If you own a wireless router....

[thewayne]

PLEASE CHANGE THE DEFAULT ADMINISTRATOR PASSWORD if you haven't already. There's a new attack going around where, if you go to a corrupt page, it launches a malicious script on your PC that tries to identify your wireless router and change the administrator password. If it succeeds, it then becomes a base layer for phishing attacks by redirecting your attempts to access financial accounts to servers under the attacker's control. In such cases, if the cloned sites are done well (and with the amount of work that this attack requires, they'll probably be done well), you may not know that you're not on your bank's web site.

There are two obvious solutions. First, make sure that your administrator password isn't the default factory setting. Second, don't go to such web sites that these attacks are launched from. Unfortunately it's not easy knowing where such sites might be lurking. I think that part of the reason that I've been virus-free for so long is that I don't go where angels fear to tread and I'm not constantly downloading programs and toolbars. But maybe I'm just lucky.

---

OK, I mis-read the article. This is a proof-of-concept, i.e., someone created this attack and proved it viable. This does not mean that it exists in the wild. Still, you should change the default password on your wireless router.

Comments

[silveradept]

Wouldn't take much at all to force the CD installer to actually connect to the router and then go through all the setup procedures from a wizard, now would it? That way, not only can you get the router set up properly, you can get it secured properly, all off the install CD.

That's for those using CDs, mind you. I'm pretty sure that routers can be set up without needing those CDs, unless my ability to do so was a fluke rather than a norm.

[annaonthemoon.livejournal.com]

You can. I think the CDs are a but pointless to be honest.