Practice & Prevention of Home-Router Mid-Stream Injection Attacks Steven Myers Sid Stamm School of Informatics School of Informatics Indiana University Indiana University Bloomington, Indiana Bloomington, Indiana Email:
[email protected] Email:
[email protected] Abstract—The vulnerability of home routers has been widely In Tsow et al.[1], Stamm et al. [2], Hu et al. [4], Traynor discussed, but there has been significant skepticism in many et al.[5], and Akritidis et al. [6], it has been shown that quarters about the viability of using them to perform damaging these devices are easily susceptible to malware infection, and attacks. Others have argued that traditional malware prevention technologies will function for routers. In this paper we show how in some cases denoted specific, simple attacks [1], [2] that easily and effectively a home router can be repurposed to perform could be deployed by simply making changes to a routers a mid-stream script injection attack. This attack transparently local variables, and thus the installation of malware is not and indiscriminately siphons off many cases of user entered critical. As a result, the susceptibility of these devices is not form-data from arbitrary (non-encrypted) web-sites, including questioned. The concept of drive-by pharming proposed by usernames and passwords. Additionally, the attack can take place over a long period of time affecting the user at a large number Stamm et al. [2], has already been seen in the wild in Mexico of sites allowing a user’s information to be easily correlated by [7]; this attack only requires changing the routers DNS lookup one attacker.