Warkitting: The Drive-by Subversion of Wireless Home Routers

Searching_ _ _ · Jun 23, 2010

Until recently, the perceived risk of wireless routers has centered around unauthorized network and bandwidth use. However, as we illustrate in this paper, the risks are far greater. An open router is a gateway for eavesdropping, redirection to fraudulent websites, and trafﬁc proﬁling. These capabilities grant the attacker nearly total control over how the network’s clients interact with the Internet.
...
WAPjacking changes the settings of existing ﬁrmware to bring some beneﬁt to the attacker. While conﬁgurable parameters vary among router models and manufacturers, most routers destined for the home market allow users to select a DNS server, enable administrative access via the Internet, log usage statistics, send usage reports to an email address, and control the trafﬁc routing.

In a WAPkitting attack, external software seizes control from the router’s ﬁrmware. While most easily accomplished by exploiting open administrative access, WAPkitting can theoretically proceed by more traditional means such as buffer overﬂow.
The ability to install arbitrary control software on a wireless router opens unlimited possibilities to an attacker. Once installed, the router has the ability to tell the user one thing while doing another.
Moreover, the hardware reset button on these devices only clears the NVRAM, a small section of the memory that stores the settings registry for factory ﬁrmware but not necessarily the malicious ﬁrmware. The malicious software can detect NVRAM resets and behave accordingly. Above all, it will never let the user re-ﬂash the ﬁrmware, although it may appear to do so.
...
In particular, a WAPkitted wireless router could use race pharming to perform man-in-the-middle attacks on clients that are part of a different, but nearby, wireless network.
Click to expand...

Warkitting: The Drive-by Subversion of Wireless Home Routers PDF

Log in or Sign up

Warkitting: The Drive-by Subversion of Wireless Home Routers

Searching_ _ _ Registered Member

Log in or Sign up

Warkitting: The Drive-by Subversion of Wireless Home Routers

Searching_ _ _ Registered Member

Useful Searches