5 ms·

Ok. What specific steps should we be doing to ensure a home router is configured safely? Please assume a consumer grade router given by the ISP and _maybe_ ano

Ok. What specific steps should we be doing to ensure a home router is configured safely? Please assume a consumer grade router given by the ISP and _maybe_ another one bought off the shelf at a box retailer. Also assume unable or unwilling to flash firmware.

ge0rg 8y ago
Disable UPnP in the router settings. In theory, that should close the hole. Disable remote maintenace / web access. Many router web UIs have exploitable flaws that can be used to bypass password authentication. Ensure that you are always running the latest firmware version. If there are no up-to-date versions / the router is too old, you might complain to the ISP. However, they might try to sell / rent you the latest and greatest router model then.
- prepend 8y ago
  It looks like this exploit gets around disabled remote maintenance, since it makes remote traffic seem local. Disabling upnp will do it. I’m going to set up blocking all inbound on 1900 on ISP’s router stopping traffic before it gets to my home router. I might finally be grateful for being forced by the isp to use their hardware for nothing other than a hop between my network’s router and the isp’s network.
- EADGBE 8y ago
  > Disable remote maintenace / web access By this do you mean a public remote address/login or the generic 192.168.0.X login page when on the serving network?
chrisper 8y ago
Make sure companies care about their products and not only about money. My Swiss ISP is providing in-house developed hardware and it's quite good. I was quite surprised.
- herbst 8y ago
  Probably not talking about USP or Swisscom then :) I use init7 now for a while with my own router and seriously never had so few networking issues ever.
  - chrisper 8y ago
    I have no issues with the Swisscom box.
ourmandave 8y ago
Side note: If there's one tech support job for friends and family I don't mind doing it's helping them replace the slow modem their ISP is "renting" them. I was paying $60 per year for a DOCSIS 2 modem. Replaced it with a DOCSIS 3 for $90. Huge speed boost for almost free.
- tbihl 8y ago
  And based on the last 3 providers I've had, you were getting a steal at $60/yr
- commandlinefan 8y ago
  I've been begging my wife for years to let me upgrade the crap modem that the ISP is loaning us. She's terrified that if I touch anything, it's all going to break, and since she works out of the house, she won't be able to get online. Sigh...
herbst 8y ago
Well the one my ISP gave me did not only crash regularly but also auto enabled WPS, and a remote telnet administration port every other day which was insecure as fuck. These were only the obvious flaws. Sometimes your only choice is changing the ISP.
cleanyourroom 8y ago
Disable upnp. Define port forwarding statically where necessary.

ge0rg 8y ago

Disable UPnP in the router settings. In theory, that should close the hole. Disable remote maintenace / web access. Many router web UIs have exploitable flaws that can be used to bypass password authentication. Ensure that you are always running the latest firmware version. If there are no up-to-date versions / the router is too old, you might complain to the ISP. However, they might try to sell / rent you the latest and greatest router model then.

prepend 8y ago
It looks like this exploit gets around disabled remote maintenance, since it makes remote traffic seem local. Disabling upnp will do it. I’m going to set up blocking all inbound on 1900 on ISP’s router stopping traffic before it gets to my home router. I might finally be grateful for being forced by the isp to use their hardware for nothing other than a hop between my network’s router and the isp’s network.
EADGBE 8y ago
> Disable remote maintenace / web access By this do you mean a public remote address/login or the generic 192.168.0.X login page when on the serving network?

chrisper 8y ago

Make sure companies care about their products and not only about money. My Swiss ISP is providing in-house developed hardware and it's quite good. I was quite surprised.

herbst 8y ago
Probably not talking about USP or Swisscom then :) I use init7 now for a while with my own router and seriously never had so few networking issues ever.
- chrisper 8y ago
  I have no issues with the Swisscom box.

ourmandave 8y ago

Side note: If there's one tech support job for friends and family I don't mind doing it's helping them replace the slow modem their ISP is "renting" them. I was paying $60 per year for a DOCSIS 2 modem. Replaced it with a DOCSIS 3 for $90. Huge speed boost for almost free.

tbihl 8y ago
And based on the last 3 providers I've had, you were getting a steal at $60/yr
commandlinefan 8y ago
I've been begging my wife for years to let me upgrade the crap modem that the ISP is loaning us. She's terrified that if I touch anything, it's all going to break, and since she works out of the house, she won't be able to get online. Sigh...

herbst 8y ago

Well the one my ISP gave me did not only crash regularly but also auto enabled WPS, and a remote telnet administration port every other day which was insecure as fuck. These were only the obvious flaws. Sometimes your only choice is changing the ISP.

cleanyourroom 8y ago

Disable upnp. Define port forwarding statically where necessary.