Scammers Hijack SOHO Routers to Steal User Information

Internet, Office IT, Office Network, Repairs and Upgrades, Security, Services, , , , , , , , ,
06
Apr 2014

TL-WR1043ND-01

TP-Link is among the vendors affected by the SOHO pharming campaign.

Recently, it was discovered that several hundred thousand routers fell victim to a hijacking scheme that could become a prevalent problem to many internet users worldwide.  The attack, dubbed as a ‘small office/home office (SOHO) pharming campaign,’ was targeting Vietnam, but according to a report by Team Cymru, the SOHO pharming campaign also made its way into regions like the US and Italy.

The criminals behind the pharming campaign took advantage of exploitable security holes in various consumer-grade routers, and from there they were able to redirect users to malicious websites to steal login credentials and/or dropped malware onto the users’ computer.  The scary part about this SOHO campaign is that more than one type of routers are affected.  According to Team Cymru, the compromised routers could be a brand name like D-Link or and off-brand like TP-Link.

soho-hijack

A diagram depicting the ‘man-in-the-middle’ hijacking scheme from Team Cymru.

Cyber security experts found that once the attackers had control of their targeted routers, they changed the devices’ Domain Name System (DNS) settings to force users to send out requests to the 5.45.75.11 and 5.45.75.36 IP addresses.  The new DNS settings then acts as a ‘middle-man’ and redirect users to malicious sites instead of legitimate ones.

While it is easy to point the fingers directly at the people manufacturing the routers, it’s not completely their fault.  There’s no such thing as a ‘hands-off’ policy when it comes to protecting yourself from intrusions by cyber criminals.  That said, there are a few things many router owners can do to lessen their chances of becoming victims to the router hijacking scheme.

  1. Disable router’s remote user-mode and graphical user interface. Disabling remote access will help keep users who aren’t directly connected to your network from accessing your routers’ admin properties.  Disabling the GUI will, reportedly, mitigate the likelihood that someone can find a hole in the routers’ software.  Instead of making changes to the routers’ setting via a graphical interface, try to change the settings via command lines.
  2. Corporate networks may want deploy tracking systems (i.e. an HTML code on the externally facing servers) to detect possibly malicious IP addresses.
  3. All SOHO router settings (especially DNS) should be controlled at the host level.
  4. Admins must proactively monitor router settings periodically to ensure that the router’s DNS is pointing at those that belong to their internet service providers (ISP).

These are just a few of the basic security measures you must consider if you or your organization is using a SOHO router.  Should you have any questions or concerns regarding the recent SOHO pharming campaign or what you should do tighten up your network security, contact our IT professionals.

Read More

Target estimates 1 in 5 Americans may be affected by recent security breach

Security,
14
Jan 2014

target_front_entrance

In mid-December Target disclosed that hackers broke into the company’s computer system and stole several millions of its members’ personal information.  A month later and Target has just tripled the number of people that might be affected by the security breach.

It’s Okay to Shop, But Be Wary of Who You Give Your Information to

According to Target’s latest revision, the recent security breach might affect one out of every five Americans—that is, roughly 70 to 110 million are susceptible to identity theft.  The data stolen from Target’s database range from email addresses to credit card numbers, so the magnitude to which one’s identity is compromised will vary.

Given that the recent Target debacle gave hackers just bits and pieces of information on people’s financial data, the ensuing aftershock should not be as bad as some might predict.  Target, to its own credit, has been proactive about mitigating the damages that its customers have or will experience because of the security breach.  The company, and affiliating banking institutions, has reached out to members by issuing them new account numbers and credit cards.

Finders Keeper, Losers Weepers

Security experts, however, predict that the fraudulent activities that coincide with such a huge security breach will be an everlasting one if consumers don’t take matters into their own hands.  Information such as emails and phone numbers can, if left in the hands of experienced cyber criminals, be used as tools to indirectly steal more personal information.  When all the pieces of a person’s identity is pieced together, thieves can easily access their target’s banking accounts and make off with the loot with just a click of a mouse.

Hackers Grab 40 Million Accounts From Target Stores

So what can you, as a consumer—especially if shop at Target, do to protect yourself if your personal information linked to a company like Target?  First, check your banking statements for any unusual activities, and if something out of the ordinary occurs report it immediately to your financial institution.  Next, Target members with a credit/debit card on record need to contact the company to make sure that the account number is completely erased from the database.  As an extra preventative measure, take yourself off Target’s database completely—that is, make sure Target does not have your email, phone number, home address, etc.

There’s not much you can do once your personal data has been stolen from you, but what you can do is try to plug in the holes while you still can.  Security analysts and firms that monitor the World Wide Web for activities regarding the intrusion and manipulation of peoples’ personal data saw a huge spike in black market activities since the breach occurred.  Since most average consumers have no means of tracking down cyber criminals or stop their malicious activities, it’s up to the local authorities and banking institutions to stop them from draining out a bank account.

Bullseye!

Target is working closely with private and government security/forensic experts to close up some of the holes, but only time will tell if people can once again trust the Target brand.  One could say that it was a bad omen for Target to choose a bullseye for its logo as that image has mutated into a double edged sword.  On one end, the retailer flourished as consumers flocked to the red buildings to make purchases, and at the same time gave away their personal information.  On the other end, the bullseye also became an attractive target for hackers and cyber criminals, evident by the recent security breach.

For more details about security issues that can affect you or your business, contact your office IT support.

Update:

Target is offering customers affected by the breach 1 year of free credit monitoring.  Sign up here.

Read More

Check Your Network: Linksys and Netgear Vulnerable

Internet, Security, , ,
13
Jan 2014

A Common Netgear Wireless Router. Model DG834G.

A Common Netgear Wireless Router. Model DG834G.

A number of Linksys and Netgear DSL modems have been found to be exploitable via a simple hole in the components’ firmware.

How Was This Discovered?

Eloi Vanderbeken recently took up the task of reverse engineering his Linksys WAG200G wireless DSL gateway’s firmware.  At first he did it just for kicks, but during the process he found out even brand name tech components are just as vulnerable to hackers as off-brand products.  Vanderbeken found out during his self-imposed hack-a-thon that his WAG200G DSL gateway was accessible to hackers via an undocumented port.

After Vanderbeken toyed around with the Linksys firmware, he was able to come up with a simple interface that allowed him to send various commands to the gateway without administration authentication.  At first, Vanderbeken found that he couldn’t do much with the interface besides resetting the gateway to its factory settings.  However, as he delved deeper into it, he found that he could inject some home-brewed command lines into the interface.  These simple code injections allowed him to gain control of certain administrative properties using a wireless connection, and to reset the gateway’s web password.

How To Check if Your Are Affected

People interested in the hack and are tech savvy enough can check out Vanderbeken’s published work on Github.  Would-be hackers can do a few things with the script.  Firstly, Vanderbeken only hacked his router because he wanted access to his router’s web console without having to input the admin password—which he forgot.  So if you are the proud owner of these selective devices, you can be assured that they’re hack-able to both you and others with malicious intents.  Chances are most people will rather reset their gateways the easy way by pressing the little red reset button on the back of their device using a pen tip.  People looking for an adventure into the world of coding, however, might actually test out the scripts to see if their highly secured network is bulletproof or not.

Eloi Vanderbeken's bruteforce code to test the vulerability.

Eloi Vanderbeken’s bruteforce code to test the vulerability.

Another thing to note is that the backdoor vulnerability in these LinkSys and Netgear components are only assessable locally.  Meaning, a hacker would have to be in range of your Wi-Fi network for them to compromise your network and personal data.

What Should I Do If I Am Affected?

Quite frankly speaking, unless your neighbor or a passerby knows exactly the type of router you’re currently using, they won’t bother to attempt to hack your network.  The easiest solution, if you happen to own one of these vulnerable devices, is to name your wireless network something other than the router’s brand and model.

Often times, the routers come shipped with preconfigured settings which use the brand or model as the default wireless network name.  If that is the case, simply log into your router, and change the network’s name.  Next, you may also want to upgrade the product’s firmware, but keep in mind that different manufacturers have different firmware upgrade requirements.  Check your product manuals or website before attempting to upgrade firmware, because one wrong move can render your router unusable.

If you need further help, contact your office IT support.

Read More

Quickly Check If You’re Email Was Breached

Uncategorized,
06
Jan 2014

OnsitePCSolution_Have_I_Been_Pwned

Recently, eight major websites have had security breaches where attackers got access to user’s email addresses, user names, passwords and various other personal information. Some of the sites include:

  • 152,445,165 Adobe Accounts
  • 4,609,615 Snapchat Accounts
  • 453,427 Yahoo Accounts
Adobe is among some of the recent companies to have security breaches.

Adobe is among some of the recent companies to have security breaches.

Finding out whether one of your accounts or emails were a part of the breach has been difficult to do until now. Newly created website https://haveibeenpwned.com/ lets you type in your email address or username and will check if your account was compromised.

If your account has infact been compromised, the best thing to do is to change your password immediately.  If you are not sure what steps to take, contact your office iT support.

Read More

Keeping Your Website Safe and Clean

Internet, Security, ,
03
Nov 2013

OnsitePCSolution_Main_Image_v1

 

Your website is crucial in helping the rest of the world to find your service or to learn more about you.  As more websites are built on WordPress allowing you to easily manage your site pages, blog and online stores, it has become a target of criminals.  In this article we will cover why it’s important to avoid free premium WordPress themes.

I have a website, what’s the problem?

If you have recently (in the last several years) had your website updated or created, there is a good chance  your main website or a sub section such as the blog is running WordPress.  The best way to check if WordPress is being used is to ask the person that designed your website.

 

Onsite_PC_Solution_wordpress-logo

 

A theme is then used to change the layout, colors, fonts and general look and behavior of your site.  Themes can either be free, or premium where you pay for more features, updates and typically support.  Since premium themes cost money, some people decide to do a quick Google search to find the premium theme for free.

Premium themes that are quickly available over Google can contain malicious code that will infect your website, and as a result anyone that visits your website.

What happens if my site is infected with malicious code?

Once your site has been infected, the malicious party can then run programs and code on your website.  This not only puts your website at risk but also puts your website visitors at risk.  Your website can also be flagged for malware by Google.

Snippet_of_malicious_code

A snippet of malicious code as described by Sam Parkinson in his blog post on the details of pirating premium WordPress themes

How can I keep myself safe?

The next time you talk to your website designer, ask them these questions:

1. Is my website running WordPress?

2. Is the theme of my website free or premium?

3. If it is premium,  where was it downloaded from and paid for?

If the site runs WordPress and a premium theme, make sure it was paid for and downloaded from the theme designer’s official webpage, or from the official WordPress premium theme site.

Also, as mentioned in this article, ask your website designer to disable dangerous functions that are not being used on your site as explained here.

We always recommend giving your office or home IT support all of the details so they can keep track of and inventory potential risks to your business as well.

Read More
1 2 3 4