5

Today I found that anyone can access my router from outside my lan using my public ip. Then after some study, I came to know that the problem was not only with my router but it is a bsnl vulnerabilities, and most of bsnl routers can be access by its public ip (by simply entering public ip in url bar).

Now my question is:

if anyone have been able to access my admin panel(brute force username and password or if i leave delult username and password or whatever any other method) what further attack can be done by an attacker

Is it possible for an attacker that he/she can access my connected devices

or

he/she can able to land me on a malicious page by dns spoofing.

4

Yes she/he have to simply change your router default DNS settings and forward any lookup to a DNS server that is under her/his control. With that she/he can start various attacks.

Some ideas:

  • Proxify your traffic so she/he can inject malicious code on every HTTP resource you are visiting.
  • Push back-doored updates to some programs.
  • Just to be clear, both attacks mentioned in this answer can trivially be done without having access to the router, in certain (but common) scenarios. – FMaz Jul 26 '17 at 12:46
3

Most routers allow for firmware updates from their admin pages. An attacker could upload a malicious firmware that gives them access into your local network, and from there attempt to find vulnerabilities in your devices and infect them.

The DNS settings can also be changed, meaning the attacker could intercept your banks website and send you to their own, which would then steal your online banking credentials. HTTPS would not help in this scenario, unless you are/have either: * Checking to make sure the lock is on the address bar * The website has HSTS enabled and you have already visited their site

If the router supports VPN or another proxy mechanism, the attacker would be able to capture all your traffic without custom firmware.

Some routers like the 2Wire from AT&T had a hidden config page that let people put custom DNS entries that were resolved by the router. These entries had no indicators other than they were on the config page.

On further thought, I recalled that some routers I've used had ports publicly accessible such as telnet or ssh that couldn't be disabled, but if you put a port forwarding rule in for that port, the router would no longer respond to it and just forward it. You could try to forward port 80 to a known dead address on your network and seeing if the page is still accessible from a public ip.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.