1

This is just for my curiosity regarding securing the router. I understand all the things such as securing password, encryption, update firmware etc etc. But I was just wondering could the router admin webpage in the browser be compromised where all the settings are fake and the DNS still being spoofed.

Now would this scenario be impossible if the router firmware can still be updated? Is the best practice just factory reset it and update again?

  • Sure; So turn in https so that can't happen. – Ramhound Jun 18 '16 at 14:57
  • when I do https with the router ip it says certificate not secure – Bruce G Jun 18 '16 at 15:06
  • it's a self-signed certificate of you trust the certificate then it's secure. It's encrypted either way though – Ramhound Jun 18 '16 at 15:11
  • Don't ask what can be done, but how. – multithr3at3d Jun 18 '16 at 17:01
1

Yes, this could happen in theory. The webinterface could be faked by the attacker if she manages to get full control over the router (e.g. rewrite firmware), so that your normal DNS server is displayed on the settings page, while in fact a malicious one is actually used. In theory the attacker could also fake the firmware update function, so that you think you update the firmware but the router is in fact still vulnerable.

However, that would be a quite advanced attack that would have to be tailored for the specific router model, and not something I would normally worry about. But if you are feeling suspicious, do a factory reset.

So can the factory reset be tampered with? Possibly on some router models, if the memory where the original state is saved is writeable. Also, some models might not restore the firmware but only settings leaving infected firmware intact. But again, this would be something out of the ordinary and the average home user should loose any sleep over it.

  • thanks Anders that is kind of scary. Now just add paranoia to my question, can the factory reset be compromised too? My router and modem are from the same isp and it seems they can update the router directly, that seems to be safest bet right now. – Bruce G Jun 18 '16 at 14:10
  • @BruceG I updated my answer. I just want to highlight again that just because something is possible in theory does not mean it is something you should worry about. You should not jump to the conclusion that your router is completely compromised just because of a couple of security warnings. – Anders Jun 18 '16 at 16:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.