|
Router hack attack could
expose home network users
Home
network users could be vulnerable to attacks from hackers who can alter
the configuration of a broadband router or wireless access point. According
to Symantec’s researchers’ proof-of-concept, the problem stems from inexpensive
plug-and-play broadband routers. These devices are shipped from the factory
with a default password that most home users would never think to change.
Hackers, however, are aware of the risk these unchanged passwords pose,
when combined with a Web site that includes malicious JavaScript code.
The attack is twofold. First, the hacker creates a phony Web page that
includes the malignant JavaScript code. When a home user views the page,
the code, running in the context of a Web browser, uses a technique known
as Cross Site Request Forger and logs into the user’s home broadband router.
In general, these routers require a password to log into. However, as
most people do not change the default password, and detailed information
on the factory set passwords is readily available online, criminals can
successfully log into the router. The Javascript component of the attack
can only work if the router’s password has not been changed.
|