Researchers take over Linksys router with simple JavaScript
A pair of researchers at last week's Black Hat conference demonstrated how a simple JavaScript app could be used to compromise a wireless router with little to no user interaction.
Network devices – such as routers, switches, printers and firewalls – can be hijacked to give a remote attacker full control of the network, Phil Purviance and Joshua Brashars, senior security consultants at AppSec Consulting, said during their presentation on Thursday. The attack method relied on JavaScript and cross-site request forgery, they said.
While demonstrations of hacking routers and other networked hardware is not new to Black Hat, this presentation was unusual because so much of the attack was automated. Its success hinged on social engineering, a modern browser supporting HTML5 and lax password security. Typically JavaScript attacks are limited to the browser, but the researchers used a blended attack, which broke this constraint and could affect actual network devices and the network itself.
