So I completely understand that routers and local networks need to be kept locked down, etc. What real security threats can come about from an attacker who has remotely accessed (telnet or web gui) your home router?
Out of personal interest, I have set up a few test scenarios on my personal network where an attacker may have modified router settings. I found these two features to be the most dangerous.
DMZ each individual client on the LAN (or port forwards)
- Enabling direct port scans & possible exploits (nmap & Metasploit)
Evil DNS Servers
- Domain names can be forwarded to evil clone sites (ex. SET) allowing for credential nabbing & possible remote shells.
Every other setting in a router seems to just further these two basic ideas in some way or another. So what real dangers lurk behind unprotected routers? Can 'evil' software be installed over telnet. Can traffic be sniffed and SSL stripped? Is there anything really beyond forwarding ports and spoofing DNS? Does an exploited router do anything beyond making the connection between the attacker and victim transparent?