Is it possible to rebuild/make firmware for a router with a backdoor for attackers? I mean If attackers get access to a home router and they're make a new firmware with backdoor in case If I will change admin panel password?
Add a comment
|
2 Answers
Once a machine is compromised you can't even trust its "firmware update" feature anymore as you can't be sure it really does overwrite the current, malicious firmware. The only way to be sure would be to desolder the memory chips and rewrite them from a trusted computer or flash it via JTAG.
On the other hand, those firmware-reflashing attacks aren't common unless it's a targeted attack, so I would say you have nothing to worry about unless you have actual proof that your router was compromised.
-
Yes, thats a targeted attack. So anyway I can reflash firmware from original website by myself?– DmitryMar 14, 2015 at 23:11
-
Assuming you are sure the firmware is indeed compromised and is sophisticated enough to prevent its self-destruction (by you using the firmware upgrade feature), you can try, depending on the router, to boot in from TFTP from which the bootloader will reflash the firmware without booting the (compromised) firmware, and even then it's not 100% sure as the bootloader itself can be compromised. The only safe solution would be reflashing via JTAG : wiki.openwrt.org/doc/hardware/port.jtag or unsoldering the memory chips. Cheaper and easier, just buy a new router.– user42178Mar 14, 2015 at 23:22
-
Thanks for response. What possible security causes while Im using compromised router?– DmitryMar 14, 2015 at 23:30
-
A router is just a tiny Linux/UNIX computer, equally dangerous as having any other compromised machine on the network. The attacker can sniff traffic, do MITM attacks, and try to compromise your other computers. As always, a firmware rewriting attack like the one you described is uncommon and unless you have a government agency behind you or have very valuable data, I wouldn't worry. Otherwise just buy a new router, but keep in mind the possibility of your other machines being compromised as well if you're such a high profile target.– user42178Mar 14, 2015 at 23:34
Firmware-rewriting attacks on routers are theoretically possible, but they're not common. An attacker would need to tune the firmware to the exact model and hardware revision involved (for example, a WNDR 3700 v2 and a WNDR 3700 v3 are completely incompatible). Further, some routers require the firmware to be signed by the manufacturer; duplicating this signature can be extremely difficult.
It's much easier just to assume that the firmware bugs or weak passwords that let you in the first time will continue to work -- almost nobody pays attention to their router after setting it up.
-
Once you've got root it's possible to reflash the entire MTD, including overwriting any bootloader that may do signature checking. Of course, rewriting such a bootloader is not trivial but possible for a targeted attack.– user42178Mar 14, 2015 at 22:16
-
@AndréDaniel, that requires getting root, which is substantially harder than guessing the admin password.– MarkMar 15, 2015 at 2:27