Echilon Posted February 22, 2007 Share Posted February 22, 2007 There's very little you can do to safeguard against users who don't have a clue :/ Link to comment https://www.neowin.net/forum/topic/539405-hack-lets-intruders-sneak-into-home-routers/#findComment-588341692 Share on other sites More sharing options...
Recommended Posts