Researchers at Symantec are warning users that if they haven't changed the default password on their home wireless router, they should finally just DO IT.
Symantec's Zulfikar Ramzan issued a warning Thursday that hackers are lacing phony Web sites with malicious code that actually will log into and mess with your home broadband router. He's coined a term for it: Drive-By Pharming."I believe this attack has serious widespread implications and affects many millions of users worldwide," wrote Ramzan in his blog on Symantec's Security Response Weblog Thursday morning. "Fortunately, this attack is easy to defend against, as well." Now, here's the thing. How long have security types been telling us to be smart about our passwords, whether the passwords are for our laptops, our smartphones, or our home routers? It's not a new call to arms. But, obviously, it's one we all need to hear again.
Once they mess with your router, the attackers have control over it, allowing them to direct you and your browser to whatever Web sites they choose. You may want to go to, say, Hack in the Box but, instead, you'll go to whatever site they want to send you to. (For more technical details about the attack, check out Ramzan's blog.)
Think about it. That could be bad. If you have kids using your home computer, do you suddenly want a hacker in charge of what Web site they're going to? It also can be dangerous. You could be surreptitiously diverted to another fraudulent Web site where you might divulge personal financial information, be infected by another round of Trojans, or unknowingly hand out critical company information.
So, it's another reminder to be smart about our passwords. I, myself, could be smarter about them. I'm trying but I still need to be better. Ramzan's warning serves as a good lesson about a new kind of attack, and a good reminder.