Could it theoretically be possible to get a virus installed through inficted router? [duplicate]

Question

I was wondering if its possible to accidentally install malware and have it spread to your router/ethernet hub. Then reinstall windows and hard reset your drives so the virus has been removed from your computer. Could the virus that has spread to your router reinstall itself onto your new fresh clean install of windows? If so what would be the best solution to remove the virus from your router/home network(and pc)?

Answer 1

What you describe here would require a targeted malware, as the theoretical situation has certain restrictions. Therefore, it would be theoretically possible under very specific circumstances, but is still exceedingly unlikely.

Thinking of the following limitations, do you posses some information that is so valuable someone would use lots of resources to get it? In that case, would they really be scheming a sophisticated malware rather than breaking into your house and stealing your laptop? I doubt it.

Limitations

The operating system on your router is very different from Windows. It is tiny and specialized for forwarding network packets. Malware living on Windows generally cannot live on that kind of devices. Therefore, the malware would require capabilities of infecting both Windows and the specific operating system of your router; it would need to be targeted against Windows and a certain network device vendor.

Malware needs some kind of vulnerability it can use to run arbitrary code on the system it is going to infect. Many times on Windows the user is the weakest link that launches an executable they should not trust, or there could be a vulnerability in the browser that allows running arbitrary code when visiting a web page exploiting the vulnerability. Those are patched rather quickly, so updating your browser regularly is sufficient, and a browser would not just visit the page by itself.

On the other hand, a router needs to have a vulnerability that can be remotely exploited. There have been many vulnerabilities in home routers, but they are typically exploited from the Internet against devices that expose the vulnerable component towards the Internet, and then used, e.g., for further spreading the malware and adding the routers to botnets used for DDoS.

In this scenario, it would only require that the vulnerable component is exposed to the local network, which makes it slightly easier to exploit as the local network is more trusted. However, using a Windows malware to do that would be much less efficient, as it would require infecting the Windows PC first. Therefore, it is not something that would be done in scale.

The resources on a router are limited. The vulnerabilities may only allow running limited amount of arbitrary code, and the memory or storage on a router may not have enough space to store a malware that would be able to re-infect the Windows PC and do anything meaningful there after that, including the capabilities of infecting the router.

Lastly, there has to be two separate unpatched vulnerabilities on two different kind of devices at the same time. Once either of these are fixed, the malware becomes useless. Who would put that much effort on a single short lived malware when there are so many fruits hanging lower?

Plausible (but unlikely) scenario

Theoretically, if all the limitations mentioned above can be addressed and someone would have a reason to target you, these events could be possible:

1. You have a vulnerable browser because you did not update it last week.
2. Someone sends you a link to a web page that infects your Windows PC through your browser, downloads more malware and installs it to your computer.
3. The malware starts to search for a vulnerable router on your network and infects it. As a PC has the capacity required, it could have a library of exploits against different kind of routers.
4. The malware could, e.g., change the DNS settings in your router in a way that you would be visiting a malicious web page instead of a page you visit regularly. That would enable it to load more malware than would fit into the router.

Prevention

Prevention is highly based on reinforcing the limitations.

1. Keep all your systems and devices up-to-date. That will reduce your attack surface.
   • If your router is end-of-life / out of support, get a new one.
   • Spend some time getting to know your router. How does it get updates? Is it automated, or should you check them regularly? Does it have any Internet facing or otherwise unnecessary services you could disable to further reduce your attack surface?
   • On a re-installation, update your operating system first, download the latest version of your favorite browser from a trusted source, and compare the checksums, if available.
2. Be cautious.
   • Do not follow suspicious links on your email.
   • Double check the sources of your software downloads.
3. On a bit more paranoid level, you could reboot your router before connecting the newly installed Windows to it. That might remove some non-persistent malware on the router. You could also revisit your router's configuration so that everything is as expected.