What checks should I perform to ensure my router is malware free? This is for a home network

  • What kind of device? What kind of access do you have to the router? It is going to depend almost entirely on that. – multithr3at3d Aug 23 '20 at 4:28

Checking a router for malware or tampering is tricky, as that would require being able to compare both firmware and configuration with known good versions. Comparing configuration could be done by comparing configuration backups, if the device has such functionality, but that doesn't really work for firmware. Therefore, there's no really sufficient way to ensure the router is free of malware.

However, some infections & router hijacks can be recognized from the modified behaviour in the network:

  • Signs of man-in-the-middle (MITM) attacks (independent of which device is used).
  • Reports from the ISP that the Internet subscription is used for malicious actions. If the router is infected, such actions likely continue despite there's no devices behind the router.
    • as a part of distributed denial-of-service (DDoS) attacks
    • for sending spam email.
  • Nice answer! +1 I'd add that the solution to ensure it is not infected (even though it does not check if it ever was) is to factory reset. (How to factory reset not just settings but also firmware in a safe way is not always easy or obvious, though.) – Anders Sep 22 '20 at 7:47
  • 1
    If firmware overwrite is even possible i.e. there's e.g. some serial port on the board allowing a pre-boot overwrite. Submitting the firmware via web form isn't necessarily effective, if the malware has disabled that functionality, only faking it still works. – Esa Jokinen Sep 22 '20 at 19:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.