Md. engineer finds flaw in 'millions' of routers

Craig Heffner with Hanover, Md.-based data security firm Seismic will unveil a software tool at the Black Hat Security Conference next week which allows him access to brand-name wireless routers, including most Linksys, Dell, and Verizon FiOS models.

Heffner tells Forbes Magazine the exploit is a variation of a 15-year-old technique known as "DNS rebinding."

"There have been plenty of patches over the years, but this still hasn't really been fixed," Heffner tells the magazine.

Heffner's software gains access to networks by manipulating IP addresses, the codes that allow computers to connect with various Web sites. The software creates a dummy site and then switches IP addresses, which allows the user to hijack a person's browser or gain access to their router settings.

Heffner does say the hack will only work if there is a vulnerability in the router's software or the default login password is still intact.

To avoid this kind of attack, router users should make sure their router software is up-to-date and the default password is changed.

To see a list of the routers that Heffner successfully hacked, click here.

(Copyright 2010 by WTOP. All rights reserved.)