Skip to main content
168 votes
Accepted

Buying a "Used" Router

Short answer: do a factory reset, update the firmware, and you are good to go. The risk is very low, bordering zero. The previous owner may have installed a custom firmware or changed its ...
ThoriumBR's user avatar
  • 54.5k
138 votes

If I delete my router's history can my ISP still provide it to my parents?

If I delete my router's history, is it still visible and can my ISP still provide it to my parents? Or is it deleted from existence? Your ISP's record of your network usage isn't in any way affected ...
T.J. Crowder's user avatar
124 votes
Accepted

Did I just get DNS Hijacked?

Yes, your router's primary DNS entry was pointed to a rogue DNS server to make devices in your network resolve apple.com and other domains to phishing sites instead. The router possibly got ...
Arminius's user avatar
  • 44.9k
102 votes
Accepted

Is removing the Ethernet cable from the router (when I'm not using it) a good security measure?

If there is not an internet connection to your device then a hacker is not going to be able to communicate with that device. (Edit: As some have pointed out...this is assuming an attacker is ...
nd510's user avatar
  • 1,748
83 votes

Do multiple routers increase security?

It may look good on paper, but it's a terrible idea. You assume that the only way to get in your PC is from the first hop, the router closer to you, and that to hack one device, the previous one ...
ThoriumBR's user avatar
  • 54.5k
68 votes
Accepted

Can someone without the WiFi login and no physical access to a router still access it with the admin login?

This may be possible using cross-site request forgery. In this attack, the attacker triggers a request to your router, for example by including an image on his site: <img src="http://192.168.1.1/...
Sjoerd's user avatar
  • 31k
56 votes
Accepted

Safe to download router firmware over unencrypted HTTP?

Sure - it could be a signed image. If the router has a built-in public key, and the image was signed by the corresponding private key, it would be perfectly safe. Unless someone had got the private ...
Matthew's user avatar
  • 27.4k
46 votes

Is it dangerous to use default router admin passwords if only trusted users are allowed on the network?

As you correctly noticed CSRF attacks are a possibility. Prevention of CSRF attacks is possible with a CSRF token, but this is nothing you can do as the user of the router. So if you are a router ...
Steffen Ullrich's user avatar
46 votes
Accepted

Is it dangerous to use default router admin passwords if only trusted users are allowed on the network?

Is it dangerous to use default router admin passwords if only trusted users are allowed on the network? Yes, it's dangerous. Here are a few more "technical" ways to do it (other than saying ...
Mark Buffalo's user avatar
  • 22.5k
43 votes
Accepted

Is it safe to buy a router if its serial number and other details are exposed on the web?

Yes this is safe. Default password and PIN are irrelevant if you change them (or replace the firmware.) Serial number is irrelevant anyway. Part number is irrelevant anyway. Which leaves the MAC ...
fork2execve's user avatar
38 votes

If I delete my router's history can my ISP still provide it to my parents?

Routers usually do not store history and ISPs, while they may record such things on internal logs, do not give them out to anyone without a court order. You do not need to worry about your parents ...
forest's user avatar
  • 66.9k
38 votes

What can be intercepted more easily, WiFi or Ethernet on a fully compromised router?

The medium doesn't matter. To the router's operating system, IP packets are IP packets are IP packets.
vidarlo's user avatar
  • 16.6k
32 votes

Is removing the Ethernet cable from the router (when I'm not using it) a good security measure?

This would reduce your risk by minimizing the time the attack surface is vulnerable to attack so yes technically it is a helpful security control. It falls into the category of Layer 1 access control ...
Trey Blalock's user avatar
  • 14.2k
30 votes

Is it something to worry about when my browser warns me that my connection to 192.168.1.1 (router admin page) is not secure?

No public Certificate Authority (CA) will issue a certificate for any IP address. Certificates are issued on domain names, and a basic DV certificates (like the ones that Let's Encrypt hands out) ...
Ghedipunk's user avatar
  • 6,050
29 votes

How to verify if router firmware is legitimate

There is no generic way to check if a downloaded firmware is the original one. A vendor might provide tools for this or not. But a properly designed update process would already include that the ...
Steffen Ullrich's user avatar
28 votes
Accepted

How to force clients to connect to WiFi automatically?

