Hot answers tagged

167

Short answer: do a factory reset, update the firmware, and you are good to go. The risk is very low, bordering zero. The previous owner may have installed a custom firmware or changed its configuration, but a firmware upgrade and factory reset is enough to take care of almost every change. The risk that the previous owner tampered with the router and his ...


138

If I delete my router's history, is it still visible and can my ISP still provide it to my parents? Or is it deleted from existence? Your ISP's record of your network usage isn't in any way affected by you doing anything to your router. You could wipe its memory, subject it to an EMP, and crush its chips to dust, and it wouldn't have any effect on them. :-) ...


123

Yes, your router's primary DNS entry was pointed to a rogue DNS server to make devices in your network resolve apple.com and other domains to phishing sites instead. The router possibly got compromised through an unpatched vulnerability in its firmware. I have an Asus AC87U, FW Version 3.0.0.4.380.7743 (1 release behind). Your release is over half a ...


103

If there is not an internet connection to your device then a hacker is not going to be able to communicate with that device. (Edit: As some have pointed out...this is assuming an attacker is attempting over the internet from a remote location) With that said, eventually you will have to connect to the internet again if you want to use the internet and if ...


91

Enforce Consequences for Students Found on the Network The first thing you need to do is ensure you have a written policy outlining what devices are allowed on the network. However, if you are not consistent in the enforcement of your policy, it is useless. This should also cover the usage policies for the Teachers, including locking their computers when ...


74

There are two different passwords that access different functions. If an attacker has the admin password, then he / she can change the SSID, WiFi password, and any other settings on the WiFi router. To fix: ensure your WiFi security setting is WPA or WPA2. Then change the WiFi password to a long one (at least 12 characters, more is better) with special ...


69

This may be possible using cross-site request forgery. In this attack, the attacker triggers a request to your router, for example by including an image on his site: <img src="http://192.168.1.1/reboot_the_router?force=true"> When a user visits his site, this triggers a request to the router. The attacker's site can trigger requests, but not view ...


59

Your IP is a public address and has nothing to do with your Facebook account. Just knowing it does not help someone to 'hack' you. In the same way, knowing your IP does not increase your threat of your computer being hacked. He's blustering.


56

Sure - it could be a signed image. If the router has a built-in public key, and the image was signed by the corresponding private key, it would be perfectly safe. Unless someone had got the private key, and uploaded a malicious version to the server, in which case, HTTPS wouldn't help either.


52

You are trying to solve the wrong problem. They are thousands and you are one. Since you are not a security expert (as far as I understand, sorry if I'm mistaken) and they aren't either but they are a horde, you are just bound to lose if you fight a conventional war. @AviD gave a great answer in a comment: Here is a non-technical idea: This is a school, ...


45

As you correctly noticed CSRF attacks are a possibility. Prevention of CSRF attacks is possible with a CSRF token, but this is nothing you can do as the user of the router. So if you are a router vendor you should definitely implement CSRF protection but as a user you have to live with what the vendor offers you and many vendors don't have proper CSRF ...


45

Is it dangerous to use default router admin passwords if only trusted users are allowed on the network? Yes, it's dangerous. Here are a few more "technical" ways to do it (other than saying it's bad): 1. No CSRF Protection You could be happily visiting a website, and there could be any number of issues with it: The website itself was haxored and has ...


44

Yes this is safe. Default password and PIN are irrelevant if you change them (or replace the firmware.) Serial number is irrelevant anyway. Part number is irrelevant anyway. Which leaves the MAC address. With some routers this is used to compute a default password, but once you change this I don't believe there is any risk. The biggest risk of any router ...


39

Is it possible to remotely connect to the Linksys device? Yes. Most routers have an online administrator page that can be accessed externally by visiting your public IP address (go check WhatIsMyIP.com too see yours). It's even easier internally by accessing the internal IP address of your router, which is in most cases either 192.168.0.1 or 192.168.1.1. ...


39

Routers usually do not store history and ISPs, while they may record such things on internal logs, do not give them out to anyone without a court order. You do not need to worry about your parents finding the naughty sites you visited unless it's in your browser history. Just turn on incognito mode and don't worry. While it is theoretically possible that ...


