3

Today someone claimed to be a technician of my ISP and to take care of connection problems on our block. He entered my apartment and briefly (~3 s) connected a small box (size of a raspberry PI) with some LEDs to my router's LAN port claiming to do some measurements.

After that, he started asking questions about how many people live there and what my occupation and income is. At this point, I realized that he was checking out if the apartment is worth a robbery. I took proper care of that threat.

However - can my router be compromised? After all, those are default Linux machines probably having some open ports.

Edit: I changed those passwords the router offered me to change: WiFi and the settings page accessable by browser. I did not change anything that requires in-depth knowledge.

  • Breaking into your aparment is probably easier than breaking your router and spying on you. – Rápli András Dec 7 '16 at 22:04
  • if he was a good enough hacker to cold pwn in 3 seconds, he wouldn't bother breaking into apartments. – dandavis Dec 7 '16 at 22:20
  • @dandavis: That is, unless root/root works because the manufacturer considers LAN connections secure. – Zsolt Szilagy Dec 7 '16 at 22:27
  • are you saying your router password was the default? even then, 3 seconds is really pushing it; i know my router's pages take a second or two each to come up. it was likely either a social prop for authority/legitimacy or maybe a scanner/phone home of some sort. an interactive attack against linux in an apt just doesn't sound reasonable; to find and id and exploit in 3 secs... maybe i'm naive or he was a spook. I would be really impressed if this was possible as-described. maybe someone know a way? – dandavis Dec 7 '16 at 22:42
  • @dandavis: I changed those passwords the router offered me to change: WiFi and the settings page accessable by browser. I did not change anything that requires in-depth knowledge. – Zsolt Szilagy Dec 7 '16 at 22:58
3

Hard to say without knowing exactly what was done, but if it is a wireless access point router with a WPS button, I'd be concerned that the intruder used the WPS button to authorize his device to connect to your wireless, then sat in his car on the next street out of your line of sight with a device connected to your net. Now the intruder can take plenty of time probing all your devices for vulnerabilities, etc.

Also, your windows file sharing and such is usually fully enabled on your internal net, and one doesn't usually think about share and file permissions too much because it is not accessible to anyone except you and your household members..... if the attacker has a device on your internal net, he can grab your files if they are not secured well.

Perhaps he has also gotten into your router's admin page (most people leave it with the default passwords -- again relying on the fact that only trusted people within the household could even get to the page). Once in your router's admin settings, he is likely going to reconfigure your DHCP server to hand out DNS server address to your devices which points to a DNS server that the attacker has stood up in order to redirect access to real sites like gmail, facebook, etc. which send you to fake sites that look like those sites login page but the credentials you enter are captured and sent to the attacker.

He would also likely reconfigure your firewall to allow himself to come in from the public Internet into your internal net.

These are just a few thoughts of what this person might have been doing. I would look very closely at every device connected to your network, and verify every single one, and I'd check that very frequently to see if anything else pops up. Check all your settings to see if anything changed, paying particular attention to DNS addresses and your firewall rules. I'd change the router password and the WIFI SSID and secrets.

1

maybe the blinking box was just a distraction.

Maybe not. Maybe the box was pre-scripted to do something malicious.

3 s is really a lot of time for a computer.

In that time, he definitely has gotten an impression of the IP addresses used (either by DHCP or by just sniffing an ARP request or couple dozen of these), has very likely been able to determine the private and public IP address of your router, and get an overview of active PC-type machines in your network (assuming they are still so noisy). It will have been enough time to open a port using UPnP to the inside and to phone home to some server to let that server know "where you've been".

You didn't clearly answer the question whether your router had default passwords when the person plugged in his box. If it did, yes, you might have been compromised. I'd ignore the people saying that they need to wait seconds for admin pages of their router to load – I don't know your router, so it might a) not be that crappy slow in the first place, b) have a management interface secured with the same password that is much faster to interact and c) to do something with the interface, you don't actually have to wait till all the login pages have completely loaded if you know what URLs you need to load with which parameters.

Now, default passwords aren't that helpful if the attacker doesn't know the type of device you have. But, again, 3s is pretty long, and that would be enough to figure out what device you use, and then try the default credentials. Also, there might have been prior knowledge – most people just have the router their ISP gives them, and it's pretty easy to guess people's ISP (or you can read it from their public IP address, and again, 3s is a long time if you're well-prepared).

What can be said about default credentials also applies to unpatched security problems with routers. I've personally connected to LANs of more than one router where the web interface was actually that buggy, it leaked configuration information that could be used to gain access on the LAN, even if you didn't have the credentials.

And, all that I'm saying here also applies to the other devices in the network. Maybe the attacker wasn't after the router at all, but after Windows machines with security holes – which might come in very handy, eg. as servers for illegal content.

Now, people nowadays seem to prefer to get victim machines/networks with much less risk – simply by sending around malware, hoping that one in ten thousand (millions?) emails leads to an infection, building a botnet.

So, I'd personally consider your network attacked, but it's a bit doubtful what the attack surface would be. I'd hence try not to be overly paranoid about that. That is, unless you have reasonable concern (not a conspiracy theory!) that someone would have enough political/financial/intelligence interest in getting access to your computers – for example, to exfiltrate secrets from your employer, who trusts you and your laptop — to actually send someone to take the risk to show up in person! Now, someone who's been hired to do so probably wouldn't need to ask about how much income you have, how many people live in your household etc.

However, restoring factory settings on your router, flashing a clean firmware image (or just buying a new one, if you have a cheap one), setting new, separate, unguessable passwords for router access and WiFi, scanning all your networked machines for viruses and being twice as careful as soon someone tries to convince you to hand over money or something similar based on "secrets" that e.g. only the tax office or your employer should have (but an attacker might have gotten access to on your computer) surely would not be too cautious. Good luck!

  • If you're concerned about a targeted attack, see if any of your neighbours were visited. – ColBeseder Dec 17 '16 at 21:29
1

It is strange that you allow someone to come into your house and plug something to lan net.
ISP generally does not need to get into your lan to discover connectivity problems. They see enough from outside: DNS, MAC, nat rules. And can correct it on their border - no need to check anything. In some cases, ISP claims to use their DSL or PON equipment, but in this case they can see your settings from outside.
So, your situation is suspicious

  1. Get lan network, reset router and change settings - check port forwarding section, maintenance (must be only lan access), nat settings and, what is most important - DNS server address (basicly, ISP sets DNS address via DHCP).
  2. In case of default or no password on local machines, box could be a kind of spy that injects lan computers to make them act as a part of some botnet.

What to do?

  1. Log in to your router and reset it to Factory. Reset is anyway needed to be sure that ARP table is correct.
  2. Check DNS record and set it as ISP suggests.
  3. Change router admin password to be more complicated.
  4. Disable ssh root login permissions on your linux hosts and nopasswd sudo for all users.
  5. Buy any simple router and place it between possibly compromised WAN port and ISP. It will isolate your network. Logging can show if there are any attacks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.