1

If you reset a router that's been hijacked to factory defaults with the inbuilt reset button, will that take care of the problem?

  • 2
    It depends on how it's been hijacked. It might also let the intruder in again if the initial attack vector has not been closed – Stephane Dec 18 '15 at 17:13
  • 1
    It can also depend on the type of router, I could normally be of more help but there is little information given. – Cameron Does Things Dec 18 '15 at 17:17
  • Do you know how the router was compromised in the first place? – Brian Duke Dec 18 '15 at 18:01
4

If your only problem is that the router is compromised than a reset to factory defaults will probably fix this problem. But make sure that you are really doing a factory reset and not a simple reset (restart) of the router.

If your problem is also that an attacker was able to compromise the router in the first place then this problem has not been solved by a factory reset. Maybe it can be resolved by updating the firmware, but if a fixed firmware is out there depends on the vendor. Also you cannot be sure that the firmware really fixes the problem even if it claims so, because some vendors just fix the one bug which got reported or seen in the wild and leave other unreported bugs open.

| improve this answer | |
1

In short, probably not.

Resetting the router to default settings will likely remove the back-door or the privileged access gained while high-jacking the device. What resetting doesn't do is stop the initial vector that cause the high-jacking in the first place.

As a rule there are a few things you should do with new or recently reset home routers to mitigate security issues:

  1. Change the administrator password
  2. Enable security (WPA2) and disable broadcast beacons
  3. Disable remote administrator access (make sure an administrator can only login from the local network)
  4. Disable UPnP which is a common vector in high-jacking routers.
  5. Update your firmware to the latest available.
  6. Disable NetUSB if it's an available feature, it's another vector.

Basically, if the hole is still there you're open to another attack - internet scans are perpetually looking for vulnerable devices so it'll just be a matter of time because the router gets re-high-jacked.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.