Is it possible to safely connect to the internet using a malicious router?

Question

If you connect to the internet using a router that's controlled by a hacker, is there some way you can safely surf the internet without getting hacked? By using a vpn and firewall maybe?

Does it make a difference what kind of router it is?

1. A wired router

2. A wireless router

3. A 4g usb dongle (Could this be used for a bad usb attack?)

Answer 1

If you use a VPN, Tor or 100%¹ HTTPS (w/o ignoring warnings) on your local machine to connect through the router to the internet than the attacker on the router cannot extract passwords or similar from your traffic and cannot manipulate the traffic. He can deny or delay the traffic though and in case of HTTPS he can at least see where you are connecting to in order to collect information about you or only disturb selected traffic. With HTTPS he can also intercept and manipulate plain² DNS requests and responses but this does not affect the security of HTTPS itself.

All of this is independent of how the router connects to the internet, i.e. it does not matter if 4G, DSL, fiber, cable or others. It also does not matter if you connect to the router with wire or wireless. With a "4g usb dongle" though you get additionally potential USB based attacks - although in this case (BadUSB) it is not enough for the attacker to be "at the router" but he has to be deeper in the firmware in order to make the USB device not behave like a router but like a keyboard or similar.

But even though your internet traffic is mostly protected, having an attacker on a local router means to have the attacker in the local network. Depending on the configuration of your system the attacker might attack your machine directly. A firewall on your local system which denies any connections initiated from outside will protect you from such network level attacks (i.e. not from BadUSB).

---

¹ Note that 100% HTTPS is unrealistic, there is usually at least some plain HTTP involved. And plain HTTP could be modified by the attacker on the router.

² Plain DNS means no DNS over TLS or DNS over HTTPS or otherwise protected DNS (like in DNSSec). Plain DNS is still the most common way of using DNS.

Answer 2

I'll break your question down into two sections: The risks associated with using a malicious access point; and whether the type of router makes a difference.

Risks associated with connecting to a malicious access point

Connecting to a malicious access point can expose you to several risks. An attacker may be able to:

• Perform a man-in-the-middle attack;
• Perform a downgrade attack;
• Perform a Session Sidejacking attack;
• Track your SSID/MAC-address;
• Exploit vulnerabilities and misconfigurations to gain access to your machine, and;
• Share malicious files with you.

A VPN - assuming it was configured correctly - would help mitigate the first three items on the list. Further mitigations built into modern some OSs would help further protect you from attack using the last two vectors on the list

Does the type of router make a difference?

The type of router does make a difference. The threats associated with wired and wireless routers are broadly similar, however, it would not be possible to track someone using their SSID on a wired router for obvious reasons.

4G is considered safer than public wifi (assuming the malicious access point is public wifi). 4G devices connect to the Internet through their provider’s cellular connection. Instead of receiving a signal from an Internet Service Provider as the device would at home or work, it receives data from the cellular company in the same way it receives a mobile phone connection. However, it would be possible to attack a machine using a malicious USB dongle.

Answer 3

When using Tor the attacker can still control your path and in this way force you to use nodes he controls. So he can use traffic correlation attacks or just capture traffic at the exit node.

Depending on the skill of the attacker he can acquire legit certificates and also get access to https traffic.

With a VPN connection it depends on the security of the endpoints. NordVPN has been hacked a while ago and private keys have been stolen. You could chain VPNs to mitigate that issue. Of course you have to trust the provider not to log your data.

Answer 4

VPN will help in this case, He will only be able to get the enrypted traffic, Traffic decryption and performing replay attack is another challenge. It depends upon the skills of hacker but while using VPN or encrypted channel you are some how safe but not completly safe.

Answer 5

There are different types of attacks for rogue or malicious APs, most common ones are to sniff and steal data. If that is the case:

I don't recommend the use of a VPN (at least not standalone) as you don't know (I guess) the attacker capabilities, they could set up the connection with SSLStrip or exploit a vulnerability of your VPN to still see and inject traffic. If you must (I don't see why you will do this), you can consider using Tor through a second router with WDS and DNS properly set up, to connect to the malicious router. Tor will protect you from sniffing even at a LAN level, plus a VPN will do the trick.

Of course it will worth to know more details about the malicious router beforehand, you can accomplish this using DNS probes, doing a port scan to the gateway while connected directly to the attacker, verify how the connection goes after you connect to the malicious router using traceroute to determine how is the AP configured, try to figure out if he uses the real MAC and if he does you can figure out the device he is using to outsmart the attacker.