S. Stamm, Z. Ramzan, and M. Jakobsson Presented by Anh Le

Authors Sid Stamm - Indiana University - Google Intern Dr. Zulfikar Ramzan - Technical Director of Symantec Security Prof. Markus Jacobsson - Indiana University - Principal Scientist at Palo Alto RC Anh Le - UC Irvine

Outline 1. Introduction 2. Preliminaries and Previous Work 3. Drive-By Pharming 4. Demo 5. New Attacks and Recent Events 6. Conclusion and Discussion Anh Le - UC Irvine

1. Introduction  Motivation: Total control of home broadband routers ○ Phishing (by changing DNS setting) ○ Botnets (by changing firmware)  How: Attacker sets up an “evil” webpage Victim visits the evil webpage Victim’s home router is compromised No physical proximity required  Enablers: JavaScript-enabled web browsers Default password management of the routers Anh Le - UC Irvine

2a. Preliminaries  DNS: Domain Name System What’s IP of yahoo.com? yahoo.com’s IP is Client DNS server (home router) Anh Le - UC Irvine

2a. Preliminaries (cont.)  Phishing: A type of social engineering attack to obtain access credentials  Pharming: An attack aiming to redirect a website's traffic to another bogus website Anh Le - UC Irvine

2b. Previous Work Internet Detecting … … Your internal subnet is /24! 1.Internal Net Discovery [Kindermann 2003] Java Applet 2.Host Scanning [Grossman 2006, SPI Labs 2006] Java Script Fingerprint router using default password and image name Detecting … … You have a Linksys router, and its IP is ! Anh Le - UC Irvine

Outline 1. Introduction 2. Preliminaries and Previous Work 3. Drive-By Pharming 4. Demo 5. New Attacks and Recent Events 6. Conclusion and Discussion Anh Le - UC Irvine

3. Drive-By Pharming Internet DNS Setting Changed! Anh Le - UC Irvine

3. Drive-By Pharming  How is it possible? HTTP Get Configuration Off-site script inclusion How about password-protected? <script apply.cgi?dns=evil.com”> Anh Le - UC Irvine

3. Drive-By Pharming (cont.)  Assumptions : 1. JavaScript-Enabled Web Browser 2. Default Password Management  Vulnerable Routers : Netgear WGR614 D-Link DI-524 Linksys WRT54G Cisco 806, 826, … … Anh Le - UC Irvine

3. Drive-By Pharming (cont.)  Verizon [Modem + Router] MI424-WR  admin:admin Anh Le - UC Irvine

4. Demo Anh Le - UC Irvine

Outline 1. Introduction 2. Preliminaries and Previous Work 3. Drive-By Pharming 4. Demo 5. New Attacks and Recent Events 6. Conclusion and Discussion Anh Le - UC Irvine

5. New Attacks and Recent Events  New Attacks: Growing Zombies/Botnets ○ By installing evil firmware Viral Spread ○ Router auto-recruits routers  Recent Events: Kaminsky DNS Vulnerability (July 2008) ○ cache poisoning attacks on any nameserver! Router Botnets (March 2009!) Anh Le - UC Irvine

5. Conclusion and Discussion  Routers with default password management are easily compromised  Browsers as conduits of attacks to internal network  Army of router botnets Anh Le - UC Irvine