10 Ways Your Router Isn’t as Secure as You Think
Pinterest Stumbleupon Whatsapp
Advertisement

You’re happily browsing the web, visiting websites, doing a bit of online banking, and perhaps some gaming. Everything is perfect, with your computer secured with a firewall and antivirus software, and perhaps a VPN.

No hacker is going to be ruining your day, right?

Well, that all depends on how secure your router is. Here are 10 ways your router could be exploited by hackers and drive-by wireless hijackers.

1. Default Admin Password and SSID

Millions of routers ship every year, all with an admin password preconfigured, and printed on the side of the device. It doesn’t take a genius to work out that every single password can’t possibly be unique. As such, it’s possible to use a relatively small number of passwords to gain access to routers from a single manufacturer.

ways router isn't as secure as you think
Image Credit: DeclanTM via Flickr

While it is straightforward to change the default password for your router, it’s not something most people do. There is no automatic “forcing” of a password reset. Basically you need to login to the router’s admin console to do it. The overwhelming majority of router owners generally don’t go near this console… if you’re one of these people, you’re at grave risk of being hacked.

Checking your router’s documentation to login and chance the router password is vital. Our guide to setting router passwords Change Your Router Password Before It Gets Hacked Change Your Router Password Before It Gets Hacked If you've never changed the password for your wireless router, your network is at risk. Here's how to log into your router's settings and set a new password. Read More should help here.

While you’re at it, learn how to change the router’s broadcast name (SSID) 50 Funny Wi-Fi Names for Your Network SSID 50 Funny Wi-Fi Names for Your Network SSID A good Wi-Fi name makes it easy to find your own network. A great network name will also entertain your neighbors. Read More . In particular, be concerned about routers supplied by your ISP. These often use addresses or phone numbers to create SSID names — something that helps drive by hackers (“wardrivers”) identify your property.

You don’t want that.

2. Obvious Admin Interface Address

Another issue with routers is that they can all be accessed in pretty much the same way. With a default password, SSID and an easily guessable IP address IP and MAC Address: What Are They Good For? IP and MAC Address: What Are They Good For? The internet isn't so different from the regular postal service. Instead of a home address, we have IP addresses. Instead of names, we have MAC addresses. Together, they get the data to your door. Here's... Read More , the router can be hijacked.

ways router isn't as secure as you think

For example, the default IP address for router admin interfaces is 192.168.1.1 or 192.168.0.1. This isn’t a secret — anyone can find out this information, either by searching online, or using network tools How to Trace an IP Address to a PC & How to Find Your Own How to Trace an IP Address to a PC & How to Find Your Own Want to see the IP address of your computer? Perhaps you want to discover where another computer is situated? Various free tools are available that tell you more about a computer an its IP address. Read More . You’ve probably already realised that means anyone can log into your router’s admin console, gaining access to your home network.

Once again, changing the default IP address is something you can do from within the admin screen, which is accessed via your web browser. As with the password and SSID, it’s one of the first things you should change after setting up your router.

3. Cloud-Based Router Management

Over the past few years, a somewhat ridiculous new tool has been offered by router manufacturers: cloud-based management. This is a cloud-based service layer that provides an interface with your router.

ways router isn't as secure as you think

That’s right: you’re only able to access the cloud-based management tool if the supported router is connected to the internet. Great idea… not. Then there’s the mesh router systems 5 Reasons to Buy a Mesh Wi-Fi Router Kit (And 3 Reasons Not To) 5 Reasons to Buy a Mesh Wi-Fi Router Kit (And 3 Reasons Not To) Is your router tucked away, battling thick walls and providing spotty coverage? A mesh Wi-Fi system wants to put an end to that horror, boosting your wireless coverage throughout the house. Read More , such as Google Wi-Fi, which are entirely cloud based, and can only be accessed from a mobile app. Mesh routers do have an advantage when it comes to firmware updates, but you should only be looking at such devices if they also offer local admin access.

After all, do you really want to leave the administration of your router to an unknown third party? How do you feel about an additional layer of trust between you and your router? So many “trusted” services have been hacked over the years that it seems insane to accept cloud-based router administration.

