Website driveby attacks on routers are alive and well. Here’s what to do

By Dan Goodin

Researchers detect 4.6 million attempts over 2 months in Brazil alone.

source unclear, GNU Free Documentation License.

D-Link's DI-514 802.11b router. It was a perfectly cromulent router for its time... but those were dark days, friend, dark days indeed. source unclear, GNU Free Documentation License.

Website driveby attacks that try to boobytrap visitors’ routers are alive and well, according to antivirus provider Avast, which blocked more than 4.6 million of them in Brazil over a two-month span.

The attacks come from compromised websites or malicious ads that attempt to use cross-site request forgery attacks to change the domain name system settings of visitors’ routers. When successful, the malicious DNS settings redirect targets to websites that spoof Netflix and a host of banks. Over the first half of the year, Avast software detected more than 180,000 routers in Brazil that had hijacked DNS settings, the company reported.

More at Ars Technica