3 ms·

So for people like myself who don't know much about this stuff, I was wondering what we can learn to figure out if the routers we are using are compromised in a

by nstart 8y ago

So for people like myself who don't know much about this stuff, I was wondering what we can learn to figure out if the routers we are using are compromised in any way. On a similar tangent, is there any way we can detect any editing being done by an ISP? Like how and where they might be inserting headers into our traffic for example. Just curious where to start in this exercise.

marcosdumay 8y ago
I guess the preferred way to discover if your router is compromised would be by network analysis... And you would need to plug it into some other computer for that, what just shifts the problem to the other computer. I guess you can gain some confidence that it isn't compromised, but can never be sure. About edit being done by the ISP, once you fix on a not all powerful adversary (not the NSA), it's easy to get some machine it couldn't have tainted.
- ant6n 8y ago
  That doesn't sound like a way that would be preferred by any home user. How about starting with a list of affected routers?
  - marcosdumay 8y ago
    Well, you are going with a completely different question than the one I got. And rereading the GP, I don't know which is correct, so, well maybe.
  - nitrogen 8y ago
    Maybe haveibeenpwned can start to check IP addresses against these global scans when you visit their site.
ac29 8y ago
For non-technical people, or people who just don't know much about this kind of thing, I would suggest just reviewing what the latest firmware version is, and updating if there are new versions. Also, review release history, if available. If your router is getting less than 2 or 3 updates a year, assume there are unfixed bugs or security issues. For this specific issue? It only affects Mikrotik routers, and the vulnerability has been patched. So if you aren't using Mikrotik, or if you are and have the latest firmware, you're good.
- pathseeker 8y ago
  >For non-technical people, or people who just don't know much about this kind of thing, I would suggest just reviewing what the latest firmware version is, and updating if there are new versions. I think you vastly overestimate how much technical knowledge non-technical people have. A huge swath of non-technical people that use computers won't even know which component the router is, let alone know how to log into the UI and check the firmware.
  - ryanmarsh 8y ago
    This is sadly true. When it comes to computer security most of humanity is incredibly vulnerable. It's all so confusing for them. Sometimes the URL bar in their browser is a URL, sometimes it's the search phrase they typed and there's no URL. Many can't tell you the difference (still in 2018 this blows my mind) the difference between their web browser and the internet. I actually had a discussion with someone yesterday where they told me they didn't download a document they just previewed it... FROM THEIR DOWNLOADS FOLDER. They thought quick viewing the doc in their OS's preview function was not the same as full blown opening it an app which was akin to "downloading it". I had to explain that the bits were in fact on their computer, downloaded. It's easy for us to point the finger and say people need to invest in their own personal understanding of this stuff. To some extent I agree but I also want my CPA to spend his free time learning more about the tax code and my finances, not patching his router. Overall computer security needs a reset. For all the complaints of "walled gardens" and "lock in" etc... most folks' iPhone is the closest they'll ever get to a secure computer. That's a shame.

by nstart 8y ago

marcosdumay 8y ago

I guess the preferred way to discover if your router is compromised would be by network analysis... And you would need to plug it into some other computer for that, what just shifts the problem to the other computer. I guess you can gain some confidence that it isn't compromised, but can never be sure. About edit being done by the ISP, once you fix on a not all powerful adversary (not the NSA), it's easy to get some machine it couldn't have tainted.

ant6n 8y ago
That doesn't sound like a way that would be preferred by any home user. How about starting with a list of affected routers?
- marcosdumay 8y ago
  Well, you are going with a completely different question than the one I got. And rereading the GP, I don't know which is correct, so, well maybe.
- nitrogen 8y ago
  Maybe haveibeenpwned can start to check IP addresses against these global scans when you visit their site.

ac29 8y ago

For non-technical people, or people who just don't know much about this kind of thing, I would suggest just reviewing what the latest firmware version is, and updating if there are new versions. Also, review release history, if available. If your router is getting less than 2 or 3 updates a year, assume there are unfixed bugs or security issues. For this specific issue? It only affects Mikrotik routers, and the vulnerability has been patched. So if you aren't using Mikrotik, or if you are and have the latest firmware, you're good.

pathseeker 8y ago
>For non-technical people, or people who just don't know much about this kind of thing, I would suggest just reviewing what the latest firmware version is, and updating if there are new versions. I think you vastly overestimate how much technical knowledge non-technical people have. A huge swath of non-technical people that use computers won't even know which component the router is, let alone know how to log into the UI and check the firmware.
- ryanmarsh 8y ago
  This is sadly true. When it comes to computer security most of humanity is incredibly vulnerable. It's all so confusing for them. Sometimes the URL bar in their browser is a URL, sometimes it's the search phrase they typed and there's no URL. Many can't tell you the difference (still in 2018 this blows my mind) the difference between their web browser and the internet. I actually had a discussion with someone yesterday where they told me they didn't download a document they just previewed it... FROM THEIR DOWNLOADS FOLDER. They thought quick viewing the doc in their OS's preview function was not the same as full blown opening it an app which was akin to "downloading it". I had to explain that the bits were in fact on their computer, downloaded. It's easy for us to point the finger and say people need to invest in their own personal understanding of this stuff. To some extent I agree but I also want my CPA to spend his free time learning more about the tax code and my finances, not patching his router. Overall computer security needs a reset. For all the complaints of "walled gardens" and "lock in" etc... most folks' iPhone is the closest they'll ever get to a secure computer. That's a shame.