8

I have a home network that was hacked into recently. The people that got into my network actually accessed my personal files and although I cannot prove it, I think they might have stolen some of them.

Since this happened, I have been looking at various ways to stop this from ever happening to me again. It's very personal like someone has robbed you of your privacy.

In doing so, I found an article How do I set up a DMZ for safer home web hosting? about using two routers daisy chained to create a multiple firewall effect. My interpretation of this approach is that adding another layer of router firewall protection would make it almost impossible for a hacker to get into my home network.

So, in following the article, I have connected two routers together and made set the settings of each router as follows:

  • Router 1 - Netgear D6200 connected directly to ISP

    Internet settings tab
    Internet IP address - Get auto from ISP
    
    DNS 1: 208.67.222.222 (Open DNS)
    DNS 2: 208.67.220.220 (Open DNS)
    
    NAT: Enabled
    
    LAN setup:
    
    IP address: 192.168.0.1  
    Subnet: 255.255.255.0
    
    DHCP: Yes
    IP Start: 192.168.0.2
    IP End: 192.168.0.254
    
    UPnP: Off
    
    All radios on this device are OFF.
    
  • Router 2 - Linksys WRT1900AC

    Internet settings tab
    Internet connection type is set to - Auto Configuration DHCP
    
    Local Network Tab
    IP address: 192.168.1.1
    Subnet: 255.255.255.0
    
    DHCP: On
    IP start: 192.168.1.51
    IP end: 192.168.1.100
    
    DNS 1: 8.8.8.8 (Google)
    DNS 2: 8.8.4.4 (Google)
    
    Advanced Routing Tab
    NAT: Enabled
    Dynamic routing (RIP): Disabled
    
    Security Tab
    Firewalls IPv4 IPv6:  ON
    
    DMZ Tab
    DMZ: OFF
    
    Connectivity tab
    UPnP: Disabled
    

My question is, how can I harden this configuration and optimize it for security?

  • 6
    If they have accessed your files than they at the very least had your data, independent of them storing or (ab)using this data. So in the sense of intellectual property stealing, if they accessed your data they already "stole" it. Though on a personal note I do not like the idea of using the word "steal" to describe this offense. – Selenog Sep 28 '15 at 9:28
  • 5
    If they've hacked one router, then adding another one merely presents them with same task once again. – Agent_L Sep 28 '15 at 12:35
  • 6
    Also, how do you know that you are 'hacked' if you cannot prove it? For instance, normally, we know of a system breach by looking through log files. – Matthew Peters Sep 28 '15 at 15:08
  • 1
    Don't configure two layers of NAT. One layer is bad enough as it is. And a properly configured firewall is more secure than NAT anyway. – kasperd Sep 28 '15 at 21:41
  • Get an old computer, install a proper router distro (I like pfsense), install IDSes and DPI modules to taste. – Fake Name Sep 28 '15 at 23:20
19

there are 7 layers in the OSI reference Model. a Network Firewall can protect you against attacks upto Layer 4. there are still 3 more layers out there that are unprotected. so, no matter what you do with those two routers, there will still be a big gap in securing your infrastructure.

Also, Since you believe that you were already hacked, the attackers may have left a back door too.

12

What this article explains is to create a DMZ in your home network. This is however only useful if you are hosting some kind of service (like a web server) from your home.

The idea behind a DMZ is that as this service needs to be accessible from the outside network (the internet in your case) there needs to be a "way in" or the service would be unusable. While it may not be exploitable at the moment it does pose a potential vulnerability. To prevent this potential exploit from impacting the entire setup (other servers in case of a typical situation, in the home case your desktop/laptop computers) an extra firewall is introduced "after" the server hosting the service.

From what I understand you do not host a service and as such have no need for a DMZ. Thus adding an extra firewall will only "secure" you from incorrect configuration of one of the firewalls. Though the maintenance of keeping 2 firewalls synced increases the likelihood of a miss-configuration occurring. It could actually lower your security as both devices are potential vulnerabilities as firewalls are computers which makes them inherently a security risk. I'm not advocating here that firewalls are useless, the advantage of a firewall greatly outweighs its risks but adding a 2nd firewall does not have advantages (unless you do need a DMZ).

  • 3
    Having two routers/firewalls of different models and firmwares connected as described can theoretically protect you from security vulnerabilities found on one device, as an attacker scanning from the Internet would have to compromise both devices before having access to your network. (As mentioned elsewhere, this is only a small part of the overall attack surface. But it's not completely unfounded.) – glibdud Sep 28 '15 at 20:22
5

To answer your question ("how to harden my current setup") specifically:

  • Update the router firmware to the most current (this ensures that any previously known vulnerabilities with the router are fixed. You may also want to research known vulnerabilities for your specific router)
  • Disable 'remote management' of the router settings. (99 times of a 100, this is just more of a security threat vector than convenience)
  • Change your router's administrator's password (his is different than the wifi network password).
  • Change the wifi network(s) password(s) themselves to something more secure and not the default or dictionary passwords.
  • Also ensure that your encryption method is at least WPA2.

The above are just the basic steps anyone should do to their router. I also recommend the following:

  • Disable 'WPS setup' if that option is available.
  • Lower the broadcast signal strength of your network to whatever you need (tip; move your router to a central point in the home).
  • Enable logging at the router level (if possible).
  • I would personally get a new router if mine was already hacked but this may not be necessary.

Notice that this list is agnostic of how many routers you have. The truth is that you do not need to physically create the chain you've suggested. Most routers have firewalls built in but you could also consider another physical device such as a sonicwall device. This is most likely overkill but still an option.

At your PC level, I would:

  • Enable more robust logging.
  • Only 'share' the files and directories you need to share (lock down the rest).
  • Use both antivirus and a firewall commercial product.
  • Enable some form of delegated access (UAC for microsoft for instance and permissions for mac).
  • If you would like more control over the network IO, install another firewall product such as netlimiter or little snitch
  • Also, change all your passwords frequently and follow good practice in doing so (IE unique and complex).
2

Computers on router 1 cannot access computers on router 2, because that would require port forwarding. It's the same that computers on the internet cannot access computers on router 1.

So the security for users on router 2 against attacks from users on router 1 is similar to users on router 1 against attacks from the internet. This all given that both routers are equally secure with admin passwords, updates etc.

2

Okay, I see the point of what you're trying to do here. I do. In fact, the instinct you have here does have a core of value in it: if I'm an attacker who wants to do a good old, no-user-interaction-needed-whatsoever breach into your home network by taking advantage of some unpatched security vulnerability in your Netgear router, putting another router behind it that would not be subject to that same vulnerability might well mean that my use of that attack to breach your network. Notice use of the word "might" there; if the second router blocking path has its own vulnerabilities that I can use to get past it then that second router becomes as valueless as the first, and I'm in your network and my mission is accomplished. But, that being said, if your second router is not susceptible to the same attack that broke through the first--meaning it uses a different type of firmware of a different design than your other does-- and if that second router doesn't have its own vulnerabilities that can allow an attacker from the Internet to take control of it or sneak traffic around it to the network you want to protect, and if (3) that second router is also well-configured to prevent n adversary from taking control of it bypassing it, then (and only then) does the second router approach meaningfully make your network more protected from Internet-based infiltration attacks.

Now, from the facts you presented above, to my eye it lloks like you probably have met those three requirements. Good. You are more secure against Internet-side infiltration attacks that you would be if you just had either the netgear router or Linksys router alone. Now here's the bad news: the traditional infiltration hack (meaning taking control of or making use of some severe misconfiguration in some device in order to then create a pathway to get into a targeted internal network you aren't supposed to be in) is merely one kind of many kinds of attacks that you have to worry about. Indeed, precisely because most consumer routers today have fair-enough protection against that threat that other attack vectors have become more worrisome for the vast, vast majority of people.
Threat vectors like: -Drive-by-download browser-based attacks to get malware on your PCs/tablets/phones -Poisoned document files (PDF, Office file-format, and occasionally other document files) contaminated with malware & spread by email, messaging apps, etc. through phishing & spear-phishing campaigns. -Other kinds of phishing campaigns that attempt to deceive you into typing your log-in info for an online service into a counterfeit website -Physical loss or theft of mobile devices that have information you want to keep confidential stored of them. -And many, many, many others.

So, to be honest, in terms of spending time and other resources that you could be using instead to help defend against other types of security risks (like those mentioned above), in most cases I would tell a client not to spend a whole lot of time implementing a two-router setup. (There are exceptions; I've implemented a dual-router approach for clients in other cases where I thought it added real security.) Instead, I would usually advise a typical user to, in rough order of priority, attend to these things:

-If you have solid suspicion that you might have malware on your devices, or that there still might be some malware remaining after a known previous infection, use a good malware scanner to look. More info on what to use, how, and how to deal with anything you find is available...well, in numerous pages right here, I'm sure. But also start preparing yourself for the possibility that you might eventually find that wiping and reinstalling your OS or OSes of choice is the only thing that will leave you feeling safe.

