Friday, February 16, 2007

Tell me something I didn't already know.

C|Net today reports that Symantec has just published some research performed by scientists at the University of Indiana that exposes a possible vulnerability of consumer routers. As King Solomon wrote in Ecclesiastes, there is nothing new under the sun. Since they came onto the market, home routers have had many a security hole. Something that many people have (myself included) have been warning about for years. However, this research simply shows a practical attack that is very simple to pull off.


In a nutshell, they put together some simple JavaScript/Java code that logs on to your router and changes your DNS settings. In doing so, attackers could say, re-route your requests to say, your banks website so that when you type in https://www.mybank.com - you are really logging in to their phishing site, and you wouldn't know the difference, as even most existing phishing filters would be fooled. (You can get a full PDF here: http://www.cs.indiana.edu/cgi-bin/techreports/TRNNN.cgi?trnum=TR641 ).


Of course, this is just scratching the surface. For example, there are certain brands of routers that use GPL'd code, and make the source code available on their websites. Are truly enterprising Hacker could - download this code, and use a similar method to upload it to replace your router's firmware. The changes could be almost invisible to the end-user, but far more malicious. Why? Think about what those attackers could do.

They could easily modify the router's code to capture and/or intercept all web traffic coming through the router. On the benign side they could, say, re-write Google's ads with their own. On the more malicious side, they could easily capture passwords, credit card numbers and more. Or find other ways of using your web viewing habits against you. They could also forgo the use of computers as 'Zombies' for DDOS attacks, and put them straight on the router. Even worse, they can make the traffic appear as if its coming from any of the PC's on your network.

What's even worse - they don't need to exploit the default password or an uprotected wi-fi network. They can simply publish their code on their website and tout that they have a
'high-performance' version of the firmware.


Granted wi-fi routers are great, and provide tremendous benefit for their owners, I hope that this research will enable manufacturers to take more steps towards securing them.

Monday, February 12, 2007

Yahoo's Big Comeback

A bunch of years ago, before I was introduced to a small project called Google, I used to use Yahoo! for my searching. It was clean, easy and relatively well organized. It also had all kinds of great free services like personals, classifieds, e-mail, etc. But then Google came along, and started to gain steam, and I like many others left Yahoo for Google.

But Yahoo!, it seems, is making a comeback. First they bought Flickr - the photo sharing site, then they announced their new mobile tools at CES - http://go.yahoo.com (which alas, isn't available for my blackberry; during CES, they also went to MacWorld, to announce their partnership with Apple on the iPhone), and now they have come up with Pipes.


While Google has come up with tons of innovative ideas lately, this one is one of the greatest I've seen of late. What is pipes? It is a very simple tool that let's you combine website data - visually. For example, pipes can take a bunch of RSS feeds, mix them together and sort them so that you get a giant super feed, without having to a lick of programming.

The potential for pipes is huge, especially because it enables developers like me to do more with less work.

It will be interesting to see how Google answers Pipes!
Go Yahoo!