In fact, Symantec calls it ‘drive-by pharming’ since it can be done simply by being within the router’s range (providing all of the correct variables are in place). If the router has the default password, all a hacker needs to do is look it up on the Internet (which can be done by a simple Google search), enter it in the router, and then use various redirection tactics to send the router’s users to malicious sites. The easiest solution around this? Change the default password.

Cisco Systems Inc. is warning users that nearly 80 of its routers are vulnerable to a hack tactic that got play last week.

Dubbed “drive-by pharming” by Symantec Corp. and university researchers who first publicized the danger in a paper, the attack involves luring users to malicious sites where a device’s default password is used to redirect them to bogus sites. Once they are at those sites, their identities could be stolen or malware could be force-fed to their computers.

In an advisory posted Thursday, Cisco listed 77 vulnerable routers in the lines sold to small offices, home offices, branch offices and telecommuters. The advisory recommended that users change the default username and password required to access the router’s configuration settings, and disable the device’s HTTP server feature.

The paper, co-written by a Symantec researcher and two other researchers from Indiana University (download PDF), urged a similar move by router owners.[more]

Tags: Hackers, Wireless Security