'Drive-By Pharming' Now a Reality, Researchers Say

At first it was just an idea. Now it's a threat.

In a blog, Symantec today reported that it has spotted the first exploits using the "drive-by pharming" concept that researchers have been warning about for two years.

"With this sort of attack, all a victim would have to do to be susceptible is simply view the attacker’s malicious HTML or JavaScript code, which could be placed on a Web page or embedded in an email," Symantec says.

"The attacker’s malicious code could change the DNS server settings on the victim’s home broadband router (whether or not it’s a wireless router)," the company reports. "From then on, all future DNS requests would be resolved by the attacker’s DNS server, which means that the attacker effectively could control the victim’s Internet connection."

Drive-by pharming began as a concept described by researchers. Jeremiah Grossman, founder of CTO of Whitehat Security, gave a presentation about the exploit at the Black Hat conference in Las Vegas in August of 2006. Symantec subsequently blogged about the idea as well. (See JavaScript Malware Targets Intranets.)

But Symantec says that attackers now are putting that idea in action. The company's researchers have spotted a rudimentary drive-by pharming exploit on the Web, redirecting traffic from one of Mexico's most popular banks.

"Anyone who subsequently tried to go to this particular banking Website (one of the largest banks in Mexico) using the same computer would be directed to the attacker’s site instead," Symantec says. "Anyone who transacted with this rogue site would have their credentials stolen."

The "real" exploit is actually more dangerous than the original concept because it takes advantage of routers that don't require administrative passwords, Symantec says.

"In its original incarnation the drive-by pharming attack required the attacker to correctly guess the administrative password on the victim’s router," the company says. "Since most people never change this password or, for that matter, even know of its existence, this measure poses little or no impediment for the attacker. So, simply changing the default password to one that is difficult to guess would have sufficed in protecting you.

"In the case of these routers, that’s not true," Symantec says. "It turns out that on this particular router the attacker does not even need to try guessing the password."

In many other cases, users can protect themselves by resetting the router and using strong passwords, the company says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.