Up to half of home wi-fi systems are susceptible to a new line of attack from hackers intent on stealing personal information such as passwords and bank information.
"Drive-by pharming", as it has been named, involves remotely altering the settings on a wireless router so that it directs the victim unknowingly to bogus mirror websites where criminals can collect secret information entered into the site.
The scam involves setting up a bogus web address book called a Domain Name System (DNS) so that, for example, when a person thinks they are at their bank's website, they are actually at a mock-up of the site set up by criminals.
The good news though, according to the Internet security firm Symantec and researchers at the Indiana University school of informatics who have highlighted the potential fraud, is that it is easy to protect against.
The attack wouldn't work if wireless routers were protected properly with a password, the Internet security expert Markus Jakobsson, of the school of informatics, told the American Association for the Advancement of Science annual meeting in San Francisco yesterday.
The malicious code messes with the settings of the victim's wireless router so that instead of directing them to a legitimate DNS while surfing the web it points them to one set up by the criminals.
The DNS is what links the words you type into the web browser address bar with the IP address of the website - a unique number code.
Once the computer is using the criminal's DNS, the victim can be directed to bogus sites without them realising. The name in the address bar looks legitimate, but the site is actually a fake. So any secret information the victim enters into the site goes straight to the criminals.
Mr Jakobsson said proper password protection could prevent the attacks, but about half of people using wireless routers did not change the factory settings on their equipment.
"In a real attack, the user would be taken to a site that is a true clone of the place they intended to go, but the cloned site would be operated by the attacker and would steal the user's password," research team member Alex Tsow said.
Criminals could use that information to access the real bank site, for example, and empty a victim's accounts.
"There is no way a user can determine that this attack takes place," said Mark Meiss, at Indiana University's advanced network management laboratory. "You can't be sure you are actually visiting your banking site, for example, even though it looks like you are. There is simply no way of telling."
The team said it did not know of any cases of drive-by pharming having happened yet, but said it wanted to bring the public's attention to the problem, particularly as it was easy to protect against the crime.
A 2005 survey of Internet crime carried out by the British police national hi-tech crime unit found that Internet fraud had affected 16% of UK businesses, costing £622m annually. The overall cost of Internet crime was £2.4bn.
Return to internet news headlines
View Internet News Archive