more than Wi-Fi routers The network gateways used by home clients are not properly secured. In fact, some are so vulnerable to attacks that they should be eliminated according to a security expert at the HOPE X hacker conference.
If a router is sold in [a well-known retail electronics chain with a blue-and-yellow logo]”You don’t want to buy it,” independent computer consultant Michael Horowitz told the audience.
If your ISP gave you your router [ISP]You don’t want to use it either, because they’re giving away millions of them, and that makes them a prime target for both spy agencies and bad guys.”
Instead, Horowitz recommends security-conscious consumers to upgrade to commercial routers meant for small businesses or those at least Separate the modem and the router using two different devices. (Many ISPs’ “gateway” modules often work alike.) If neither of these options is possible, don’t worry because Horowitz has also provided a list of precautions users can take instead.
Problems with consumer routers
Routers are the basic but unspoken workhorses of modern computer networks. However, few home users are aware that routers are actually complete computers, with their own operating systems, software, and vulnerabilities.
“A compromised router can spy on you,” Horowitz said, explaining that an attacker-controlled router could launch a man-in-the-middle attack, alter unencrypted data or send the user to often-disguised “evil twin” sites that use webmail or online banking portals.
Horowitz noted that many consumer home gateway devices fail to notify users if and when firmware updates become available, even though those updates are necessary to patch security vulnerabilities. Some other devices will not accept passwords longer than 16 characters – which is the minimum password security length today.
Universal Pwn and Play
Millions of routers around the world, even some of the best, have Universal Plug and Play Networking Protocol (UPnP) enabled on ports facing the Internet, exposing them to external attack.
UPnP is designed for local networks [local area networks]And, as such, it has no security. It’s no big deal, Horowitz said by itself.
But, he added, “UPnP online is like going for surgery and having the doctor work on the wrong leg.”
Another problem is the Home Network Management Protocol (HNAP), a management tool found on some older consumer-grade routers that transmits sensitive information about the router over the web at http://[router IP address]/HNAP1/, and gives full control to remote users providing administrative usernames and passwords (which many users never change from factory defaults).
In 2014, a router worm called TheMoon used the HNAP protocol to identify vulnerable Linksys-branded routers on which it could propagate itself. (Linksys quickly released a firmware patch.)
“Once you get home, this is something you want to do with all of your routers,” Horowitz told the tech-savvy audience. “Go to /HNAP1/, and hopefully you won’t get a response, if that’s the only good thing. Honestly, if I get any, I’ll fire the router.”
WPS threat
Worst of all is Wi-Fi Protected Setup (WPS), a handy feature that allows users to bypass the network password and connect devices to Wi-Fi simply by entering the eight-digit PIN code printed on the router itself. Even if the network password or network name is changed, the PIN remains valid.
“This is a huge security issue that has been obscenely deleted,” Horowitz said. “This eight-digit number will get you to [router] Regardless. So a plumber comes into your house, flips the router, takes a picture of the bottom, and can now connect to your network forever.”
Horowitz explained that the eight-digit PIN is not really eight. It’s actually seven digits plus the final checksum number. The first four digits are validated as one string and the last three digits as another string, resulting in only 11,000 possible tokens instead of 10 million.
“If WPS is active, you can go into the router,” Horowitz said. “You only need to make 11,000 guesses” – a trivial task for most modern computers and smartphones.
Then, there’s networking port 32764, which French security researcher Eloi Vanderbeken discovered in 2013 was quietly left open on gateway routers sold by many major brands.
With port 32764, anyone on a local network – which includes the user’s ISP – can have full administrative control of the router and can even perform a factory reset, without a password.
The port was closed on most affected devices after Vanderbeken’s disclosure, but it was later found that it could easily be reopened using a specially designed data packet that could be sent from the ISP.
“Obviously a spy agency did it, it’s amazing,” Horowitz said. “It was intentional, no doubt about it.”
How to lock your home router
The first step toward home router security, Horowitz said, is to make sure the router and cable modem aren’t the same device. Many ISPs rent such dual-purpose devices to customers, but these customers will have little control over their home networks. (If you need to get your own, see our recommendations for the best cable modem.)
“If you are given one box, which I think most people call a gateway, you should be able to call your ISP and have them walk away from the box so that it just acts as a modem. Then you can add your router to it,” Horowitz said.
Then, Horowitz recommended customers to buy a low-end commercial grade Wi-Fi / Ethernet router, such as Pepwave Surf SOHO (Opens in a new tab)which retails for around $200 (although price gougers beware), rather than a consumer-friendly router that can cost as little as $40.
Commercial grade routers are not likely to have UPnP or WPS enabled. Horowitz noted that Pepwave offers additional features, such as a firmware rollback in the event of a firmware update error. (Many high-end consumer routers, especially those geared toward gamers, offer this as well.)
Regardless of whether a router is a commercial or a consumer level, there are many things, varying from easy to difficult, that home network administrators can do to make sure their routers are more secure.
Easy fixes for your home wireless router
Change administrative credentials from the default username and password. It’s the first thing an attacker will try. Your router’s instruction manual should show you how to do this. If it doesn’t, Google it.
Make the password long, strong and unique, and don’t make it look like a regular password to access Wi-Fi.
Change the network name or SSIDfrom “Netgear” or “Linksys” or whatever defaults to something unique – but don’t give it a name that identifies you.
“If you live in an apartment building in a 3G apartment, don’t connect to SSID’ Apartment 3G,” Horowitz quipped. He called it ‘Apartment 5F’.
Turn on automatic firmware updates If they are available. Newer routers, including most network routers, will update the router’s firmware automatically.
Enable Wireless WPA2 encryption So only authorized users can jump on your network. If your router only supports the old WEP standard, it’s time for a new router.
Enable the new WPA3 encryption standard If the router supports it. However, as of mid-2021, only the latest routers and client devices (PCs, mobile devices, and smart home devices).
Disable Wi-Fi Protected SetupIf your router allows you to.
Set up Wi-Fi for guests And offer to use it to visitors, if your router has this feature. If possible, set the guest network to turn itself off after a specified period of time.
“You turn on your guest network, set a timer, and after three hours, it turns off by itself,” Horowitz said. “This is a really great security feature.”
If you have a lot of smart home or IoT devices, chances are that many of them won’t be terribly secure. Connect them to the guest’s Wi-Fi network instead of your primary network to reduce the damage from any potential IoT device hacking.
Do not use cloud-based router management If your router manufacturer offers it. Instead, see if you can turn this feature off.
“That’s a really bad idea,” Horowitz said. “If your router offered that, I wouldn’t, because now you trust someone else between you and your router.”
Many “network router” systems, such as Nest Wifi and Eero, are entirely cloud-based and can only interact with the user through cloud-based smartphone applications.
Although these models offer security improvements in other areas, such as automatic firmware updates, it may be worth looking for a network style router that allows local administrative access, such as the Netgear Orbi.
Home router repairs are a bit tricky
Install new firmware when it becomes available. This is how router makers install security patches. Routinely log into your router’s administrative interface to check – here’s a guide with more information.
With some brands, you may have to check the manufacturer’s website for firmware upgrades. But have a spare router on hand if something goes wrong. Some routers also allow you to backup your current firmware before installing an update.
Set your router to use the 5GHz band For Wi-Fi instead of the standard 2.4GHz band, if possible — and if all your devices are compatible.
“The 5GHz band doesn’t travel as much as the 2.4GHz band,” Horowitz said. “So if there’s a bad guy in your area a block or two away, they might see your 2.4GHz network, but they might not see your 5GHz network.”
Disable remote administrative accessAnd the Disable administrative access over Wi-Fi. Administrators should only connect to routers via wired Ethernet. (Again, this won’t be possible with many mesh routers.)
Advanced router security tips for tech-savvy users
Change the administrative web interface settingsIf your router allows it. Ideally, the interface should enforce a secure HTTPS connection over a non-standard port, so that the administrative access URL would be something like, to use Horowitz’s example, “https://192.168.1.1:82” instead of the more standard “http://192.168”. .1.1″, which by default uses standard Internet port 80.
Use incognito or private mode When you access the administrative interface so that the new URL you set in the above step is not saved in the browser history.
Disable PING, Telnet, SSH, UPnP and HNAP, if possible. All of these are remote access protocols. Instead of setting their respective ports to ‘closed’, set them to ‘incognito’ so that unwanted external connections that may come from attackers exploring your network are not answered.
“Every router has the option not to respond to PING commands,” Horowitz said. “It’s something you totally want to turn on—a great security feature. It helps you hide. Of course, you wouldn’t hide from your ISP, but you would hide from someone in Russia or China.”
Change the Domain Name System (DNS) of the router Server from a private ISP server to a server maintained by OpenDNS (208.67.220.220, 208.67.222.222), Google Public DNS (8.8.8.8, 8.8.4.4) or Cloudflare (1.1.1.1, 1.0.0.1).
If you are using IPv6, the corresponding OpenDNS addresses are 2620:0:ccc::2 and 2620:0:ccd::2, the Google addresses are 2001:4860:4860::8888 and 2001:4860:4860::8844, and Cloudflare including 2606:4700:4700::1111 and 2606:4700:4700::1001.
use Virtual Private Network (VPN) Router To supplement or replace your existing router and encrypt all your network traffic.
“When I say VPN router, I mean a router that can be a VPN client,” Horowitz said. “Then you sign up with some VPN company, and everything you send through that router goes through their network. This is a great way to hide what you’re doing from your ISP.”
Many home Wi-Fi routers can be “flashed” to run open source firmware, such as DD-WRT Firmware (Opens in a new tab)Which in turn supports the OpenVPN protocol natively. Most of the best VPN services support OpenVPN as well and provide instructions on how to set up open source routers to use it.
finally, Use Shields Up for Gibson Research Corp Port scanning service https://www.grc.com/shieldsup (Opens in a new tab). It will test your router for hundreds of common vulnerabilities, most of which can be mitigated by the router administrator.
[This story was originally published in July 2014 and has been updated with new information ever since.]
[ad_2]
