1

I learned I can access my router from a web device like so http://ipaddress/login.html

enter image description here

I was wondering if anyone could gain access to my router control panel. IF that is the case can they compromise my home network that connects to the router? Any malicious code or anything. Or i should not be worried at all

EDIT: ITS ACCESSIBLE FROM INTERNET, thats why I said web devices EDIT2: I can access http://ip/login from a device not connected to my home network, ie my phone connected via 4g, or from a restaurant wifi. I think im clear enough now

  • 5
    Is it accessible from the internet or just the LAN? Is it password protected? – AndrolGenhald Dec 19 '18 at 17:32
  • yes its accessible and its password protected with default pass hahaa – Born vs. Me Dec 19 '18 at 18:23
  • 1
    "ITS ACCESSIBLE FROM INTERNET, thats why I said web devices" - a web device you use you access the router is the browser. While the browser can access the internet the browser is not the internet and the browser can also access thinks different from the internet - notably the local network (intranet not internet). Nothing in your description except your unproven claim suggests that the router can actually be accessed from the internet (i.e. outside your local network). – Steffen Ullrich Dec 19 '18 at 21:44
  • Look. I access the ip/login page from my wyork computers, or from my mobile 4g connection. PM me I can give you the ip – Born vs. Me Dec 20 '18 at 0:01
  • @SteffenUllrich Look at my updated answer If you want I can give you the ip to test it yourself, private message me – Born vs. Me Dec 20 '18 at 0:05
1

Based on the information so far it cannot be said if there is a problem or not. One need to watch out for several things:

  • If the administrative interface is accessible from the internet (usually not) and you have no password or a weak password then an attacker might get access this way. It is strongly recommended to have the administrative interface not exposed to the internet.
  • If you are logged into the router locally or have no or a weak password AND if the router is vulnerable to CSRF attacks or DNS rebinding (in case of no or weak passwords) then an attacker might get access by using your browser as a trampoline to access the internal interface of the router from outside.
  • Additionally there might be some kind of backdoor in the router where an attacker gets access. This might for example be a remote access for the ISP which due to bugs or misconfiguration is not restricted to the ISP only. But there were also real backdoors in the past left by the vendor.

If the attacker can get access to your router he can get usually get access to your internal network too. Typical attacks involve changing the DNS servers so that all of your traffic is passed through DNS servers controlled by the attacker. Or your router will be part of a botnet attacking other systems or sending spam. See for example A Massive Botnet Using Compromised Routers Is Ready To Attack, Over 200,000 MikroTik Routers Compromised in Cryptojacking Campaign, VPNFilter botnet has hacked 500,000 routers. Reboot and patch now!, Over 65,000 Home Routers Are Proxying Bad Traffic for Botnets, APTs, How millions of DSL modems were hacked in Brazil, to pay for Rio prostitutes.

In other words: unless you can be sure that none of the attack vectors actually exist you should be worried. It is hard to be sure about this but choosing a router from a vendor with good reputation regarding security issues helps. For more information see routersecurity.org. Also check that the firmware of your router is up-to-date and that you are using a strong password. Also don't login to your router with your normal browser profile in order to prevent misuse of logged in sessions using CSRF - use a different browsing profile or incognito mode for this.

  • Its accessible from the internet – Born vs. Me Dec 19 '18 at 18:24
  • @Bornvs.Me: then make sure it's not. How this should be done depends on the specific device - thus refer to the documentation of your device. If this is a system you got from your ISP maybe contact your ISP for help too. – Steffen Ullrich Dec 19 '18 at 19:12
  • what could possibly happen? can you show a link to a worst case scenario, id like to pentest my own router – Born vs. Me Dec 19 '18 at 21:32
  • @Bornvs.Me: see updated answer for the many things which can happen. – Steffen Ullrich Dec 19 '18 at 21:39
0

Assuming that admin panel is exposed to the Internet (and not just available on your local WiFi network), you are definitely placing yourself at risk.

If you don't need it accessible from the internet, look for a configuration setting to disable it; it will be named something like "disable remote configuration". This will greatly help prevent your router from being attacked remotely.

If you can't disable it, there are several steps you should take to lock your router down, the first of which is to change the admin password. Since there are plenty of resources on line for securing home routers, I would recommend you find and follow one of them.

  • What can possibly happen from the router? cna they get access to my pc? – Born vs. Me Dec 19 '18 at 18:24
  • Yes, if they can get into your router, they can configure it to expose your PC. – John Deters Dec 19 '18 at 18:47
  • A common attack would be to change your DNS server address to one that delivers malicious addresses. Your PC might think it is going to example.org but actually be connecting to evilhacker.com. – John Deters Dec 19 '18 at 18:51
  • It would be equivalent to putting your home network on a coffee shop WiFi without telling you. It doesn’t immediately give them full access, but it would make lots of new attacks possible. – John Deters Dec 19 '18 at 18:54
  • can they get access to my pc? – Born vs. Me Dec 19 '18 at 21:33
0

Most likely you just accessed it from your local network? If the IP address is not 10.x.x.x, 192.168.x.x, or 172.16-31.x.x then you should log into your router and turn off remote access. Many routers have the ability to managed from the open internet and not the local network which opens them up to brute force attacks among other things. I'd start by making sure you can only access the router from the local network.

Second, when you go to that site do you have to provide a password? Has it been changed from the default? If not, change this password. Routers have gotten better in past 3 years about not using the same default password across all the devices, but it's still worth checking and changing.

If you do this, you should be pretty protected from rogue log in. Interestingly, most routers have logs also, if you dig around you can find them and probably see who and how many times someone might have tried to log into your router.

For reference, here is how to find the enable/disable button for remote web access: https://www.microcenter.com/tech_center/article/8339/how-to-set-up-remote-access-on-a-tenda-fh1201

And to answer the final question, if someone can access the router from the internet and changes the settings to allow them inbound access to your network: yes they can attack all the devices on your local LAN. There are multiple ways this can look

  • its accessible from internet – Born vs. Me Dec 19 '18 at 18:24
  • In my answer there is a link to a page showing where that setting can be disabled. – bashCypher Dec 19 '18 at 18:31

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.