4. UPnP Enabled by Default

Browsing your router’s admin console, you’ll find that Universal Plug and Play (UPnP) What Is UPnP & Why Is It Dangerous? [MakeUseOf Explains] What Is UPnP & Why Is It Dangerous? [MakeUseOf Explains] Technology in the computer age has been plagued with unsecured features, security loopholes, and general oversights in software architecture. Flash drives can carry keyloggers. Browsers might have open backdoors. Windows constantly updates with security fixes.... Read More is enabled by default. This networking protocol, enabled on internet-facing ports, exposes you to external attack because it was designed for local area networks (LANs), not the internet. As a result, it has no security.

ways router isn't as secure as you think

Having UPnP enabled, therefore, is a big risk. Your router is basically a magnet to internet-based malware, and you don’t want an open door to your data labelled “UPnP”. Spend a few moments in your router’s documentation or online help file and learn how to disable UPnP.

While you would expect UPnP to be disabled by default, this isn’t always the case, especially on older router models.

5. The HNAP Management Bug

You may not be familiar with HNAP. The Home Network Administration Protocol (HNAP) is intended to enable ISPs to manage the routers they’ve sent out to customers. Although accessible by the end user, it is particularly useful to ISPs.

Unfortunately, it has a massive flaw.

With HNAP, your router’s device name and other information is broadcast, in plain text, without any form of encryption Why We Should Never Let the Government Break Encryption Why We Should Never Let the Government Break Encryption Living with terrorist means we face regular calls for a truly ridiculous notion: create government accessible encryption backdoors. But it's not practical. Here's why encryption is vital to day to day life. Read More . For this reason alone, you need to disable HNAP. The problem is, it often doesn’t switch off when instructed. You’ve guessed it: the only solution to HNAP is to buy a new modem, or at least contact your ISP and express your displeasure. Hopefully, they’ll offer a replacement forthwith.

To check for the HNAP vulnerability on your router, go to this URL:

http://[YOUR.ROUTER.IP.ADDRESS]/HNAP1

If you’re able to get a positive response from the router, you’ve got problems.

6. WPS Is a Security Nightmare

It can be really easy to allow guests to access your network without sharing your Wi-Fi password. All they need is the Wi-Fi Protected Setup (WPS) code, printed on the base of your router.

This is an eight-digit PIN that will remain the same even of the router name and password are changed. However, as you’ve already realised by this point, it’s also a security risk.

ways router isn't as secure as you think

First, the code remains the same (unless you force a change in the admin console), so a visitor to your home can gain access again and again. There’s no facility to force a guest user to re-authenticate each time they visit your home. That’s not good.

Second, and perhaps more worrying, is the PIN itself. While it appears to be an eight-figure PIN, it isn’t. Instead, the first seven figures are split into two groups, one of four, and another of three. These are validated as too sequences, while the eighth number is a checksum, to complete access to the router. But while an eight-digital number has 10 million combinations, this type of PIN has just 11,000. WPS makes it simple to hack a Wi-Fi network How Easy Is It to Crack a Wi-Fi Network? How Easy Is It to Crack a Wi-Fi Network? Wi-Fi security is important. You don't want intruders piggybacking on your precious bandwidth -- or worse. There a few misconceptions regarding Wi-Fi security, and we're here to dispel them. Read More .

That’s a code that could potentially be guessed — a brute force attack would certainly make light work of it. Your solution here is to disable WPS from the router’s web console.

7. Unstable Firmware

Updates downloaded from your router manufacturer or ISP should increase your device security. It follows that your network will become more secure in turn. But sometimes that doesn’t happen. For instance, following a firmware update, your previous changes to the router configuration (such as your own admin password and SSID, etc.) could be overwritten. Typically, the router is updated, but back to the factory settings, requiring you to reconfigure it. This often happens with updates from your ISP, and is a good reason to use any profile saving facility on offer in the router’s admin screen.

ways router isn't as secure as you think
Image Credit: Konrad Twardowski via Flickr

Other problems can occur.

