lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 21 Mar 2007 01:48:34 -0400
From: Jim Popovitch <>
To: full-disclosure <>
Subject: Re: Newest hacks

On Wed, 2007-03-21 at 13:26 +0800, wrote:
> Hi guys, 
> I noticed a news recently.Researchers at Indiana University's
> Department of Computer Science recently released a report outlining a
> way hackers could potentially access and change the configuration
> routers on home networks. They described how some JavaScript built
> into a Web page could be used to log into the administrator account of
> a home router and change its DNS (define) settings.The Indiana
> University report points out that this attack doesn't exploit any
> browser vulnerability, and, more importantly, it seems to work with
> pretty much any router,rrespective of brand or model.Any idea how to
> program the javascript to modify the DNS configuration?  

Sure.  Someone could create an html email with an img src set to
something like this:  

Next they could add a bunch of urls for all the different router types.
Then, they could send the email from a common Sender addr like
security@<comapany>.tld so that email clients load the images
automatically.  :-(

-Jim P.

Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia -

Powered by blists - more mailing lists