1

I have just updated my RT-N12 D1 router to the latest firmware, and it has new function - "Added protection mechanism for GUI login brute-force attack for login username and password.". I Googled and found that most of the latest firmwares of Asus routers include this new function.

I noticed that the login GUI is totally new. After I tried to randomly wrongly login 6 times, I cannot try again, but if I open another tab in browser it works fine.

I found out if I want to use Wake-on-LAN to wake my desktop computer with this router, the only way is to login to the router control page even when I am outside. I sometimes need to wake up my computer at home, when I am at work, so if I can use Wake-on-LAN instead of turning on my desktop all the time, it saves a lot of energy, but the problem is the security of the login page.

I found out that the latest firmware may prevent brute-force attacks for login, but I am not sure how it works and how safe it is.

Improve this question
3
  • "how secret is it"? It's not secret at all. Are you asking how "secure" it is? It is as secure as your password is. The more complex your password, the more secure a brute-force protection mechanism is.
    – schroeder ♦
    Commented Nov 15, 2015 at 17:33
  • Yeah my wording was wrong. What password mechanism did Asus apply for this case? It looks like someone just cannot brute-force more than 6 times in one tab in browser, but then if the person opens another tab then can brute-force more. Before this framework update, it used to be just a very simple username and password pop up box and should be very easy to just keep brute-force.
    – Annie
    Commented Nov 15, 2015 at 17:37
  • Based on what you've said in your comment Annie, that sounds like no real security protection because it is enforced on the client. An attacker would write a script that could impersonate being in a new browser window on every attempt.
    – Neil Smithline
    Commented Nov 15, 2015 at 21:47

1 Answer 1

Reset to default
1

It is not secure at all, as it looks like it's enforced on the client because opening a new tab clears the cooldown delay and you can log in straight away again.

A bruteforce script would directly submit username/password pairs to the router without interpreting the page's Javascript code that enforces the block.

This will only slow down manual attackers who don't want to automate the task, but automated attacks will be unaffected. It is scary to see that someone thought such "protection" was a good idea.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .