If you have a router with default login and password for the admin page, can a potential hacker gain access to it without first connecting to the LAN via the WiFi login?

up vote 69 down vote accepted

This may be possible using cross-site request forgery. In this attack, the attacker triggers a request to your router, for example by including an image on his site:

<img src="http://192.168.1.1/reboot_the_router?force=true">

When a user visits his site, this triggers a request to the router.

The attacker's site can trigger requests, but not view responses. Not all routers are vulnerable to this. Setting a non-default password certainly protects against CSRF1.

There are plans to block such requests in the browser, but these haven't been implemented yet.

Edit 1: Setting a non-default password protects against CSRF in some cases. The attacker can no longer forge a request to login using the default credentials. However, if you are already logged in to the router he can use your current session.

  • 6
    Depending on how the administrative web interface handles authentication it may be necessary to provide the default user name and password in the URL for HTTP Authentication: <img src="http://admin:defaultpassword@192.168.1.1/reboot_the_router?force=true"> – David Foerster Sep 19 at 10:07
  • 3
    @Q-bertsuit The user does have LAN access. – Bergi Sep 19 at 12:20
  • 12
    As much as I agree that default passwords should be changed, I don't believe it would help against CSRF. Whether you are logged in with a strong password or a weak one it won't matter. You are already logged in and CSRF would most likely work. IMHO, the better advice, in this case, would be to always log out from the admin interface. Don't stay logged in after being done with it. and don't tick the "Remember me" checkbox during login. – Dan Sep 19 at 12:57
  • 3
    Many "SoHopeless" routers are just insecure too, the number of CVE's where just calling a URL and getting the router to execute commands with no security at all is a constant source of amazement. See vpnmentor.com/blog/critical-vulnerability-gpon-router – James Snell Sep 19 at 13:43
  • 12
    This exploit has no business working as well as it does. GET requests are supposed to be "safe" and shouldn't trigger side effects. Also, CSRF tokens have been standard practice in web forms for many years. But routers are all terrible so I guess this is what we should expect. – Kevin Sep 19 at 17:06

Almost all routers are configured by default to only expose the administration interface to the "LAN" side and not to the internet. Some routers have the option to enable or disable this, so it would be good to check the settings of your router.

You can also test this using an online port scanner or this ShieldsUP! tool. These will check if they can access anything on your router from the internet.

  • 1
    To be fair, a router configured with the default credentials is unlikely to have this setting turned on. I don't think I've ever seen a case where the default configuration would allow for remote management... – Shaamaan Sep 21 at 7:58

Yes, easily.

There are a variety of ways an attacker can gain access to said router. Here are some attack vectors I have on top of my head:

Cross-site Request Forgery

Basically, your browser is connected to LAN. If you browser a page hosted on the attacker's server, then your browser is connected to it as well. Therefore, through your browser, the hacker can access your router admin page. Whether the hacker can get a response depends on the specifics of the implementation.

It is even easier if "browser" is replaced with "executable file".

You may refer to Sjoerd's post for technical details.

Exposed Admin Page

Many routers have the option of enabling external access to the admin page, in addition to internal access.

For example, your router has external IP 8.8.8.8, while internal IP is 192.168.0.X. If external access is enabled, anyone on the internet can type http://8.8.8.8 and see your router's admin login page.

This option is disabled by default.

VPN

VPN is another feature included in most home routers. The purpose is to allow you to access your home network from outside. By definition, you can connect the router's admin page once you're VPN connected.

VPN is likely disabled by default.

  • If your computer is infected with malware, the attacker may already have remote access and thus be inside your home network without him even knowing whether you are using cable LAN or WLAN on this particular computer. (He needs some assistance from you, like opening an email attachment or visiting a website that uses a zero-day exploit for your browser. But social engineering is a common door opener for hackers to make you do them this favour.)
  • The same applies to vulnerable mobile phones (e.g. an old Android for which no fixes are supplied any more), because they may have been infected in a public place - lets say, an unencrypted airport WLAN.
  • Unfortunately, there may be IoT devices that will most likely never get any software update. If a smart light bulb accepts commands via Bluetooth as well as WLAN and somehow allows to be injected code, it may be updated with a modified firmware from outside your house, and then used as a bridge into your home network.
  • 2
    I have seen the last point happening to myself, the antivirus I was using detected an intrusion from one of the office cameras (I even placed a question in this SE)... I take these are common bridges nowadays. – CPHPython Sep 20 at 11:26

This is also possible via DNS Rebinding. The attack is explained in detail in this article but in short, if you visit a malicious website (or a website with malicious code, such as in an ad or XSS) it can essentially trick your browser into making a request to your router, on your local network, allowing the attacker to make changes remotely.

Some relevant quotes;

...historically, network routers themselves are some of the most common targets to DNS rebinding attacks... 

There are two common attack vectors that I’ve seen with DNS rebinding:

1. POSTing default credentials to a login page like http://192.168.1.1/loginto own router admin. Once the attacker has authenticated they have full device control and can configure the network as they please.

2. Using a router’s Internet Gateway Device (IGD) interface through UPnP to configure permanent port forwarding connections and expose arbitrary UDP & TCP ports on the network to the public Internet.

From what I understand this requires a bit of setup, and is specific to the interface your dealing with (i.e. one javascript script isn't going to work against every router interface). DNS Rebinding isn't limited to routers as you'll read in the article.

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.