Beware Home Router Hack

H

HardOCP News

[H] News
Joined
Dec 31, 1969
Messages
0
C|Net is reporting that attackers could change the configuration of home routers using JavaScript code. So, if you haven’t changed the default password, you’d better do it.

The researchers found that it is possible to change the DNS, or Domain Name System, settings of a router if the owner uses a connected PC to view a Web page with the JavaScript code. This DNS change lets the attacker divert all the Net traffic going through the router. For example, if the victim types in "www.mybank.com," the request could be sent to a similar-looking fake page created to steal sensitive data.
Click to expand...
 
Why would anyone using a router leave the password at its default !!? I changed mine to 123456 right after I set it up,for that extra bit of security and piece of mind.... :D
 
Manny Calavera said:
Why would anyone using a router leave the password at its default !!? I changed mine to 123456 right after I set it up,for that extra bit of security and piece of mind.... :D
Click to expand...

holy crap! 123456! thats the same combination I have on my luggage! :D
 
Manny Calavera said:
Why would anyone using a router leave the password at its default !!? I changed mine to 123456 right after I set it up,for that extra bit of security and piece of mind.... :D
Click to expand...

FLECOM said:
holy crap! 123456! thats the same combination I have on my luggage! :D
Click to expand...

WOW..what a coincidence...thats my ATM card PIN..
I thought for sure when I set that up it was almost too tough to guess.....
My router password is ******* no one will ever get that....:)
 
Seems pretty elaborate for a hack. they would have to know the persons bank and re-direct it to the fake site. Coincidentally all my neighbors leave the defaults.:rolleyes:
 
I got Verizon Fios last month and have my first router. Unfortunately I didn't get much in the way of directions and wouldn't know how to set-up anything. I shall have to look into this. Vista, Fios, C2D - I can't keep up these last months.
 
The really crazy part is allot of peeps use the 123456... for pin and comp pass,etc...My
wife was using a combination of that for years for her online banking,until she met me,and I got her to change her bad password habits. :D

I usually use crazy long passwords for email and comp,and especially my online bank sign in and paypal sign in stuff.If its less then 15 letters,forget it... :)
 
Crosshairs said:
My router password is ******* no one will ever get that....:)
Click to expand...

I have a client where one of the passwords is that. Can't remember how many * they use but that for some reason is one of the passwords I always forget.

Anyway most of the people I've seen use the default router passwords don't change anything elce either.
 
Haha. This reminds me of a few years ago when I visited an engineering firm in Cleveland with a friend who was friends with one of the engineers. The guy takes us into a conference room to show us a slideshow and stuff and logs onto his computer. He misses the tab key or something and his password is being typed next to his username....p...a...s...s...w... backspacebackspacebackspace "whoooops!"

...at an engineering firm :p
 
I thought everyone change their passwords. I guess I give them too much credit. I like using all zeros for my pin and, passwords by the way.
 
I've actually never changed the passwords or logins on any of the routers me or my parents have had.

But I guess when I move this weekend I shall be doing that...:D
 
Crosshairs said:
My router password is ******* no one will ever get that....:)
Click to expand...

that reminds me of a "user friendly" cartoon where they are doing tech support and they ask the guy what his password is and he sais "asterik asterik asterik asterik" and the support guy was like "!?!" and the customer was like "now, am i stupid? or just really clever?"

lol
 
Wow, so you mean people could HACK me if they know the password?!?! *sarcasm*

lol, this is a joke right....? no...?
 
Nasty_Savage said:
Seems pretty elaborate for a hack. they would have to know the persons bank and re-direct it to the fake site. Coincidentally all my neighbors leave the defaults.:rolleyes:
Click to expand...

Not really. One could make a fake version of all the major banks and just hope that you visit one of them. Being that they would then be setup as your dns, if you go to a site that the don't already have a copy of it would showup in their dns cache. Then they would be able to use that data to know which to copy to make their new sites. It might take awhile to get those not using major banks but it wouldn't have to be too elaborate, just time a little time consuming.
 
The combination in Spaceballs was not 123456, it was 1-2-3-4-5, get it right! ;) :p
 
Night_Hawk-19 said:
change password or in wireless network at least use Encription or MAC address.
Click to expand...

MAC addresses are easy to spoof, and depending on the encryption type (plus key length, which is more important), that can be broken in a matter of hours or days.
 
protias said:
MAC addresses are easy to spoof, and depending on the encryption type (plus key length, which is more important), that can be broken in a matter of hours or days.
Click to expand...

While true, if you add the following:

  • Strong router admin password
  • SSID Broadcast disabled
  • WPA2 encryption
  • MAC address filtering
It's like putting multiple locks on a door. One lock by itself may be relatively easy, but add enough, and someone will likely look for a door with no locks or one easy lock as opposed to your door that has four or five.

With security, I'd never say anything is impossible --but if you make it difficult and/or time consuming enough, someone will likely move on and choose an easier target.
 
Manny Calavera said:
Why would anyone using a router leave the password at its default !!?
Click to expand...

Its sad, but alot of people do.

http://www.wsls.com/servlet/Satelli...LS_BasicArticle&c=MGArticle&cid=1128768019035
We drove through the neighborhood. From the 70 homes in the subdivision, we found about 20 wireless signals... Only six were protected...
Click to expand...

My buddy sits on the board of the church he attends. When he was away on business training, someone on the board decided it was time to upgrade the Church's network/pc hardware. When he found out after he returned from his trip, he drove to the Church, sat in the parking lot and accessed the wireless network without any problems. Anyone War-driving could've done the same. As a matter of fact, I'm sure if you drove around your own neighborhood(s), you'd find plenty of wireless signals for networks that use the default password.
 
LoneWolf said:
While true, if you add the following:

  • Strong router admin password
  • SSID Broadcast disabled
  • WPA2 encryption
  • MAC address filtering
It's like putting multiple locks on a door. One lock by itself may be relatively easy, but add enough, and someone will likely look for a door with no locks or one easy lock as opposed to your door that has four or five.

With security, I'd never say anything is impossible --but if you make it difficult and/or time consuming enough, someone will likely move on and choose an easier target.
Click to expand...
Yup, but like I said, the key length and how often the key changes is more important than the type of encryption (this is not to say that DES is better than 3DES, but I think you know what I mean....hopefully).
NordicRX8 said:
Its sad, but alot of people do.

http://www.wsls.com/servlet/Satelli...LS_BasicArticle&c=MGArticle&cid=1128768019035


My buddy sits on the board of the church he attends. When he was away on business training, someone on the board decided it was time to upgrade the Church's network/pc hardware. When he found out after he returned from his trip, he drove to the Church, sat in the parking lot and accessed the wireless network without any problems. Anyone War-driving could've done the same. As a matter of fact, I'm sure if you drove around your own neighborhood(s), you'd find plenty of wireless signals for networks that use the default password.
Click to expand...
No, I have never done this :p My neighborhood has 5-6 wireless networks, 4 of which are unsecure.
 
of course some people dont change their default passwords. not everyone knows all this...many dont read manuals or investigate the "why's". they're scared into security

typical tho and exactly why the exploit is there
 
Want to scare someone? Show them this.

It's quite an eye-opener for anybody who doesn't take wireless security seriously.
 
My neighbors all have wireless, and all of them are wide open with the default router passwords. I am the lone exception in my neighborhood by having WEP encryption, a locked key, DHCP turned off and my username and password changed for my router.

Am I paranoid? Hell yes, I am. I will say, though, it was really convenient to have lax neighbors when my service went down for a few days, and most of them were still up.
 
You must log in or register to reply here.
Back
Top