Ars Technica has an interesting read on a new attack that has been exploiting vulnerabilities in multiple varieties of DSL modems, forcing users in Brazil to visit compromised websites in turn leading to the theft of financial information. Researchers say the attack is a "perfect storm" of incompetence courtesy of Brazilian regulators, ISPs and hardware vendors who failed to properly test and confirm modem security across more than six unnamed varieties of DSL modems. Kaspersky Lab Expert Fabio Assolini put it this way in a blog post:

quote:

---

"This is the description of an attack happening in Brazil since 2011 using 1 firmware vulnerability, 2 malicious scripts and 40 malicious DNS servers, which affected 6 hardware manufacturers, resulting in millions of Brazilian internet users falling victim to a sustained and silent mass attack on DSL modems. This enabled the attack to reach network devices belonging to millions of individual and business users, spreading malware and engineering malicious redirects over the course of several months."

"The negligence of the manufacturers, the neglect of the ISPs and ignorance of the official government agencies create a 'perfect storm,' enabling cybercriminals to attack at will."

---