What it is
Happy 2008! And thanks to my Mom for forwarding the article on this new hack.
In a new rub on the "redirect you to malicious sites" deal, hackers have found a way – using simple javascript – to modify settings on millions of personal firewalls and routers. By visiting a page with carefully crafted javascript a malicious hacker could modify the settings on your home or business router or firewall – changing, for instance, the DNS settings to point to a DNS server with false entries. Using this method they can redirect future calls to legitimate sites to their own servers. Thus you might BELIEVE you were really logging into Paypal or your Bank – and in fact the browser might even point to the right address in the address bar – but you'd really be logging into a site in Russia that is collecting your user name and password.
While we've encouraged each of you to get a home router – we perhaps haven't placed enough emphasis on being sure that it is secure from such tampering. We highly recommend that you check your home router and be sure that the password is set to something other than the default. A password should preferably be at least 7 characters long and include varied case, at least one number, and at least one symbol.
What you should do
It's highly recommended that you discover how to change your router password and change it immediately to something other than the default. Be sure to change it to either a password you can remember, or if you feel you can't remember it – write it on a piece of tape and put that on the bottom of the router (if in a home setting). The same is true of your wireless WEP or WPA key – set it, and print it, but don't leave it at the default.
Further references
Original article from ZDNet: http://news.zdnet.com/2100-1009_22-6159938.html?tag=nl.e550
Router home pages for looking up instructions on how to reset your password:
Linksys home page: http://www.linksys.com
Netgear home page: http://www.netgear.com
dLink home page: http://www.dlink.com
Cheers,
|