Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 5 down vote favorite

I am interested in how reliable the information determined from doing forensics on a SOHO router is. Most of these routers don't seem to be very advanced, so I question if it would be possible to detect tampering.

If logfiles had been changed for example, could this be detected? Given that they use flash memory, would there be remnants of previous incarnations of the file to sue as evidence?

If you need to make a case that a SOHO router was tampered with in any way, what steps could you take to establish this and then what would you provide as evidence?

share|improve this question

3 Answers

up vote 4 down vote accepted

Forensics comes down to how well trained and trustworthy the person doing the forensics is and is unrelated to the design of hardware.

If your router's software is compromised, there's no book of things that can be changed since anything the mind can conceive, can realistically be done. The processors on routers these days can run compilers, interpreters and once you get a shell and root access, they are small computers that always run, have access to all traffic, are connected to the internet and most people don't even think are a security risk.

If you actually want to make a case, get a dis-interested professional to do all the work. Any Judge or defending lawyer would quickly dismiss as biased the input of someone pressing action based on "evidence" they collected themselves. You only have to show how you came to suspect a problem and called in the experts - anything you do past that would probably work against your interests.

share|improve this answer
So if something was done from your internet connection and you know someone got through your router to show it, there would be no way to prove this at all? – Sonny Ordell Jun 23 '11 at 16:20
2  
Could you be a little more specific? Forensics explains the inner workings of a device so that it's clear to all how tampering or how these bits that were downloaded, observed, depicted traces back logically and without any other explanation to the actions of an actor. Of course you you can prove someone used, accessed or modified your property the same as you could in the real world. There are myriad ways you can prove someone walked on your property. It's all about your tools and the specifics of the situation. – bmike Jun 23 '11 at 16:27
@bmike, it is my understanding that things are more limited on these SOHO routers with traditional disk forensics not being workable, and them not logging login attempts or various things that may be needed to make a case. In a scenario where someone bruteforces a weak WPA password, and edits the logfile to remove their machine as having authenticated, how could you establish they did? – Sonny Ordell Jun 23 '11 at 22:23
I use SNMP and remote syslog - if you could show editing of the router logs, that sure would be an ideal smoking gun to prosecute trespassing, defacement and unauthorized access. – bmike Jun 23 '11 at 22:30
Do the cheaper routers even have SNMP? Without remotely duplicating the logs, is there any way you could show tampering? I know you can do this on a traditional PC but i'm not sure you could do this on these simple devices... – Sonny Ordell Jun 24 '11 at 15:33
show 1 more comment
up vote 2 down vote

If you need to make a case that a SOHO router was tampered with in any way, what steps could you take to establish this and then what would you provide as evidence?

The only way I can think of is if you had logs being duplicated to a separate log host, a quick comparison of the log sets would be strong evidence. Although that will never realistically be the case for a SOHO/Home router.

share|improve this answer
up vote -1 down vote

If you have the right cables then you should use jtag or similar to dump the firmware and compare it with a clean copy from the manufacturer or another router. I think it would be possible but you must be very careful to ensure the original device is imaged in a forensically sound manner but once this is done it should be relatively simple.

share|improve this answer
This doesn't help with the point the OP made about detection of tampering with logfiles... – Rory Alsop♦ Apr 11 '12 at 14:28

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.