Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

At home I have a wireless cisco router. Unfortunately I wasn't smart to change its ip or passwords. So anyone who is connected to it can access 192.168.0.1 and log in as admin using password admin and do whatever they like.
However in order to connect to my router you have to enter the password which was blahblahblahblahblah (yes it is word blah repeated 5 times).

I came home tomorrow to find that my router password was removed and my network became public. Is there any way anyone could have been able to connect to my router without knowing the password and change it to public?

share|improve this question
    
You say you didn't change the passwords and then say to connect to your router the password is "blahblahblahblahblah". Could you please clarify? I assume one password you are referring to is for access to the admin account and the other is WEP or WPA key. –  Celeritas Aug 8 '13 at 23:16
    
make a hard reset, and change the admin password, your WPA password and disable the PSK, and don't use WEP password –  jcho360 Aug 9 '13 at 13:25

2 Answers 2

up vote 3 down vote accepted

From your description, I suppose that your router was configured such that:

  • Using the WiFi entailed knowing the WiFi password, set to the password "blahblahblahblahblah".
  • When contacting the router over IP (whether from the WiFi, or from the outside -- a router, by definition, routes data, so it is connected to at least two networks), it is possible to access the administration interface with the login "admin" and the password "admin".

Then it seems highly probable that the intrusion came from the outside: someone, or some robot, simply connected to your router public IP address (the one facing the outside, allocated by your ISP, not the internal 192.168.0.1), tried to open the administration interface with the default password, and lo! it worked. You would not have been the first one to leave a default password. There is even a database of devices which have been left open. Maybe yours is referenced in there; you might want to have a look.

If your router was configured to deny access to the administration interface from the outer network, then the intruder must have come in from the WiFi part. Let's face it, "blahblahblahblahblah" is not the strongest password ever -- even if the rest of the WiFi was done properly (i.e. WPA2), such a password would not have lasted long against an attacker with a simple PC.

And, of course, there is always the possibility of a remotely exploitable security hole in the router software. Routers are, internally, small computers with software, which is not often updated (if at all), so they have bugs and holes. A simple search on "CISCO" in the published CVE uncovers 1418 entries.

share|improve this answer
    
Wow this is interesting info. Weirdly enough yes I was on the database. Well this is concerning. Thank you very much, I am off to try to fix security at home :) –  Quillion Aug 9 '13 at 13:49

Did anyone perform a hard reset on the device? Usually there is a pin hole button you need to press for a few seconds to reset the device to the default configuration. Just a thought.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.