Hot answers tagged

167

Short answer: do a factory reset, update the firmware, and you are good to go. The risk is very low, bordering zero. The previous owner may have installed a custom firmware or changed its configuration, but a firmware upgrade and factory reset is enough to take care of almost every change. The risk that the previous owner tampered with the router and his ...


138

If I delete my router's history, is it still visible and can my ISP still provide it to my parents? Or is it deleted from existence? Your ISP's record of your network usage isn't in any way affected by you doing anything to your router. You could wipe its memory, subject it to an EMP, and crush its chips to dust, and it wouldn't have any effect on them. :-) ...


69

This may be possible using cross-site request forgery. In this attack, the attacker triggers a request to your router, for example by including an image on his site: <img src="http://192.168.1.1/reboot_the_router?force=true"> When a user visits his site, this triggers a request to the router. The attacker's site can trigger requests, but not view ...


39

Routers usually do not store history and ISPs, while they may record such things on internal logs, do not give them out to anyone without a court order. You do not need to worry about your parents finding the naughty sites you visited unless it's in your browser history. Just turn on incognito mode and don't worry. While it is theoretically possible that ...


29

No public Certificate Authority (CA) will issue a certificate for a private IP address, such as the 192.168.x.x blocks. Because of that, I would expect that I would not see an HTTPS connection to a consumer-grade router in my network, and if I noticed such a connection (this assumes, of course, that I'd actually notice the lock icon when it shouldn't be ...


23

The main risk is that the firmware has been replaced by a malicious version, which could make it possible to intercept all the traffic on your network. Passwords, injecting malware, redirecting you to malicious sites, etc. That's a worst-case scenario but easy for someone to do. You want to factory reset the device to try to clear out anything that the ...


21

Almost all routers are configured by default to only expose the administration interface to the "LAN" side and not to the internet. Some routers have the option to enable or disable this, so it would be good to check the settings of your router. You can also test this using an online port scanner or this ShieldsUP! tool. These will check if they can access ...


18

By far, your main risk in buying an "open box" router is that the router has some subtle damage that the manufacturer didn't detect but that will ultimately reduce the lifespan of the device. That's one reason why they often have reduced warranties. Security-wise, the risk is negligible if you do a factory reset and re-flash the firmware. That should re-...


12

Yes, easily. There are a variety of ways an attacker can gain access to said router. Here are some attack vectors I have on top of my head: Cross-site Request Forgery Basically, your browser is connected to LAN. If you browser a page hosted on the attacker's server, then your browser is connected to it as well. Therefore, through your browser, the hacker ...


12

ISPs can absolutely log traffic upstream from your router. The easiest way for an ISP to inspect what users are doing is by inspecting logged dns queries. People can get around this by using non ISP dns servers such as 1.1.1.1 (cloudflare dns) or 8.8.8.8 (google dns) The next easiest is to actually log connections. To get around this, people use VPN or an ...


9

The PSK passphrase is (by design) stored in a retrievable format by the Modem vendor, in this case Arris, but the same standard is supported by many other modem vendors. In DOCSIS cable modems this is most commonly done via SNMP against this specific OID: clabWIFIAccessPointSecurityKeyPassphrase OBJECT-TYPE SYNTAX SnmpAdminString (SIZE(0..63)) ...


8

In short: If you really care about stuff like that, go into a retail store and buy a new router that's on stock. The risk is small, but you can't easily mitigate it. I could imagine some creep buying lots of routers, returning them and then spying on the people who bought them just for the kick of it. Or of course some evil organization. This risk is small, ...


7

What are the main risks in this scenario? I know this is not the intent of your question, but in my opinion the main risk is not to you, but to the previous owner. Chances are that the credentials of the previous owner are still present on the device. You may gain access to the account of the previous owner this way. Resold devices are often not cleared at ...


7

Your parents will not normally have the authority to retrieve data from the ISP. An ISP does not offer this type of information on request. You need some type of government warrant before they're released, and the process is non-trivial. If you're worried about pr0n and simply silly stuff, then don't worry about it. If you're Dread Pirate Roberts v2.0, ...


6

How much of the public IP is changing upon the DHCP renew? How quickly before you see the packets upon getting a new IP? This is unlikely a targeted attack and more likely a shotgun-approach scanner bound to scanning a large subnet. It only takes a few minutes to scan an entire class B with SYNs. The IP in question has been reported by several as an ...


