0

My wireless router admin page does not include https option.

It is always served over http. This is obviously a concern in case someone is sniffing the network and can read my password in plain text.

The admin page is web-based, so I am wondering what a good solution would be.

One idea is to be notified if the settings ever change, what would be the best way to accomplish this?

I am guessing I should set up another device as a proxy between all LAN devices and router and block/allow certain connections? If so, what is the best way to accomplish this?

All suggestions and potential solutions will be of great help. Thanks.

3

Context: I'm going to assume that you use your wireless router in a home setting. If you use this router in an enterprise setting, get a different router.


Know your threat model!

Obviously, plain HTTP communication is bad. But why? Because it doesn't guarantee the authenticity, integrity or confidentiality of your data. So who could have access to your data? Anyone who can listen to the communication between you and your router.

Depending on how you communicate with the router, the list of devices that can do that becomes very small.

Direct Connection

This is the simplest setup and looks like this:

+----------------+                +----------------------+
|                |                |                      |
|  Your Computer +<-------------->+ Your Wireless Router |
|                |                |                      |
+----------------+                +--+-------------------+
                                     ^
                                     |
                                     |
+----------------+                   |
|                |                   |
| Other Devices  +<------------------+
|                |
+----------------+

It's a wired connection between you and your router. An adversary would need to be able to physically tap the cable to be able to intercept (and possibly modify) your communication between the router and your computer. In most cases, this is an absolute non-issue.

Switched Connection

This is a more complex setup and something you would typically encounter in larger apartments, or in situations where you want more wired connections than your router physically offers.

+----------------+                +-----------------+                +----------------------+
|                |                |                 |                |                      |
|  Your Computer +<-------------->+ Ethernet Switch +<-------------->+ Your Wireless Router |
|                |                |                 |                |                      |
+----------------+                +-+---------------+                +-+--------------------+
                                    ^                                  ^
                                    |                                  |
                                    |                                  v
+----------------+                  |                                +-+--------------+
|                |                  |                                |                |
| Other Devices  +<-----------------+                                | Other Devices  |
|                |                                                   |                |
| (May be evil)  |                                                   +----------------+
|                |
+----------------+

In this example, some devices connect directly to your router (they may be physically close, for example), while others connect via a Switch. In this example, your computer is connected to the router via a switch.

A malicious device, marked here as "May be evil", might employ an attack called MAC Flooding, which targets the Ethernet Switch. The switch would then basically act like a hub, forwarding traffic not only to the intended partner like it would under normal operating conditions, but forwarding the traffic on all ports (except the source port).

This would potentially allow an attacker to listen to your communication with the router's admin page and potentially sniff the admin password.

Is this feasable? This is for you to decide, but I personally would assume that if a device in my home has become infected, I have different worries.

Connection over W-LAN without any Security

This is a situation you definitely want to avoid.

                                                                Unencrypted W-LAN

           ((( O )))                                               ((( O )))
               |                                                       |
               |                                                       |
+--------------+-+                                                   +-+--------------------+
|                |                                                   |                      |
|  Your Computer |                                                   | Your Wireless Router |
|                |                          ((( O )))                |                      |
+----------------+                              |                    +-+--------------------+
                                                |                      ^
                                 +--------------+-+                    |
                                 |                |                    v
                                 | Other Devices  |                  +-+--------------+
                                 |                |                  |                |
                                 | (May be evil)  |                  | Other Devices  |
                                 |                |                  |                |
                                 +----------------+                  +----------------+

Communicating wirelessly without any encryption is the same as yelling any and all of your data at the top of your lungs, constantly. Any script kiddy "advanced persistent nuisance" in your neighborhood who ever watched "üb3rh4x0rZ 1337 guid3 t0 wifi haxxing" can sniff your data, connect to your network, and in general be nasty to you.

Don't do this. Please.

Connection over W-LAN with Encryption

This situation isn't as bad, but potentially dangerous.

                                                                Encrypted W-LAN

           ((( O )))                                               ((( O )))
               |                                                       |
               |                                                       |
+--------------+-+                                                   +-+--------------------+
|                |                                                   |                      |
|  Your Computer |                                                   | Your Wireless Router |
|                |                          ((( O )))                |                      |
+----------------+                              |                    +-+--------------------+
                                                |                      ^
                                 +--------------+-+                    |
                                 |                |                    v
                                 | Other Devices  |                  +-+--------------+
                                 |                |                  |                |
                                 | (May be evil)  |                  | Other Devices  |
                                 |                |                  |                |
                                 +----------------+                  +----------------+

If your "encryption" is based on WEP, then there might not be any at all. WEP is broken beyond repair, and the "advanced persistent nuisance" we spoke about in the last section can crack your key in a matter of minutes.

If your encryption is WPA2-PSK (using AES, not TKIP) with a long, random password and a unique SSID, then you should be fine. The situation is still not ideal, because sensitive data is still transmitted over the air and any wireless device knowing your key could potentially listen to it.

What does this mean? What should I do?

Simply put, connect to your router directly and you should be fine in the vast majority of realistic cases. You will probably not connect to your router's admin page that often, maybe to add a new port forwarding configuration, or to reboot it remotely if the network is bad again.

Other than that, you have the options of using open-source software such as DD-WRT. If your router is supported, then flashing it should be relatively easy. This might void your warranty, so be careful.

Finally, you can just buy a different router. Most stores are required to take it back within a certain period of time for any reason. If you say "the thing doesn't do what I need it to do", then that's reason enough.

  • Also, everything else can probably be disconnected from the device while configuring it, as home routers are seldom serving any critical networks that can't handle the downtime. – Esa Jokinen May 14 at 11:12
  • I like your "drawings" do you do them manually or is there a tool out there? (And you're answer is good too) – Azteca May 14 at 19:08
  • I use asciiflow to make them. It takes a while to get used to them and sometimes it acts weird, but luckily it's easy to fix any weird behavior afterwards. – MechMK1 May 15 at 8:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.