I am behind a router(linksys that runs dd wrt on it) and I was infected with sality. I'm curious, can my router get infected too? If yes, how can I remove the infection?
I used the search bar but found nothing relevant.
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Absolutely. Given that you can modify the firmware on a router, you could infect it with a virus if you were so minded. DD WRT is Linux-based; some routing equipment uses OpenBSD or one of the other BSDs.
However, generally speaking, routers are fairly stripped down pieces of kit - i.e. they run very cut down versions of Linux, or OpenBSD - and as such, the attack surface is much, much smaller than your desktop - in English, there's fewer places you're likely to find a security hole. Short of persuading a user to upload a malicious update, your average router probably doesn't have that many vulnerabilities in it, especially when the default configuration is to drop all incoming connections (connections that originate from the internet side of the router).
That's not to say people won't try though; for example, there have been a number of published exploits against Cisco kit, for example this one.
There is also a value-of-target factor to consider. With home routers, there are many different possible configurations and no standard operating system; they're not even guaranteed to be running x86 processors - I'd suggest an ARM variant would be more likely. Cisco kit is likely to be a much more attractive proposition since there is a lot of it in big businesses and the software on it is likely to be similar, meaning attacks might work across multiple models. This is the same idea that attacking Windows is a much more attractive proposition than attacking Linux, because there are many more Windows installs to target.
If you're asking "is my router likely to be compromised?" I'd say the chances are pretty slim. If you want to check if exploits exist, have a search for vulnerabilities against that model and see what you find.
Yes, routers can get infected. Typically they are just Linux boxen with a web server providing an admin interface, and a bunch of sockets and radios to provide networking. I've certainly had one before that, out of the box, had a weak default password and would listen on the public (DSL) interface for the admin server.
But do routers get infected? Yes. An example is psyb0t, which used the default weak state of Linksys routers to grow a botnet. It didn't permanently infect the systems: turning them off removed the malicious code. But routers are typically left on for days at a time, and it can be hard to tell when one is infected.
Yes - if there is a vulnerability and the configuration changes to allow someone external to re-load their software, your router will be compromised.
Typically, you can reset the password (or log in if it wasn't changed) and re-load the router with known good firmware/software to undo whatever was done.
You will of course have to find and patch the vulnerability or find it altered again.
The Sality Malware attack is a Win32 based infection, that then uses the known behaviour and limitations of common brand/model ADSL router's firmware to compromise the DNS settings (among other things).
Unless they find some way of also attacking DD-WRT / OpenWRT, then NO your router did NOT also get infected.