36

Giving the WiFi password away effectively gives full access to the local network. From there the guest might access the other computers inside the same network unless they have an additional protection. The guest can also try to brute force the router password, can mount man in the middle attacks with ARP or DHCP spoofing .... Because of this better routers ...


34

The wireless router is the gateway to your entire home network, from a wireless baby monitor, to the secure computers you do your banking on. Controlling this gateway gives an attacker access to the devices inside the network and to data that passes through it. It's no surprise that home routers are a new frontier for the criminal underground and default ...


33

A few years ago (2003), there was this worm called "Blaster" (or MSBlast, Lovesan etc. - read more on https://en.wikipedia.org/wiki/Blaster_(computer_worm)). It spread by using a vulnerability in an RPC service, running on Windows XP and 2000. At the time where it was "worst", you could get infected within minutes, if you didn't have a firewall set up. I ...


32

You don't need government grade malware to do this and such attacks have actually been carried out for years. Typical SOHO routers are often vulnerable to CSRF and similar attacks and this can be used by the attacker to compromise the router, i.e. changing critical settings like the DNS servers. This compromise can be executed when you visit a web site. It ...


32

This would reduce your risk by minimizing the time the attack surface is vulnerable to attack so yes technically it is a helpful security control. It falls into the category of Layer 1 access control in the OSI model. This said you are also losing data created by attackers at night which could be useful for trending attackers activity. It might still be ...


29

No public Certificate Authority (CA) will issue a certificate for a private IP address, such as the 192.168.x.x blocks. Because of that, I would expect that I would not see an HTTPS connection to a consumer-grade router in my network, and if I noticed such a connection (this assumes, of course, that I'd actually notice the lock icon when it shouldn't be ...


28

You can't simply Force a client, but to trick him! As long as the device's WiFi is running, it keeps sending probe requests, searching for your previous connected networks. Using some software like airodump-ng, you can easily sniff out those probes. Then the attacker may create a similar evil twin using the BSSID and ESSID gathered from the previous ...


25

Although it is not one of the things you listed in your question, he can engage in illegal activity over the internet which, when investigated by the authorities will render your IP as the source. Which, depending on the country you live in, may land in you in a lot of trouble.


23

Yes, routers have been compromised by malware executing inside the network, testing a list of default passwords. The malware enters the network through an infected phishing attachment, or a browser exploit. If you have the ability to validate the router can't be reconfigured outside of the local network, you not only have the ability to change the default ...


23

It is probably safe. But downloading over https should be preferred if possible. Without https: If there is a flaw in the signature mechanism, it can be exploited (example: https://github.com/QubesOS/qubes-issues/issues/2520 ) An attacker can know which firmware/version you install (so if there is known flaws in that firmware/version , it could be ...


23

The main risk is that the firmware has been replaced by a malicious version, which could make it possible to intercept all the traffic on your network. Passwords, injecting malware, redirecting you to malicious sites, etc. That's a worst-case scenario but easy for someone to do. You want to factory reset the device to try to clear out anything that the ...


21

I find it extraordinary that this question was asked, and I am not even a security professional. It is a bit like asking "Is it OK to leave the bank vault unlocked if only trusted cashiers are allowed in the basement?". One does not know where to start in responding. I half wonder if the question was an Ali G style windup, posted for sport. A default ...


21

It's obvious that someone changed DNS entries inside your router, probably using default credentials. You should go with factory reset, update your firmware, change default credentials and disable outside access to it. And yes that DNS 185.183.96.174 is coming from hackers, still alive... dig apple.com @185.183.96.174 This will return: apple.com. ...


21

Almost all routers are configured by default to only expose the administration interface to the "LAN" side and not to the internet. Some routers have the option to enable or disable this, so it would be good to check the settings of your router. You can also test this using an online port scanner or this ShieldsUP! tool. These will check if they can access ...


20

Your IP isn't public by default (every website you visit knows it, but that's it) and some random guy on Facebook shouldn't be able to get it. To get it he would need to trick you into visiting a website he controls or use other tricks (for example I think Skype leaked your IP for a while, don't know if they fixed it or he could possibly get it from an e-...


Only top voted, non community-wiki answers of a minimum length are eligible