0

I’m a newbie to this area of security, but I’ve been reading up on best practices and have been checking out the Fritzbox 3490. As I understand it when accessing the admin page locally it should always be done with https via the browser. The problem is that the Fritzbox only allows https when setting up a remote access account with them.

I’ve read though the manual and it claims that the firewall isolates the box when locally accessing the admin. I’m not sure this sounds secure, so I need advice - is this an easy way for an attacker to take over the router if there is no encryption on the local admin? Should I search for another brand of router?

2
  • It is not very secure and AVM itself mentions that TLS would protect important connections. They still don’t support setting up a TLS certificate. This means you have to trust your WLAN encryption or the wires
    – eckes
    Oct 22, 2017 at 4:22
  • 1
    They do support that:)
    – Tobi Nary
    Nov 21, 2017 at 7:13

1 Answer 1

1

First of all, there are different attacker scenarios, lets start with some theoretics:

First, you might be concerned about attackers from the Internet. Here the firewall is a rather important thing. It primary separates local traffic within your LAN from getting into the Internet and prevents unwanted traffic from the Internet entering your LAN.

Especially, if you did not set up remote access, the latter means nobody from the Internet can access your local admin page. While the former means if you send locally your admin credentials to your router, that message never leaves your LAN and therefor can't be sniffed by someone out in the Internet.

Secondly, you might assume that the attacker has direct access to your LAN. Either because you just mistrust your fellow LAN users or because someone from the Internet already hacked one of the devices within your LAN. In this case it might be possible for the attacker to read your password while you transmit it to the router via HTTP. So your indeed should prefer HTTPS.

About your more practical issue:

The problem is that the Fritzbox only allows https when setting up a remote access account with them.

Where did you get this?
I actually found:

"For the following MyFRITZ! activities the HTTPS security protocol is used:
- setting up a MyFRITZ! account [...]"

and

"The FRITZ!Box generates its own HTTPS certificate. Because this certificate does not come from a certification authority preconfigured in common browsers, you have to confirm in your web browser or in the My FRITZ!App that the connection should be established nevertheless."

From Fritzbox manual

It rather states (as I read it) that for the listed activities HTTPS is default/required. But, it also indicates that your router is quite capable of HTTPS. So you could just type the "https://" in front of your admin page URL and test it. However you will get a warning about the not certifiably connection, but this still encrypts your traffic (as long as there is no Man-in-the-middle). With my Fritzbox 7360 I'm capable of using the HTTPS protocol this way.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .