Symantec warns of router compromise
By Tom Espiner
Special to CNET News.com Published: January 24,
2008 9:10 AM PST
Security
company Symantec has warned of an attack involving the
subversion of routers.
The security company said this was the first time
it had seen such an attack "in the wild," although the concept had
been discussed a year ago
by Symantec researchers, according to a Symantec blog
post.
In the attack, which targeted
users of an undisclosed Mexican bank, the intended victims received a spam
e-mail claiming they had received an e-card, directing them to gusanto.com, a
Spanish-language e-card site. However, the e-mail also had embedded HTML image
tags that contained an HTTP get-request to the router to change its Domain Name
System settings, according to Symantec's
The HTTP get-request redirects
traffic flowing over the router to a specific IP address when the user attempts
to access six domain names that are banking-related. Symantec requested that
ZDNet UK not publish the IP address.
The attack is made possible by
a cross-site scripting vulnerability in routers made by broadband-equipment company 2Wire that was reported in August last year,
according to Symantec. Parsons said this was "a simple hack" and
advised small to medium-size businesses to change default security settings on
routers and educate users about clicking on suspicious links.
Tom Espiner of ZDNet UK reported from