1

I'm trying to secure the home router (DIR-655 h/w version B1) of a family member and want to make sure it isn't already compromised. I installed it for them a few years ago but then didn't have access to it again until recently.

It's been working well for them and there are no history or signs of malware on any of the devices (1 Windows machine, 2 Macs, and a couple of iPads and iPhones), but the firmware hadn't been updated in all this time and was more than 3 years out-of-date (latest is 2.11 from 8/14/2013) until I just updated it. Also, UPnP was enabled, and I think this model had a vulnerability related to that.

What are the best ways to tell if the router has been hacked? How can I get root shell access like the person asking this question did so that I can check for some of the same red flags?

These log entries caught my eye, but they might also be perfectly normal:

HTTP listening on port 65530   <-- I know it needs a web server, but shouldn't that be listening on port 80?

read /var/tmp/hosts - 1 addresses

read /etc/hosts - 2 addresses

compile time options: IPv6 GNU-getopt no-MMU ISC-leasefile no-DOCTOR no-NOWILD no-DBus no-I18N TFTP

[ 37.400000] --- End Trap ---
[ 37.400000] CALL && CALLI on stack:
[ 37.400000] User Stack (fdpic):
[ 37.400000] Starting backtrace: PID 841 'miniupnpd'

[ 26.130000] br0: topology change detected, propagating

[ 23.820000] device ath0 entered promiscuous mode

[ 3.890000] All bugs added by David S. Miller 'davem@redhat.com'

[ 3.850000] 6 cmdlinepart partitions found on MTD device ubicom32_boot_flash

[ 3.730000] Serial: Ubicom32 mailbox serial driver.   <-- There are no serial devices attached

[ 0.220000] SCSI subsystem initialized   <-- SCSI? On a router?

PS If I do a factory reset on it, would that guarantee that the router is clean?

  • 1
    The main hardness of this is that there is no real difference between a clear router and a "well" hacked one. You can't point, for example, to a file like "if there is a /etc/hack-crack.conf, then it is hacked". – peterh Feb 16 '17 at 5:16
  • A factory reset does usually not reset the firmware but the configuration. If the firmware itself is compromised this will not help. And you'll probably not notice if the firmware is compromised unless you are looking for traces of specific publicly known exploits. – Steffen Ullrich Feb 16 '17 at 5:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.