Does an insecure computer on my home wireless network threaten other machines?

Question

I have a DD-WRT based wireless network with strong password security. However, other machines on the network may not be as protected as mine. If these machines are compromised, need I fear the attacker can more easily hack my machine, having gained access to another machine on the wireless network? We do not share domains.

Answer 1

It does indeed slightly facilitate a remote attack on your machine, since an attacker would be able to send you packets from your local network, rather than having to rely on NAT traversal from the router you use to connect to the Internet. You would still need to have network-facing services running on your machine, such as SMB/CIFS, Telnet, other protocols for local peer discovery (e.g. Bonjour), or the attacker would need to attack certain layers of your OS's network stack (since they can send you packets directly, although that's quite rare).

What you should be slightly more worried about are possibilities for ARP spoofing, DNS spoofing, and so on. If you start getting invalid certificate errors or seeing unexpected content whilst using the Internet on an untrusted local network (usually public WiFis, but a private WiFi with infected machines would work just as well) then you should be worried.

Answer 2

In short, yes.

I'm convinced the next wave of home PC compromises will stem from devices that we don't give a second thought about, such as TV's, BluRay players, Streaming Music Devices, etc that are connected to the internet through our home routers.

But, before I get sidetracked.....

The reasons it may be easier for your machine to be compromised by someone residing on your LAN:

• Most users don't enable a local firewall on their PC.
• The malicious user can attempt to crack your router password and you would be none the wiser.
• If other PC's on your machine are compromised they could be used to host illegal/copyrighted content and get your internet connection shutdown. (this doesn't affect your PC directly, but is a denial of service that would affect you)

If your router allows, I would recommend segmenting your network. Place the other users, or yourself on the guest network.

Answer 3

If a machine on your network is compromised, then yes you are very vulnerable. However, if you're password protected, have your sharing settings locked down, ports kept to a minimum or obfuscated, use a vpn, have a properly locked down router, updated computer, firewall, intrusion detection software, antivirus and the latest operating system fully patched then you're okay... sort of.

provided your router is secure, you could create a secondary network from the same router, the same way guest networks are created. This would isolate a local attacker pretty effectively, however this would only be as secure as your router is, and while it would still give you internet access, it would mean you can't communicate with any other device on the main network that the weak device is on. Alternatively, maybe just isolate weak devices?