Consumer router insecurity

Laptops, Notebooks, Smartphones and Networking

Moderator: Moderators

User avatar
jpr
Administrator
Administrator
Posts: 1956
Joined: Fri Nov 21, 2003 6:15 pm

Re: Consumer router insecurity

Post by jpr »

My ISP supplies me with an "all-in-one" router/AP/ONT, so it's not super-convenient to use anything else (telephony and TV service depend on it as well, AFAIK). I'll just have to hope it's not compromised (it actually works quite well, but the b****** (Vodafone) disabled bridge mode so they can sell their own WiFi extenders :x - I might open another topic about that soon, actually :-k ).
No sig due to budget cuts.
User avatar
thegrommit
Ultra nForced
Ultra nForced
Posts: 6002
Joined: Sat Aug 02, 2003 1:24 am

Re: Consumer router insecurity

Post by thegrommit »

https://arstechnica.com/information-tec ... h-malware/
A recently discovered hack of home and small-office routers is redirecting users to malicious sites that pose as COVID-19 informational resources in an attempt to install malware that steals passwords and cryptocurrency credentials, researchers said on Wednesday.

A post published by security firm Bitdefender said the compromises are hitting Linksys routers, although BleepingComputer, which reported the attack two days ago, said the campaign also targets D-Link devices.
Water cooled clay
User avatar
shadow
nForced
nForced
Posts: 1459
Joined: Wed Sep 11, 2019 11:00 am

Re: Consumer router insecurity

Post by shadow »

thegrommit wrote: Wed Mar 25, 2020 10:28 pm https://arstechnica.com/information-tec ... h-malware/
A recently discovered hack of home and small-office routers is redirecting users to malicious sites that pose as COVID-19 informational resources in an attempt to install malware that steals passwords and cryptocurrency credentials, researchers said on Wednesday.

A post published by security firm Bitdefender said the compromises are hitting Linksys routers, although BleepingComputer, which reported the attack two days ago, said the campaign also targets D-Link devices.
They don't list any specific routers and appear to say it's largely people with poor credentials set that should be worried.

Honestly I've known so many people that just plug it in and expect it to work when it comes to tech stuff. It's depressing. The recent move to either not having or not enabling the web config page by default with some vendors is a plus.

(And automatic updates.)
Soon to be primarily a console gamer.
User avatar
thegrommit
Ultra nForced
Ultra nForced
Posts: 6002
Joined: Sat Aug 02, 2003 1:24 am

Re: Consumer router insecurity

Post by thegrommit »

More vulnerabilities in D-Link routers:

https://www.bleepingcomputer.com/news/s ... patch-now/
Now, the company has disclosed five severe vulnerabilities in some of their router models, which could allow a severe network compromise. Moreover, some devices have reached their "end of life" phase, which means they wouldn't be patched.
As usual, exploitable if remote management is enabled [-X
Water cooled clay
User avatar
jpr
Administrator
Administrator
Posts: 1956
Joined: Fri Nov 21, 2003 6:15 pm

Re: Consumer router insecurity

Post by jpr »

Came across this interesting piece of kit - seems to be developed by the Czech national registrar? Turris Omnia.
Nice little box there, if a bit expensive - ~300 EUR. Runs OpenWRT and is very customizable/expandable. :-k
No sig due to budget cuts.
User avatar
powerarmour
Mod Squad
Mod Squad
Posts: 12696
Joined: Sun Oct 13, 2002 2:10 am

Re: Consumer router insecurity

Post by powerarmour »

jpr wrote: Tue Aug 25, 2020 9:17 am Came across this interesting piece of kit - seems to be developed by the Czech national registrar? Turris Omnia.
Nice little box there, if a bit expensive - ~300 EUR. Runs OpenWRT and is very customizable/expandable. :-k
Looks good. :sweet:
Libera te tutemet ex inferis
User avatar
jpr
Administrator
Administrator
Posts: 1956
Joined: Fri Nov 21, 2003 6:15 pm

Re: Consumer router insecurity

Post by jpr »

Will move flats in some months, and will need a router + AP - this might just do it. Should be similarly priced as a decent router + decent ac/ax AP, but looks like it could have a longer useful life, and the official OpenWRT support and hardware upgradeability is nice. I suppose I'll just see what's available until then :-k
No sig due to budget cuts.
User avatar
shadow
nForced
nForced
Posts: 1459
Joined: Wed Sep 11, 2019 11:00 am

Re: Consumer router insecurity

Post by shadow »

I still keep going back to my Google Wifi. Everything is secure and just works as expected. May or may not use a bridge with it for more ports once I have my new wifi card.

I know I'll probably end up with an ASUS AX model sooner or later, but for as few connecting devices as we use at once and most of them being AC...meh.
Soon to be primarily a console gamer.
User avatar
daglesj
Ultra nForced
Ultra nForced
Posts: 2006
Joined: Thu Feb 10, 2005 8:54 am

Re: Consumer router insecurity

Post by daglesj »

jpr wrote: Tue Aug 25, 2020 9:17 am Came across this interesting piece of kit - seems to be developed by the Czech national registrar? Turris Omnia.
Nice little box there, if a bit expensive - ~300 EUR. Runs OpenWRT and is very customizable/expandable. :-k
I'd expect the best internet experience and options in the world for that price (including the postage). Bet you'll still have to manage 90% of it with CLI and scour hundreds of sites to get the proper solution.

Filed under "they saw you coming". :wink:
The spec of my PC? 5960X @ 4.4GHz / Asus X-99A MB / 32GB Quad DDR4 3200 / PM961 NVMe / RX 480 / RM650X / Artic Cooling 240 AIO / iFi Nano Black Label DAC
User avatar
jpr
Administrator
Administrator
Posts: 1956
Joined: Fri Nov 21, 2003 6:15 pm

Re: Consumer router insecurity

Post by jpr »

Well, it is markedly aimed at enthusiasts/developers, especially being open-source, so I wouldn't expect too much hand-holding anyway :wink:

Considering the feature set it's actually not that expensive - it does have an SFP port for fiber, and 3x3 MIMO AC Wifi (easily upgradable since it's a mini-PCIe card) - besides getting continuous updates.

Not saying it's the best router ever made or even the most convenient, but, as I said, it is interesting :-k

Something to revisit when the time comes :)
No sig due to budget cuts.
Post Reply