Are consumer-grade routers any more or less vulnerable? [closed]

Question

I apologize if this is an obvious question, I'm not very familiar with hardware.

I am planning on hosting a few personal websites from my home, but I'm concerned about my security. I'm using a fairly old cable router (probably around 10 years old I would guess, it's ASUS RX3041). I was wondering if it would be possible for an attacker to send some malicious packets and gain access to my router or be able to send packets to computers connected to the router on ports that are not mapped, or any other exploit, really.

Even if the router was compromised, the server should still be secured with its own firewall and what not but what I want to know is if I can rely on the router as a security layer.

Is it reliable to host a website with my current setup?

Answer 1

TL:DR - Yes, routers CAN be vulnerable.

Misconfigured/Unconfigured routers - A ton of people just install their routers and leave the default accounts turned on without modification. Thus allowing attackers easy access.

Vulnerable built in scripts - http://www.reddit.com/r/netsec/comments/1xy9k6/that_new_linksys_worm/

See:

• What is the "Moose" worm and how can I protect myself from it?

• http://www.pcworld.com/article/2899732/at-least-700000-routers-given-to-customers-by-isps-are-vulnerable-to-hacking.html

• http://www.pcworld.com/article/2464300/fifteen-new-vulnerabilities-reported-during-router-hacking-contest.html
• http://searchsecurity.techtarget.com/news/4500246976/NetUSB-router-vulnerability-puts-devices-in-jeopardy

As for answering whether your 'current setup' is secure. We would need a bit more information about the entire scope of your security onion before being able to answer that.

Answer 2

Other answers have been given to answer whether routers are secure: your router likely has unpatched vulnerabilities.

A recommendation for making things more secure would be to put a real Linux box in front of your router. Configure it for automatic security updates every 10-30 minutes so your patches come quickly. For kernel vulnerabilities, you could use something like KSplice (have to pay for it, unfortunately) which can patch these vulnerabilities in a running Linux kernel, ie without a restart.

What you'll likely want to do is setup your network like this:

Note that "Network Partition" and "Server DMZ" don't have to be physical devices, but can be. The above setup puts your workstations in one subnet and your server(s) in another subnet. This is called a "De-Militarized Zone," or a DMZ for short. Having the servers in a DMZ allows you to limit what can connect into the DMZ from the workstation network and vice versa. A compromise of a server in the DMZ can be limited to stay within the DMZ. A compromise of a device in your workstations/WiFi devices, etc. can be limited to not be able to hit the DMZ.

By the way, this is why you shouldn't host things at home if you can help it. Managing a network is something I believe you don't want to be a full-time job.

Hope this is helpful.

Answer 3

A router is actually a small computer; most of them use the same kind of software as full-fledged servers (typically some Linux variant). As such, it has security holes, that should be patched promptly when discovered. Vulnerabilities that are not fixed might be exploitable and yield remote control to attackers, at which point they can do what they want with the router, and, in particular, see all your internal traffic (unless blocked by further firewalls). The real problem here is that software upgrades on routers is rarely done; it is called a "firmware update" and almost never done.

Most cabled-based ISP provide the modem and tend to consider that the modem is still theirs, not yours. Some will push firmware updates on their own accord, without any warning. Some will try to automatically block at the network level incoming connection attempts that look like attacks on known vulnerabilities. Some don't care.

Some ISP may also claim that by hosting "servers" you are breaching the usage conditions, and then block your Internet access or charge you more. In any case, ISP apply asymmetric bandwidth, with a lot more download than upload. In my experience(*), server hosting at your home, while possible, is not really worth the effort. You have to take care to fly under your ISP radar (or to use one of the rare ISP that do not mind about "server usage"), and the performance is poor. Renting a server somewhere (a simple VPS) is cheap, faster, and way less hassle.

^{(*) My experience includes running the master DNS for my own domain, and my mail server, from a home machine. I don't do it anymore.}

Answer 4

Consumer grade routers are frequently more vulnerable than professional grade for the following key points:

1. They usually only work through web or graphical interfaces, where errors strike at the speed of the click. The click being the one of the owner, of the cat or of the attacker.

2. They usually have a web server embedded which is in itself a huge amount of code with a proportionnal amount of vulnerabilities. For models I had hands on, this web server couldn't be inactivated. On professionnal grade server it can easily be turned off, thus closing a serious amount of weaknesses.

3. They don't get the same level of quality control and security fixes updates.

4. They much too often embed easy remote admin and debugging functions which are not publicly advertised because of the target market: consumer grade. These admin and debugging functions are well known of network professionals and cyber-criminals. This is a huge piece of security through obscurity. The truth is that it is no security.

I will end by an answer to a question you didn't ask but to which Naftuli Tzvi Kay made a pretty detailed answer: Linux box in front of your router

How would you sort the security level of three kind of equipments to connect to Internet:

a consumer grade router, a professional grade router, a Unix server running as a firewall router ?

Here is my practical professionnal experience on about a hundred of such equipments:

1. Unix server configured as a router and firewall

2. Professionnal grade firewall router

3. Consumer grade firewall router

Answer 5

There are some good answers here, but I wanted to highlight that there has bee a LOT of research findings recently which show that the security of domestic, small business routers has been very poor. In particular, some major manufacturers, such as Netgear, TP Link Linksys etc have been found to have some very poor practices, such as using the same ssh key on all models, including USB and virtual USB support which is not secure, running services which lack adequate protection from being exploited as part of a DDoS amplification attack etc.

Of course, there is no guarantee that more expensive 'enterprise' routers will be any better.

These days, hosting web sites on your home connection is rarely a good idea. Once upon a time, it has significant financial benefits, but I think these days, there are very good and competitive hosting options which are a far better choice. The reality is people expect more these days i.e. hosting which includes UPS, backups, redundency, etc. The level of security threats has increased to the point where just keeping things up-to-date is overwhelming. Find a good hosting company and see what sort of deal you can get.