6

It most likely checks for updates. I've noticed such behavior in many recent routers: they periodically check their home site for new firmware. If there is a new version available, it will notify you that an update can be done in the update menu. On the one I have I was able to make the update directly via the router menu, without needing to download the ...


6

It looks like it tries to fetch the web page at each of a list of common router local IPs with JavaScript, deciding that it's found it when one responds. It uses jQuery's $.get(), but there are lots of ways to fetch one a web page from within another1. This assumes that the router has a web administration panel on port 80, but they usually do. The relevant ...


5

It is common for SOHO devices (switches, routers) that they either do not support HTTPS or provide HTTPS with factory self-signed certificate which cannot be replaced. I wouldn't worry much as long as: you control the wiring between your PC and router. remote management is disabled over wireless (admin page is allowed only via wired media) media. remote ...


5

If an attacker had modified the firmware in a moderately sophisticated way, then the only way to be completely sure of wiping that firmware is to update via jtag or direct flash writing. If you rely on software-based firmware update, then that is under the control of the compromised firmware. There are tutorials online on how to do that if it falls under ...


3

This is not a problem. Others here have given technically precise answers which assume general knowledge of how the secure web connections work. However if you have that level of knowledge you will already know the answer to this question. Here is a simpler answer. Secure web pages (i.e. those with "https" at the start of the URL and a green padlock or ...


3

If your computer is infected with malware, the attacker may already have remote access and thus be inside your home network without him even knowing whether you are using cable LAN or WLAN on this particular computer. (He needs some assistance from you, like opening an email attachment or visiting a website that uses a zero-day exploit for your browser. But ...


3

Ideally, printers are to be seperated from their clients (and the internet) as much as possible. There seems to be some kind of confusion on your side between categories of network devices. I'm assuming you're coming from a COTS standpoint which usually means that a device called "Router" does carry the jobs of "Router", "Firewall", "Switch", "WiFi Access ...


3

All of these sites are behind the Akamai CDN. The message and code indicates that your cite was blocked by Akamai. As for why Akamai might have done this see Why is Akamai blocking me?. Notably it might block an IP address if this IP was the source of potential malicious activity, like attempts to attack sites protected by Akamai (SQL injection, ...), web ...


3

Be aware some corporate devices are configured to disable password recovery. This is not uncommon for Telco-provided CPE, like Cisco routers. You might be buying a paperweight or a parts donor. Keep an eye out for stickers that imply its been a Customer-site device provided by big-local-telco, and perhaps avoid those listings.


3

It's not often I read a question and laugh out loud. I'm sorry your ISP is not helping you. Their response is funny. IF they can infallibly detect a virus, then they should also have the ability to respond to it. A virus on the router could certainly copy information and inspect your traffic and not have any other effect. This might slow down your speed. ...


3

That CVE number is totally bogus. The format for CVE's is CVE-[YEAR]-[number], so any CVE issues this year would start with CVE-2019, CVE-2020 won't be around until next year. The fact that you couldn't find the number on Mitre's website confirms that. Mails like the one you received are scams. They try to make some quick money by threatening to disclose ...


2

I assume you're talking about a couple bsumer level router (router+switch) with a web GUI for configuring it. All the traffic on your network passes through your router. This includes DNS queries Eg. What is the IP for google.com Is anyone on your network has malware on their device, that could connect to the router, and use a default password (or guess ...


2

One of the helpful things in this situation is a knowledge of the OSI model and the layers of technology. OSI layers can be extremely boring to study in school, but they, and an understanding of technology stacks in general, form the basis of almost all understanding of the interrelationships of technology. And that understanding will help you troubleshoot ...


2

It's because the MAC addresses are seeable in "clear text", or we should say clear waves. Else how should the wifi router know the received frame is for him ? See OSI Model. The encryption is in higher layers.


2

I'm not sure exactly what type of attack you are referencing but consider this...if an attacker controls your router what is to stop them from making any arbitrary change to unencrypted data? The packets pass through the router and the router could (if desired) make any change to the packet that the attacker desires (assuming he has taught the router how to ...


Only top voted, non community-wiki answers of a minimum length are eligible