1

I suspect that my home router was been hacked (with firmware upgrade), so that I would like to build and buy a new router enough secure. Something that can prevent not authorized firmware upgrade. I don't think that a username and a sophisticated password are enough because these data can be sniffed or captured with a simple code inject on the browser by a 0-day.

Maybe I need of a device that can be upgraded only by serial or that have a jumper that disallow firmware flashing. Then my questions are:

  • Is there such kind of home router?
  • Can u give me some advice to prevent such kind of intrusion?
Improve this question

3 Answers 3

Reset to default
6

Many routers can be flashed with custom firmware, e.g. DD-WRT, OpenWRT, or Tomato. These alternative systems have additional security features, for example:

  • Enforcing SSL-only administration.
  • Allowing HTTP(S) logins only internally, or only on wired connections.
  • SSH login with client certificates.
  • Stateful firewalls with more features than your average home router.
  • Advanced logging (e.g. log servers, SNMP traps, etc.)
  • Native IPsec support.
  • More advanced settings for wireless security (e.g. RADIUS)

On some of these systems you can also disable firmware uploads on the web panel entirely, to make it a little more difficult for attackers to do drive-by attacks.

Improve this answer
4

So you think that someone hacked into your router and upgraded the firmware internally on your network?

I use a Netgear WNR3500lv2, with the custom firmware tomato you can even disable http access locally, you can also disable the SSH daemon it gives you lots of other fancy features such as bandwidth monitoring, web monitoring, vpn client/server and so on.

But there are many other routers out there that support the Tomato firmware.

Tomato's official site

Tomato Shibby which i use

Improve this answer
1

You'll need to improve your security practices before a new router is going to help you much. If you don't know how your router got hacked, start there. Check your router settings, especially ensure that it cannot be administered from the web side. Check that your router has WEP turned off completely, and that the router is set to WPA-2 PSK security at a minimum. Create a new, very long, secure password for accessing the router. Use a different long password for your WiFi - something your guests can easily enter into their iPhones, but long enough to thwart brute forcing. Make sure that any holes allowing outside traffic to come into your network through your router are using holes you intended to have in it.

If you have (or can borrow) a known clean client, perhaps an iPad, Chromebook, or iPhone, use that device to set and change your router's password instead of your PC. It's less likely to have key logging malware on it than your PC.

It's entirely possible the intruder pwn3d your PC, or a PC belonging to a family member or other legitimate user of your router, possibly through a corrupt web page, an email virus, or other piece of malware, and used your own PC to modify your router's firmware. UPnP enables easy discovering of appliances like routers - it's sure easy for the hacker or malware to use the same mechanism to attack your firewall. Make sure all your equipment on the "safe" side of your firewall is clean and free of viruses, Trojan horses, rootkits, keyloggers, etc. Once your PC is cleaned up, go back and change your router's passwords again.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .