Drive-by Pharming Threat no comments
This is just in on Bugtraq.
In gist:
“An attacker can create a web page containing a simple piece of malicious JavaScript code. When the page is viewed, the code makes a login attempt into the user’s home broadband router and attempts to change its DNS server settings (e.g., to point the user to an attacker-controlled DNS server). Once the user’s machine receives the updated DNS settings from the router (e.g., after the machine is rebooted) future DNS request are made to and resolved by the attacker’s DNS server. “
– Zulfikar Ramzan of Symantec
Fact: a lot of dsl router/modems have default user/passwords. Users rarely, if ever, change them.
Think about the implication. An attacker controlled DNS server can point *insert your favorite webmail/online banking/online shopping site here* to his own mock-up of the site and no one is wiser.
