Symantec claimed that it had identified the first drive-by pharming attack, against a Mexican bank. The attack, where a hacker changes the DNS settings on a customer’s broadband router or wireless access point and directs the link to a fraudulent website, had previously been thought to affect home users only.

According to Symantec's principal researcher, Zulfikar Ramzan, the attack emanated from an email “pretending to be from a legitimate Spanish-language e-greeting card company, Gusanito.com.” Inside the email was an HTML image tag but instead of displaying images, it sent a request to the home router to tamper with it. The code looked to change 2Wire DSL routers to point the user’s web browser to a fraudulent bank site that mimics the site of one of the largest Mexican banks. Ramzan declined to name the specific bank.

“So, whenever you’d want to go to the bank site, instead of the real one, you’d get the attacker’s fake site,” he says. For the home PC user, the danger is that this drive-by pharming attack is “so silent and there’s only subtle telltale signs that it’s occurring,” he added.

A white paper from Symantec and the Indiana University School of Informatics coined the term. At the time the researchers detailed the JavaScript-based security threat and said such an attack could hit up to 50 percent of home broadband users.

Drive-by pharming can occur because home router equipment is often left configured with default log-in and password information and never changed. “The attacks know what the defaults are,” Ramzan says. The simplest defence is to make sure home routers of any type have the default password settings changed.
Corporate routers are not typically seen to be as vulnerable to drive-by pharming “because they tend to be managed better,” he says.

Ramzan added he expected the drive-by pharming attack to accelerate as online attackers move beyond into newer methods than traditional email phishing.