You can't simply Force a client, but to trick him! As long as the device's WiFi is running, it keeps sending probe requests, searching for your previous connected networks. Using some software like ...
Eibo's user avatar
  • 2,495
23 votes

Is it dangerous to use default router admin passwords if only trusted users are allowed on the network?

Yes, routers have been compromised by malware executing inside the network, testing a list of default passwords. The malware enters the network through an infected phishing attachment, or a browser ...
John Deters's user avatar
  • 34.3k
23 votes

Safe to download router firmware over unencrypted HTTP?

It is probably safe. But downloading over https should be preferred if possible. Without https: If there is a flaw in the signature mechanism, it can be exploited (example: https://github.com/...
Tom's user avatar
  • 2,105
23 votes

Buying a "Used" Router

The main risk is that the firmware has been replaced by a malicious version, which could make it possible to intercept all the traffic on your network. Passwords, injecting malware, redirecting you to ...
schroeder's user avatar
  • 131k
21 votes

Is it dangerous to use default router admin passwords if only trusted users are allowed on the network?

I find it extraordinary that this question was asked, and I am not even a security professional. It is a bit like asking "Is it OK to leave the bank vault unlocked if only trusted cashiers are ...
Staycator's user avatar
  • 227
21 votes

Did I just get DNS Hijacked?

It's obvious that someone changed DNS entries inside your router, probably using default credentials. You should go with factory reset, update your firmware, change default credentials and disable ...
Mirsad's user avatar
  • 10.2k
21 votes

Can someone without the WiFi login and no physical access to a router still access it with the admin login?

Almost all routers are configured by default to only expose the administration interface to the "LAN" side and not to the internet. Some routers have the option to enable or disable this, so it would ...
Sjoerd's user avatar
  • 31k
18 votes

Buying a "Used" Router

By far, your main risk in buying an "open box" router is that the router has some subtle damage that the manufacturer didn't detect but that will ultimately reduce the lifespan of the device. That's ...
bta's user avatar
  • 1,121
16 votes
Accepted

Can I protect my router from a Mirai Worm and how do I know if I'm vulnerable?

Like your quote says; change the password. It would be much harder to fix if Mirai used 'actual' vulnerabilities (software bugs i.e. memory corruption). Then you'd have to hope there's an update ...
J.A.K.'s user avatar
  • 4,853
15 votes

Is removing the Ethernet cable from the router (when I'm not using it) a good security measure?

Given how many attacks are aimed at routers, the number of security flaws / backdoors in consumer grade routers, and the fact your router is an always-on gateway to the big bad internet, I'd say ...
John U's user avatar
  • 367
12 votes

If I delete my router's history can my ISP still provide it to my parents?

ISPs can absolutely log traffic upstream from your router. The easiest way for an ISP to inspect what users are doing is by inspecting logged dns queries. People can get around this by using non ISP ...
jorfus's user avatar
  • 441
11 votes

Can someone without the WiFi login and no physical access to a router still access it with the admin login?

Yes, easily. There are a variety of ways an attacker can gain access to said router. Here are some attack vectors I have on top of my head: Cross-site Request Forgery Basically, your browser is ...
kevin's user avatar
  • 933
11 votes
Accepted

How does Comcast know my WiFi password?

The PSK passphrase is (by design) stored in a retrievable format by the Modem vendor, in this case Arris, but the same standard is supported by many other modem vendors. In DOCSIS cable modems this ...
Scott Helms's user avatar
10 votes
Accepted

What's the difference between pixie attack and other attacks on WPS?

Pixie works by exploiting weaknesses in the generation of the E-S1 and E-S2 nonces which are used to produce the enrollee hash, as described in the Pixie Dust Attack. Traditional attacks attack the ...
Polynomial's user avatar
  • 135k
9 votes
Accepted

Modify the hosts file of the router and redirect trafic

It depends a lot on the router. Most household/everyday routers don't have the capability to implement local DNS like you're referring to. See here: https://superuser.com/questions/311877/why-do-most-...
Verbal Kint's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible