At first it was just an idea. Now it's a threat.
In a blog, Symantec today reported that it has spotted the first exploits using the "drive-by pharming" concept that researchers have been warning about for two years.
"The attackers malicious code could change the DNS server settings on the victims home broadband router (whether or not its a wireless router)," the company reports. "From then on, all future DNS requests would be resolved by the attackers DNS server, which means that the attacker effectively could control the victims Internet connection."
But Symantec says that attackers now are putting that idea in action. The company's researchers have spotted a rudimentary drive-by pharming exploit on the Web, redirecting traffic from one of Mexico's most popular banks.
"Anyone who subsequently tried to go to this particular banking Website (one of the largest banks in Mexico) using the same computer would be directed to the attackers site instead," Symantec says. "Anyone who transacted with this rogue site would have their credentials stolen."
The "real" exploit is actually more dangerous than the original concept because it takes advantage of routers that don't require administrative passwords, Symantec says.
"In its original incarnation the drive-by pharming attack required the attacker to correctly guess the administrative password on the victims router," the company says. "Since most people never change this password or, for that matter, even know of its existence, this measure poses little or no impediment for the attacker. So, simply changing the default password to one that is difficult to guess would have sufficed in protecting you.
"In the case of these routers, thats not true," Symantec says. "It turns out that on this particular router the attacker does not even need to try guessing the password."
In many other cases, users can protect themselves by resetting the router and using strong passwords, the company says.
Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.