Security Export to Reveal Hack that Works on Millions of Home Routers

Seismic's Craig Heffner claims he has built a tool that uses a new version of the old DNS rebinding vulnerability. This vulnerability will allow him to crack millions of routers including the ever so popular Linksys WRT54G and other popular home routers from companies like Dell, Verison Fios, D-Link, Netgear, Linksys, Belkin, ActionTec, and Asus.

Craig Heffner is planning on release the details of his hack at the up and coming Black Hat 2010 conference next week. He has already tested his hack on thirty different router models and over half of them are vulnerable to this attack. Routers running alternative firmware like DD-WRT and OpenWRT are also vulnerable.

According to Forbes “Users who connect to the Internet through those devices and are tricked into visiting a page that an attacker has set up with Heffner's exploit could have their router hijacked and used to steal information or redirect the user's browsing.” The exploit still requires the hacker to gain access the router setting which can be accessed by using a vulnerability in the device's software or by simply trying the default login password. The majority of people don't change their router logins, so concerned users should make sure their firmware is up to date and patched. Also make sure you have a password, other than the default, on the wireless as well as the router admin login.

List of tested routers