15

I apologize if this is an obvious question, I'm not very familiar with hardware.

I am planning on hosting a few personal websites from my home, but I'm concerned about my security. I'm using a fairly old cable router (probably around 10 years old I would guess, it's ASUS RX3041). I was wondering if it would be possible for an attacker to send some malicious packets and gain access to my router or be able to send packets to computers connected to the router on ports that are not mapped, or any other exploit, really.

Even if the router was compromised, the server should still be secured with its own firewall and what not but what I want to know is if I can rely on the router as a security layer.

Is it reliable to host a website with my current setup?

closed as too broad by D.W., Mark, Lucas Kauffman, Steve, Xander May 30 '15 at 14:16

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Also, watch out for CSRF attacks. – Aatif Shahdad May 28 '15 at 20:14
  • @Aatif How is that related to networking. I made up a pretty neat csrf protection technique which is utilized without actually storing the tokens rather than encrypting them. I guess I should ask another question on this approach another time. It may, as usual, turn out to be not as good as I think :D – php_nub_qq May 28 '15 at 20:48
  • 3
    @php_nub_qq there may be CSRF vulnerabilities in the router's admin interface. – user42178 May 28 '15 at 22:57
  • 1
    One important thing to consider: if the router is 10 years old, does your provider still patch it for vulnerabilities or is it no longer supported? – Jörg W Mittag May 29 '15 at 6:45
  • 2
    @php_nub_qq it's really not that hard. Send the person a link on social media to a post on any site/forum which allows img tags to arbitrary URLs, and use the default IP of the router which is almost never changed. The hard part would be to figure out which router the person has, but once that's done it becomes pretty easy if the device is vulnerable. – user42178 May 29 '15 at 15:39
22

TL:DR - Yes, routers CAN be vulnerable.

Misconfigured/Unconfigured routers - A ton of people just install their routers and leave the default accounts turned on without modification. Thus allowing attackers easy access.

Vulnerable built in scripts - http://www.reddit.com/r/netsec/comments/1xy9k6/that_new_linksys_worm/

See:

As for answering whether your 'current setup' is secure. We would need a bit more information about the entire scope of your security onion before being able to answer that.

  • 1
    Plenty of routers don't even allow the owner to change the default account (the last 5 I've owned haven't) – Jeremy List May 29 '15 at 8:19
  • 1
    @JeremyList that sounds pretty bad to me, I wouldn't own such a device. – php_nub_qq May 29 '15 at 15:39
  • @php_nub_qq Sometimes you have no choice. There's a huge multi-national company group, that has a company here in Portugal, which distributes routers with extremely weak passwords (easily guessable from their SSID) to the general public, without any option to create a new user and to disable the default ones (guess and admin). If you don't use that equipment, you will need to buy your pricey router. – Ismael Miguel May 29 '15 at 16:48
  • @IsmaelMiguel well you can always purchase online, ebay and what not – php_nub_qq May 29 '15 at 18:04
  • 1
    @php_nub_qq It indeed is a bit chatty. I know we can't put a price on security, but we aren't in a perfect world. Everything here is even more expecive thanks to turists. But anyways, for some reason you may not be able to get a new router and that is another factor that should be added (in my opinion) to the answer. – Ismael Miguel May 29 '15 at 19:09
13

Other answers have been given to answer whether routers are secure: your router likely has unpatched vulnerabilities.

A recommendation for making things more secure would be to put a real Linux box in front of your router. Configure it for automatic security updates every 10-30 minutes so your patches come quickly. For kernel vulnerabilities, you could use something like KSplice (have to pay for it, unfortunately) which can patch these vulnerabilities in a running Linux kernel, ie without a restart.

What you'll likely want to do is setup your network like this:

enter image description here

Note that "Network Partition" and "Server DMZ" don't have to be physical devices, but can be. The above setup puts your workstations in one subnet and your server(s) in another subnet. This is called a "De-Militarized Zone," or a DMZ for short. Having the servers in a DMZ allows you to limit what can connect into the DMZ from the workstation network and vice versa. A compromise of a server in the DMZ can be limited to stay within the DMZ. A compromise of a device in your workstations/WiFi devices, etc. can be limited to not be able to hit the DMZ.

By the way, this is why you shouldn't host things at home if you can help it. Managing a network is something I believe you don't want to be a full-time job.

Hope this is helpful.

  • 3
    I read somewhere that Linux 4.x will have livepatching support in the mainstream kernel. So maybe it will soon be accessible to everybody without having to pay for KSplice. – kasperd May 28 '15 at 21:04
  • 1
    If that's the case, Linux 4 can't come soon enough. This shouldn't be something users have to pay for. I'm disappointed that KSplice took the route it did. I understand that there are bills to pay, but it's good to hear that this may be coming to mainline. – Naftuli Kay May 28 '15 at 21:10
  • I'm disappointed that so many people get so disappointed when they are asked to pay a fair price in trade for some amazing software. Where did this expectation of "something for nothing" come from? That being said, KSplice is monumentally expensive, so refer to your own penultimate paragraph, I guess. :) – Lightness Races in Orbit May 29 '15 at 2:48
  • Why would you call that router the network partition? – munchkin May 29 '15 at 7:16
  • @munchkin It's more of a concept and not a physical device per se. The idea is having separate subnets for the DMZ and client networks, firewalling access between them and between them and the internet. – Naftuli Kay May 29 '15 at 7:53
6

A router is actually a small computer; most of them use the same kind of software as full-fledged servers (typically some Linux variant). As such, it has security holes, that should be patched promptly when discovered. Vulnerabilities that are not fixed might be exploitable and yield remote control to attackers, at which point they can do what they want with the router, and, in particular, see all your internal traffic (unless blocked by further firewalls). The real problem here is that software upgrades on routers is rarely done; it is called a "firmware update" and almost never done.

Most cabled-based ISP provide the modem and tend to consider that the modem is still theirs, not yours. Some will push firmware updates on their own accord, without any warning. Some will try to automatically block at the network level incoming connection attempts that look like attacks on known vulnerabilities. Some don't care.

Some ISP may also claim that by hosting "servers" you are breaching the usage conditions, and then block your Internet access or charge you more. In any case, ISP apply asymmetric bandwidth, with a lot more download than upload. In my experience(*), server hosting at your home, while possible, is not really worth the effort. You have to take care to fly under your ISP radar (or to use one of the rare ISP that do not mind about "server usage"), and the performance is poor. Renting a server somewhere (a simple VPS) is cheap, faster, and way less hassle.

(*) My experience includes running the master DNS for my own domain, and my mail server, from a home machine. I don't do it anymore.

  • I'm pretty lucky I have a very good ISP, I can switch between using a public IP or hiding myself and using the modem's IP, I can also switch between high down low up and low down high up speeds and also a bunch of other stuff over the web without even speaking to them. Furthermore they have opened port 25 so I can host my own mail server (which may not necessarily be a good idea but still). The problem with hiring hosting is that most companies have very poor support and usually take too long to respond. The ones with good support charge extra for VPS, I do want to be able to install stuff. – php_nub_qq May 28 '15 at 19:13
  • 1
    @php_nub_qq I don't work for either company, but AWS or Digital Ocean could help you get what you want on the cheap. – Naftuli Kay May 28 '15 at 19:19
  • 1
    @php_nub_qq Try Openshift – rpax May 28 '15 at 22:47
1

Consumer grade routers are frequently more vulnerable than professional grade for the following key points:

  1. They usually only work through web or graphical interfaces, where errors strike at the speed of the click. The click being the one of the owner, of the cat or of the attacker.

  2. They usually have a web server embedded which is in itself a huge amount of code with a proportionnal amount of vulnerabilities. For models I had hands on, this web server couldn't be inactivated. On professionnal grade server it can easily be turned off, thus closing a serious amount of weaknesses.

  3. They don't get the same level of quality control and security fixes updates.

  4. They much too often embed easy remote admin and debugging functions which are not publicly advertised because of the target market: consumer grade. These admin and debugging functions are well known of network professionals and cyber-criminals. This is a huge piece of security through obscurity. The truth is that it is no security.

I will end by an answer to a question you didn't ask but to which Naftuli Tzvi Kay made a pretty detailed answer: Linux box in front of your router

How would you sort the security level of three kind of equipments to connect to Internet:

a consumer grade router, a professional grade router, a Unix server running as a firewall router ?

Here is my practical professionnal experience on about a hundred of such equipments:

  1. Unix server configured as a router and firewall

  2. Professionnal grade firewall router

  3. Consumer grade firewall router

0

There are some good answers here, but I wanted to highlight that there has bee a LOT of research findings recently which show that the security of domestic, small business routers has been very poor. In particular, some major manufacturers, such as Netgear, TP Link Linksys etc have been found to have some very poor practices, such as using the same ssh key on all models, including USB and virtual USB support which is not secure, running services which lack adequate protection from being exploited as part of a DDoS amplification attack etc.

Of course, there is no guarantee that more expensive 'enterprise' routers will be any better.

These days, hosting web sites on your home connection is rarely a good idea. Once upon a time, it has significant financial benefits, but I think these days, there are very good and competitive hosting options which are a far better choice. The reality is people expect more these days i.e. hosting which includes UPS, backups, redundency, etc. The level of security threats has increased to the point where just keeping things up-to-date is overwhelming. Find a good hosting company and see what sort of deal you can get.

Not the answer you're looking for? Browse other questions tagged or ask your own question.