Unstable firmware installations can occur if the data is incorrectly applied, or the update image is rolled out to incompatible devices. Whatever the case, an unstable or reset firmware on your router can open the doors to hackers.

There isn’t an awful lot you can do about this. When it comes to ISPs, they will roll out firmware without warning. Some manufacturers will let you know, but not all. Flashing the DD-WRT firmware What Is DD-WRT And How It Can Make Your Router Into A Super-Router What Is DD-WRT And How It Can Make Your Router Into A Super-Router In this article, I'm going to show you some of the coolest features of DD-WRT which, if you decide to make use of, will allow you to transform your own router into the super-router of... Read More to your router is a possible answer here, but it isn’t compatible with all devices.

Really, the answer is to regularly login to your admin console and check the status of your router.

8. The USB Port

More and more routers are shipping with a user-accessible USB port. This feature is increasingly sought-after and it’s easy to see why. With a USB port, you can connect USB flash drives and hard disk drives to your router. This essentially converts your router into a NAS box, a central repository for your data. As a result, the data on your drive can be accessed from anywhere on your home network.

In many ways, this is extremely convenient. But if your router is already insecure, the data on the USB drive could be accessed by intruders. Worse still, the USB port could be targeted by an intruder with a physical attack.

ways router isn't as secure as you think
Image Credit: Danny Choo via Flickr

Picture this: someone posing as a tradesman, or even someone you know, slipping a compact USB drive into the back of your router. Saved to the drive is malware designed to hijack your router.

Your router is now part of a botnet.

Prevent this from happening: disable the USB ports. If you’ve previously enjoyed using the router like a NAS box, perhaps it’s time to buy one. If money is a problem, you could use your Raspberry Pi as a NAS Turn Your Raspberry Pi Into An NAS Box Turn Your Raspberry Pi Into An NAS Box Do you have a couple of external hard drives lying around and a Raspberry Pi? Make a cheap, low powered networked attached storage device out of them. While the end result certainly won't be as... Read More .

9. Inexplicably Open Ports

In addition to the ports mentioned earlier, it is not uncommon to find that your router has other ports open. Some of these are necessary, such as HTTP. Most others are not. Unless you’re running some specialist equipment or projects at home, you probably don’t need POP3 (110) or VNC (5900) ports open, for example.

ways router isn't as secure as you think

To check if your router has some ports open that you think should be closed, you’ll need a port checking tool. Several are available online; we used the tool at yougetsignal.com.

Use these results to configure your router. If you’re not using a particular service or protocol, then there is no need for the corresponding port to be open.

10. Beware the Misfortune Cookie

It might sound like something you get from a Chinese restaurant, but the Misfortune Cookie is far from edible. Indeed, it’s likely to give you indigestion.

A software-specific vulnerability in some 12 million routers when discovered, the Misfortune Cookie is so named because of an error in HTTP cookie management in the affected devices. This error enables an attacker to craft HTTP cookies to exploit the vulnerability, corrupting the router and altering the device’s state. This could involve attachment to a botnet, for instance. It certainly affords the attacker remote access to your router… and other devices on your network.

ways router isn't as secure as you think

Furthermore, routers can be hijacked to use in a man-in-the-middle attack What Is A Man-In-The-Middle Attack? Security Jargon Explained What Is A Man-In-The-Middle Attack? Security Jargon Explained Read More , and bypasses your device’s hardware firewall. Any computer, tablet, phone, entertainment system or IoT device on your network can be affected.

What can you do about this? Well, begin by checking if you have been affected. You’ll know if you have: the router’s web console will not be accessible using the usual credentials.

To fix the exploit, check with your router’s manufacturer. The bug should have been patched in an update. If it hasn’t, then either look for a new router, or see if your device is compatible with DD-WRT.

Fix Your Router Today!

Hopefully by now you’ve taken steps to fix these issues with your router. It is imperative that you do so, to prevent hackers accessing your network, and bots hijacking your router or PC.

Because routers are all so very different Which Brands Are Best When Buying a Wireless Router? Which Brands Are Best When Buying a Wireless Router? Not all wireless routers are made equal -- and the same is true for router brands. Here are some of the more reliable brands along with a few that aren't so much. Read More , you’re going to need to spend some time with your device’s documentation. All of the issues above are fixable — it’s simply a case of finding the right screen in the browser-based admin screen.

Have you experienced security issues with your router? Did any of the above vulnerabilities need fixing? Tell us below, sharing your router model, to encourage other readers to check their own routers.

Image Credit: dedMazay/Depositphotos

Leave a Reply

Your email address will not be published. Required fields are marked *

  1. root
    December 15, 2017 at 11:50 am

    I don't get, why you should change the IP of the router ...
    All you need to do to find the new address it typing "ipconfig" in the commandline to find the new one! that's no increase of security at all!
    Please remove this point from this list.

    • Scott
      December 18, 2017 at 4:25 pm

      Of course if someone is attached to your network, they can easily see what IP range it uses, and the inside address of the router. But if someone you don't trust is connected, you've got other bigger problems.
      The main benefit to this is to avoid attacks via deliberately crafted links on web pages that are hard-coded to common private network gateway addresses, like 192.168.0.1 or .1.1. When used in combination with default admin (or unchangeable backdoor) passwords, they can send commands to your router using your web browser inside the network to relay them from an external source. These are typically embedded into advertisements that the host of the site you are actually visiting have no control of.
      By making these nonstandard and somewhat random, those links will be ineffective.

  2. Zhong
    December 14, 2017 at 3:49 am

    Would it be just better to use a switch to hook up different PCs and just get an AP for wifi?

    • Scott
      December 18, 2017 at 4:33 pm

      You need a router somewhere between your cable/DSL and the machines inside. In most cases, this is one function of your cable/DSL modem, but it doesn't have to be. There are advantages to splitting their functions into different boxes. A switch and/or WiFi AP may or may not be in the same box.
      In my case, my DSL modem includes the router. It connects to a switch, which in turn feeds two separate APs and several wired devices. And each AP I use happen to have four port switches in them as well.

  3. Larry
    December 14, 2017 at 2:59 am

    One thing that has always been a concern to me is the inability to change the administrator user name. On the Linksys router I have now, an E8350, I can not find a way to change that.

  4. alfie
    December 13, 2017 at 10:19 pm

    also worth checking is that you have disabled remote administration from your isp, telnet and rtelnet ports are blocked via routers firewall if available and your admin and wireless passwords are at maximum length and a mix of characters and symbols.

  5. ciscokid
    December 13, 2017 at 2:32 pm

    A few things I wish to clarify with this article. Firstly you should only really worry about changing the default management IP address of your router if you are concerned about people accessing your network(while they are physically in your house). The management IP address of 192.168.0.1 (as shown in the article) is a private RFC1918 address so is not routable on the internet and is therefore cannot be reached outside of your own private LAN. It would be best to ensure that you do not have remote management turned on because this means if someone knows your public IP address they could http to it and then plug in default username/password.
    Article also states you should disable UPnP. In my opinion this is a bad idea and an outmoded one. It should be enabled on a home network because if not then you will end up with reachability issues between your devices. Network discovery relies on UPnP so disabling it is bad idea (I know because I just tested it). Better to disable UPnP on internet facing devices (eg:IP cameras and network printers)but not your router.

    • Scott
      December 18, 2017 at 5:21 pm

      Regarding the gateway address, see my reply to root above.

      As for UPnP, it may be used by printers for discovery, but all that happens within the local network and does not involve the router at all. The reason routers have it is primarily for gaming. It allows an application to open external ports on the router/firewall for multi-user games across sites to directly communicate with each other instead of relaying everything through an external server.
      The problem is UPnP has security vulnerabilities which enable specially crafted URLs to do the same thing. Those URLs would also be typically embedded in an ad.
      It is useful for its purpose and some games might not work well without it, but it should only be turned on as needed and disabled again when done with the application that needs it.
      Internet-of-Things devices like cameras, "smart" TVs, appliances, etc. should be on their own network with no access to the network your computers are on. They are riddled with vulnerabilities and must be isolated.