0

So, suppose you gain access to my wifi router through some attacks (may be brute-force). After a days or two I changed my wifi password with more complexity. So what can you(a attacker) do to again to gain gain access to the same network? Will it be possible that the attacker make some configuration in my router and then make it venerable so that he can crack it much much faster and easier the next day.

1

Assuming the attacker got your WiFi password but NOT your router administration password (they are not the same thing!), then it's unlikely the attacker can do anything to re-establish access to your network.

In theory they could have attacked devices on your network (such as your PC, phone, IoT/"Smart Home", or the router itself) to attempt to leave a "back door". How hard this would be depends on what devices you have on the network, how secure they are inherently against such attacks (phones are generally pretty good, IoT generally very bad), and whether you have given them strong passwords and other security configurations (home routers used to ship with a default password - often just "admin" - for example).

If the attacker got into the router - either because the password was guessable, because it wasn't configured to require one, or because they exploited a pre-auth vulnerability on it - then there's a lot they can do. They could turn on external (remote) management so they can get into it without being on your WiFi, through your Internet connection. They could create a second WiFi network (from the same router, with access to your local network and Internet) and hope you don't notice. They could turn off its firewall. They could potentially even set it to proxy all your Internet traffic through their own computer, on the Internet. What's more, those are just things that might be possible from the official admin interface, but most home routers are vulnerable to command injection attacks allowing an attacker to run arbitrary programs on them. Thus, the attacker could do all sorts of things, including installing a remotely-accessible back door in the router, intercepting all Internet and local traffic on your network, launching attacks against other devices, etc.

Similarly, depending on how secure your other devices on the network are, an attacker could potentially have done lots of other harm. For example, if you have file sharing enabled on your PC, they could potentially have read any files you shared, and maybe overwritten them; if they could overwrite an executable file then they could have arbitrary code running on your PC now.

Additionally, they could in theory have done some harm to you by abusing your Internet connection. For example, downloading pirated media (they don't care if you get sued or your ISP cuts your connection) or even doing criminal stuff like launching attacks on other sites or dealing in child porn or similar (they don't care if you get arrested; it's just cover for them).


Realistically, though, they were probably just somebody who wanted Internet access for, at worst, watching porn they don't want their dad to see in their own router logs, or something. They might have noticed any other devices that were advertising file shares or similar, maybe even tried some obvious password guesses (such as "the same as the WiFi password"; never reuse passwords) but the odds of them actually trying to leave backdoors or commit other crimes is pretty low.

1
  • Thanks for all the description and that's what i need. I was forgetting about your first point( capability to do remote management ) Sep 12 '20 at 12:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.