Cisco Says 77 Routers Open to 'Drive-By Pharming'

PC World ^ | uesday, February 20, 2007 | Gregg Keizer, Computerworld

[xcamel]

this isn't good...

[doc1019]

Considering that Cisco is the Internet … you are right, this is not good.

[flashbunny]

somebody call al gore, quick!

[Slump Tester]

"Owners of home routers who set a moderately secure password -- one that is non-default and non-trivial to guess -- are immune to router manipulation via JavaScript," the report read.

So be a smart shopper, and for about $20 or so you don't need to worry.

[doc1019]

?

[sigSEGV]

Hype from a "security" company. This is hardly anything new. Anybody running an HTTP interface on their router with a default password is probably already hacked anyway.

[Sender]

Speaking of Cisco/Linksys routers, what could cause a new router to repeatedly drop the DSL connection about every minute? It connects, authenticates, lets me view a couple of web pages then DSL link fails. I also get a brief popup in Windows "a network cable is unplugged". Then it reconnects. Over and over.

I got new network cables, tried all sorts of config settings, can't get it to stay online. Everything works fine without the router. My ISP and Linksys tech support were not so good. ISP said "not us, call Linksys" and Linksys said "gee, I dunno, maybe it's a bad router."

[xcamel]

sounds like an overheated chip - ie: bad router.

[Keeper of the Turf]

My brother's on DSL and he's always dropping out. Not every minute but too much for my liking.

[COEXERJ145]

Speaking of Cisco/Linksys routers, what could cause a new router to repeatedly drop the DSL connection about every minute? It connects, authenticates, lets me view a couple of web pages then DSL link fails. I also get a brief popup in Windows "a network cable is unplugged". Then it reconnects. Over and over.

Funny, I have this exact same problem and it started several months ago. It does it every morning for an hour or so and then stops.

I bought a new router but I can't make it work with my DSL connection, all I get is "low connectivity" message from Windows. Same message I get if I plug the DSL modem into the computer. Verizon tech support is useless and says the problem is with my PC. The PC is less than 2 months old.

[quikdrw]

I had a client with that problem. LinkSYS finally had a BIOS update that fixed it.

[proxy_user]

Can you explain why a router maker would allow someone on the external internet to connect to the http interface? Surely, such a router should only allow a dhcp client to do this, and it should certainly know their IP addresses.

What is this stuff about malicious sites? Does that just give them an IP address to attack by trying to connect back to the router?

[KoRn]

Have your provider send a tech out to run a test on your phone lines back to the DSLAM. Are you using line filters on your phones or are you using a line splitter?

Do you have any satellite receivers plugged into a phone jack?

[2 Kool 2 Be 4-Gotten]

...and switch to the device's serial number. "This value, which is unique to each individual router, would comprise a very secure and unpredictable password," the report stated.

If the "serial number" is really what its name implies i.e. a number that increases serially with each product shoved out the door, then it can't be all that secure, as it's a monotonic increasing series.

[bmwcyle]

This sucks.

[BlessedBeGod]

...what could cause a new router to repeatedly drop the DSL connection about every minute?

I have exactly the same problem, too, but with broadband! It happened once in November, several times in December, and now happens every few days. It drives me nuts, but I don't know how to troubleshoot it.

[Redcloak]

this isn't good...

It's neither good nor bad; it's just another example of the stupid getting the abuse they so richly deserve. I've bought plenty of Cisco products, like the new Linksys router right in front of me. Right there in the instructions it tells you to CHANGE THE F-F-F-FLIPPING PASSWORD. (Or words to that effect : ) All of them have that in the instructions. Those who fall victim to this "flaw" do so because they refused to follow instructions. If they wind up seeing 37 cases of vodka purchased from a Moscow liquor store on their Visa bill, they deserve it!

[dhs12345]

Not certain what SlumpTester means by it either.

The most annoying thing about my router -- can't change login name. Have a very random password, though.

[dhs12345]

Is there some kind of a ping to stay alive option? I know that my router is constantly hitting my modem with a ping. The Ethernet light on both the modem and router flash at about 4x per second if there is or isn't data.

Have cable.

[Mike Bates]

Cisco Says 77 Routers Open to 'Drive-By Pharming'

What does Pancho say?