Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My wireless network protected under WPA-PSK/WPA2-PSK protocol.
Is there a good reason to change the default user/password for the router management interface?

What would it take for an hacker to get into my network?
Does the fact that I use default user/password would make it easier to hack?

share|improve this question
    
Don't forget to keep the router/access point firmware patched and up to date; devices, particularly consumer devices often have massive security holes. They may not be patched often, but if there's a patch, you need it. See Moon worm and Home wifi router vulnerabilities as merely two references. –  Anti-weakpasswords Feb 15 at 19:36

3 Answers 3

up vote 3 down vote accepted

Short answer: Yes, change it.

As long as you can ensure that the attacker is not able to break into your WiFi (using WPA2 is good beginning) and is also not able to get access by other ways (e.g. over VPN, weak WPA2 password, plugging a cable into your switch, malware on your devices, ...), theoretically there is no need to change the password.

However, since you probably can not ensure these requirements, you certainly should change the password. So that in the case the attacker is able to break into your network, he can not damage that much.

share|improve this answer

@Ted has valid answers to a couple of your questions. I just wanted to add something referring a bit more to the one he didn't cover as well:

What would it take for an hacker to get into my network?

Really, not a lot. WEP has been pretty much cracked, and WPA/WPA-2 are still not perfect. The way most attackers hack into a WiFi network is with aircrack (which comes with Kali/BackTrack). Basically, they start listening for unencrypted wireless traffic, then pretend to you (a valid user) that they are the router. They "tell you" (as the router) that you need to re-authenticate, so you do. They can't get your password that way, but they CAN sniff the password hash. Now all they need to do is perform a dictionary / rainbow tables attack and they have your password, IF it's weak. But all this allows them to do is access your WiFi. Now, this allows them to do a great many things, but if you watch for HTTPS on logins and use HTTPS Everywhere, have AV, and update your software regularly, it would be rather difficult to compromise your computer or data. However, this changes if you still use the default password for the router management interface. Now they have almost complete control over how your traffic is dealt with, and what it says. Bottom line, as @Ted said, change the password.

share|improve this answer

Ultimately whoever physically owns the router has the last backdoor. Every router I've ever owned has a Factory Reset button on it, which can be pressed to default to factory settings.

How much damage a hacker could do before then? Lots. Set a password and be safe.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.