I'm trying to secure the home router (DIR-655 h/w version B1) of a family member and want to make sure it isn't already compromised. I installed it for them a few years ago but then didn't have access to it again until recently.
It's been working well for them and there are no history or signs of malware on any of the devices (1 Windows machine, 2 Macs, and a couple of iPads and iPhones), but the firmware hadn't been updated in all this time and was more than 3 years out-of-date (latest is 2.11 from 8/14/2013) until I just updated it. Also, UPnP was enabled, and I think this model had a vulnerability related to that.
What are the best ways to tell if the router has been hacked? How can I get root shell access like the person asking this question did so that I can check for some of the same red flags?
These log entries caught my eye, but they might also be perfectly normal:
HTTP listening on port 65530 <-- I know it needs a web server, but shouldn't that be listening on port 80? read /var/tmp/hosts - 1 addresses read /etc/hosts - 2 addresses compile time options: IPv6 GNU-getopt no-MMU ISC-leasefile no-DOCTOR no-NOWILD no-DBus no-I18N TFTP [ 37.400000] --- End Trap --- [ 37.400000] CALL && CALLI on stack: [ 37.400000] User Stack (fdpic): [ 37.400000] Starting backtrace: PID 841 'miniupnpd' [ 26.130000] br0: topology change detected, propagating [ 23.820000] device ath0 entered promiscuous mode [ 3.890000] All bugs added by David S. Miller 'firstname.lastname@example.org' [ 3.850000] 6 cmdlinepart partitions found on MTD device ubicom32_boot_flash [ 3.730000] Serial: Ubicom32 mailbox serial driver. <-- There are no serial devices attached [ 0.220000] SCSI subsystem initialized <-- SCSI? On a router?
PS If I do a factory reset on it, would that guarantee that the router is clean?