Security implications of an exploited router

Question

So I completely understand that routers and local networks need to be kept locked down, etc. What real security threats can come about from an attacker who has remotely accessed (telnet or web gui) your home router?

Out of personal interest, I have set up a few test scenarios on my personal network where an attacker may have modified router settings. I found these two features to be the most dangerous.

1. DMZ each individual client on the LAN (or port forwards)

   • Enabling direct port scans & possible exploits (nmap & Metasploit)

2. Evil DNS Servers

   • Domain names can be forwarded to evil clone sites (ex. SET) allowing for credential nabbing & possible remote shells.

Every other setting in a router seems to just further these two basic ideas in some way or another. So what real dangers lurk behind unprotected routers? Can 'evil' software be installed over telnet. Can traffic be sniffed and SSL stripped? Is there anything really beyond forwarding ports and spoofing DNS? Does an exploited router do anything beyond making the connection between the attacker and victim transparent?

Answer 1

The impact will always be severe, but a lot of the specifics depend on the individual router. If the device runs embedded Linux (e.g. DD-WRT) it may be possible to remotely enable SSH and add a public key to auth_keys, giving full remote shell access.

Without SSH, I can see the following issues:

• Rogue DNS
• DMZ'ing internal IPs
• Arbitrary port forwarding
• Allowing IPsec / L2TP through the firewall (could hit internal VPN endpoint)
• Backdoored router update
• Modifying routing tables
• Fingerprinting of internal systems (often easy to see host names, IPs, sometimes OSes too)

With SSH, we can add some more stuff on top:

• Uploading arbitrary tools, e.g. sslstrip / sslsniff - MitM is easy.
• Exposing a VPN endpoint, allowing more remote attacks
• Installing malware (e.g. botnet node)
• Directly attacking internal systems.

In terms of getting remote shell access without it being a full Linux system, it very much depends on the router. Telnet may well only be used to send new firmware images, or it could have much more functionality. The firmware images might be signed, or they might not. It all depends.

Answer 2

Your router processes all your traffic, so someone with control of your router could see everything you do by acting as a man in the middle. They could direct you to any site they choose by NATing the destination. They could also use NAT to open a direct connection to your computer, allowing them to attack it directly. That's all without installing custom firmware on it, which would give them even more control.

In other words it would be a bad thing.

Answer 3

Might also be worth noting that there are a lot of devices which depend on being "hidden" from the world as part of their security. Once your router is compromised it's possible to find and to trick these devices.

Example of an attack on a printer: http://www.guardian.co.uk/technology/2012/jul/23/hacking-attack-printers

So an extended effect of a compromised router may be that a lot of stuff that we take for granted as being safe behind the firewall, now become added attack paths. Or even an attack path that can be maintained once the router exploit is discovered and fixed.

Just think about how many Smart TVs there are, or whole house automation systems are being installed by Internet/TV companies.