Is it possible to rebuild/make firmware for a router with a backdoor for attackers? I mean If attackers get access to a home router and they're make a new firmware with backdoor in case If I will change admin panel password?


Once a machine is compromised you can't even trust its "firmware update" feature anymore as you can't be sure it really does overwrite the current, malicious firmware. The only way to be sure would be to desolder the memory chips and rewrite them from a trusted computer or flash it via JTAG.

On the other hand, those firmware-reflashing attacks aren't common unless it's a targeted attack, so I would say you have nothing to worry about unless you have actual proof that your router was compromised.

  • Yes, thats a targeted attack. So anyway I can reflash firmware from original website by myself? – Dmitry Mar 14 '15 at 23:11
  • Assuming you are sure the firmware is indeed compromised and is sophisticated enough to prevent its self-destruction (by you using the firmware upgrade feature), you can try, depending on the router, to boot in from TFTP from which the bootloader will reflash the firmware without booting the (compromised) firmware, and even then it's not 100% sure as the bootloader itself can be compromised. The only safe solution would be reflashing via JTAG : wiki.openwrt.org/doc/hardware/port.jtag or unsoldering the memory chips. Cheaper and easier, just buy a new router. – user42178 Mar 14 '15 at 23:22
  • Thanks for response. What possible security causes while Im using compromised router? – Dmitry Mar 14 '15 at 23:30
  • A router is just a tiny Linux/UNIX computer, equally dangerous as having any other compromised machine on the network. The attacker can sniff traffic, do MITM attacks, and try to compromise your other computers. As always, a firmware rewriting attack like the one you described is uncommon and unless you have a government agency behind you or have very valuable data, I wouldn't worry. Otherwise just buy a new router, but keep in mind the possibility of your other machines being compromised as well if you're such a high profile target. – user42178 Mar 14 '15 at 23:34

Firmware-rewriting attacks on routers are theoretically possible, but they're not common. An attacker would need to tune the firmware to the exact model and hardware revision involved (for example, a WNDR 3700 v2 and a WNDR 3700 v3 are completely incompatible). Further, some routers require the firmware to be signed by the manufacturer; duplicating this signature can be extremely difficult.

It's much easier just to assume that the firmware bugs or weak passwords that let you in the first time will continue to work -- almost nobody pays attention to their router after setting it up.

  • Once you've got root it's possible to reflash the entire MTD, including overwriting any bootloader that may do signature checking. Of course, rewriting such a bootloader is not trivial but possible for a targeted attack. – user42178 Mar 14 '15 at 22:16
  • @AndréDaniel, that requires getting root, which is substantially harder than guessing the admin password. – Mark Mar 15 '15 at 2:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.