-Make sure the Operating Systems and all your firmware on all your devices are fully up-to-date with security updates (ie. fully patched), and any & all auto-update features available for downloading & installing those updates without users having to bother with doing anything are on and working.

-Make sure your programs are likewise fully patched and that any auto-updaters they come with are on and working. Especially browsers, browser add-ins/plug-ins, and document viewing & editing programs.

-On browsers: Unless you have a strong preference otherwise, use Google Chrome and/or Microsoft Edge for general day-to-day browsing. See if you can get by with turning the built-in Adobe Flash off for most uses and by using the PDF readers baked into the browsers (rather than Adobe Reader) most of the time. Also, security bonus: neither browser will now work with security-problem-plagued Java plug-ins.

-If you didn't have one already, I'd say buy a cost-effective SPI (Stateful Packet Inspection) router that doesn't have any currently known and unpatched horrible security vulnerabilities in its firmware. (Google or Bing is your friend.) Change the default user-name (if you can) and set a strong password. Check for said firmware updates. Make 100% sure any "remote administration" function is definitely set to off. Kill UnP to be safe. And that's... well, really that'll take care of blocking the kind of infiltration threats that I might expect a home/home office router to face. If you want to go more hardcore re. security capabilities you can upgrade to a business-class router or change out the cheap router maker's firmware for something like DD-WRT. (Oh, that reminds me, you might want to check DD-WRT compatibility before you buy. Just, you know, in case.)

-For every account or service that you care in any way about protecting, use a unique and not-obviously idiotic password. Use some sort of password-management program or system to keep track of those passwords.

-Oh, wifi setup, right. WPA2, of course. Long passkey, longer than almost any password you could have, and have plenty of pseudo-randomly chosen characters (or words, actually, as long as they're sufficiently random) for purpose of adding complexity. Any blasted WPS "feature" off. Guest account off, until/if you ever have guests to use it.

-For PCs create both a user-level account and an administrator account. Run as a user for day-to-day well, usage, and as an administrator only when you need to do administrator things without security prompts aggravating you.

-Turn on two-factor authentication everywhere you can.

-Be skeptical and suspicious of all links, documents, and other files contained in messages of all types (email, messaging apps, Facebook wall posts, Facebook messages, tweets, every means of electronically communicating information that you can think of). Even if you know the sender.

-Install only programs and apps you've looked at a bit, and only from trusted sources (ie., the Amazon, Apple, Google, Microsoft app stores). If we're talking about legacy Windows programs, presume any one of them that you haven't done some good homework investigating is either outright malicious or harmful to your privacy. [Don't get me wrong, I'm a Windows guy. But if you're downloading Win32 applications you found on the Internet you gotta be sure of what you're doing.]

In other words, pay attention to the basics. And, well...back up important stuff off-line just in case. Unless you've got super important stuff to protect, focus on the basics and back stuff up. And then go have fun setting up multiple-level router networks if you have the time and inclination later.

And if you do have super-important stuff to protect?

Start by focusing on the basics and backing stuff up.

  • Oh, BTW: one item nobody's mentioned re. hardening consumer routers yet: set the DCHP for the inner router to start assigning ips to stuff on the network at some chosen point or another (other than just the beginning of the range, of course) in the 10.0.0.0 private address space, instead of the 192.168.0.0 space. So many, many more ip addresses for an opponent to nmap through... – mostlyinformed Sep 29 '15 at 9:26
1

My first suggestion would be to get a Mikrotik router. They're cheap and very powerful. Any port (including wireless interfaces) can be routed and/or switched as you desire. Firewall rules can be established for any pair or ports and any traffic pattern. You do however need to know a bit about networking so this may not be useful for everyone.

If that's not an option for you then you can take a pair of routers as you suggested, but I would arrange them a bit differently:

[ISP]--wan_port[Wireless router]lan_port----wan_port[Second router]lan_port--[secure lan]

Difference being that the article suggested that DMZ is established between your ISP and your wireless lan. But... most "hacking" occurs in your Wireless network. Either because you gave someone your WiFi pre-shared-key or they broke into it with some hacking software. If you google the internet you'll see that most routers are vulnerable due to flaws in Wifi Protected Setup (WPS) standard. In the scheme I proposed, that does not matter as all hackers that get into your WiFi will only get free internet and not necessarily into your secure lan. Secondary router is doing port/address translation (PAT) and that's as good as most firewalls. But you do need to specify explicit translations for services that you want to have access to from your wireless network.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.