CPE dns hijacking malware
Dobbins, Roland
rdobbins at arbor.net
Tue Nov 12 06:12:13 UTC 2013
On Nov 12, 2013, at 12:56 PM, Mike <mike-nanog at tiedyenetworks.com> wrote:
> It appears that some of my subscribers DSL modems (which are acting as nat routers) have had their dns settings hijacked and presumably for serving ads or some such nonsense.
How do you think this was accomplished? Via some kind of Web exploit customized for those devices and targeting your user population via email or social media, which tricked users into clicking on something that accessed the Web admin interface via default admin credentials or somsesuch; or via some direct attack on the CPE devices themselves; or via some other method?
-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>
Luck is the residue of opportunity and design.
-- John Milton
More information about the NANOG
mailing list