5 ms·
If your router allows Internet access via admin password, you should get a new router not change your admin password.
by creeble 12y ago
If your router allows Internet access via admin password, you should get a new router not change your admin password.
- maxerickson 12y agoI think "Remote Management" is an option on pretty much all consumer routers. It's pretty unfortunate to have it default to on when there is a non unique default password though.
- x0x0 12y agoSure, but from the wan side? Why on earth would anyone want that?
- Alupis 12y agoISP's that want to remotely manage their CPE, ie. reboot remotely, adjust routes, etc. Obviously these should be locked to only respond to designated control IP's that originate from the ISP, and default user/passwords should be changed...far too often I've seen corps use a non-default user/pass but instead switched to something different... but only that every single device they deploy has the same exact user/pass on it.
- segacontroller 12y agoI have seen smaller ISPs use something similar to admin/c0mcast on every single device while using equipment too cheap to include an access list for remote management.
- maxerickson 12y agoFor remote management of the router? I can think of lots of reasons to have it on; one would be a second home.
- zaroth 12y agoThere are many ways, even if WAN-side Management is disabled, to take over these routers from the WAN side. E.g. [1, 2] There are also vulnerabilities in the auto-provisioning protocols used by the modems that can give the attacker an entry-point. [3] This is just the tip of the iceberg from 10 minutes of Googling. I also recall there was some technique where an attacker could reflect attack traffic through a browser and back into the router, so if you knew the router IP and user/pass you could compromise it by getting the user to visit a malicious or drive-by-hacked site.... but I couldn't find a link for that one. [1] - https://securityevaluators.com/knowledge/case_studies/routers/soho_router_hacks.php https://securityevaluators.com/knowledge/case_studies/router... [2] - https://www.eff.org/deeplinks/2014/08/def-con-router-hacking-contest-success-fun-learning-and-profit-many https://www.eff.org/deeplinks/2014/08/def-con-router-hacking... [3] - http://www.computerworld.com/article/2491042/malware-vulnerabilities/home-routers-supplied-by-isps-can-be-compromised-en-masse.html http://www.computerworld.com/article/2491042/malware-vulnera...
- justincormack 12y agoJavascript to 192.168.1.1, eg see here http://blog.kapravelos.com/post/68334450790/attacking-home-routers-via-javascript http://blog.kapravelos.com/post/68334450790/attacking-home-r...
- segacontroller 12y agoISP network support for one.
- xorcist 12y agoThere has been about handful of ways to coax all common UPnP implementations to give you LAN access, except for the all the obvious ways if you can get the victim to view a web page. Don't rely on it for security.
- sp332 12y agoOr... you could just uncheck that option in the router config? Pretty sure it's not on by default in home routers.