Trending Topics

      Next match: LFC v Spurs [Premier League] Sun 5th May @ 4:30 pm
      Anfield

      Today is the 28th of April and on this date LFC's match record is P27 W14 D8 L5

      Router compromised with suspect firmware ?

      Read 1190 times
      0 Members and 1 Guest are viewing this topic.
      RedLFCBlood
      • Guest
      Router compromised with suspect firmware ?
      Jan 26, 2012 11:27:26 am
      Ok where do I start for a couple of month maybe longer I've been having major problems with my internet.

      It kept dropping connection when another wireless device connected to the internet.

      So basically if only wireless device excluding the PS3 was connected it would be pretty much stable, but if the laptop was connected and you connected an I-Phone it would lose connection.

      Also if I plugged a LAN cable in whilst the wireless was active it would drop connection and not reconnect.

      I was getting IP conflict on this device messages all the time (or words to that effect)

      The only way I could get an LAN cable to work was go into my router and disable the wireless signal.

      When I played Call of Duty on the PS3, I was lucky to finish a match when connected Wireless.

      When ever I tried to update my PS3 or the games through wireless it would not download the updates, it would start and then lose connection so far through, yet if I done it through Lan it would download.

      My internet was struggling mate it was lagging like hell and when I went offline it lost connection all together, its been going on a few days now, i'm going to contact my provider tomorrow.

      I'm surprised I completed three games off the bounce before it went off mate, the last few days I haven't been able to complete a full game.

      Got it updated I had to go into my router and turn the wireless off and then connect my ps3 thriough a LAN cable and  download it, seems to be working better, but still suffering from lag and losing connection every now and then.

      Changed all my wires and broadband filters yesterday with expensive gold cabling and my internet is still the same.

      If I plug my Lan cable in without disabling wireless my connection drops and it wont connect to the internet.

      If I don't plug my lan cable in and just connect wirelessley it just keeps on losing connection and I'm lucky to get a couple of full games.

      Had a quick look online and it appears a lot of people are having the same problem with my provider and they have no answer to the problem.

      All I want to do is play MW3 hassle free, might change my provider, if they can not rectify the fault.

      Anyway after a lot of tooing and froing with my internet provider, they offered to exchange my router and said they would take a look at my old router once it had been returned.

      So my Router came last Thursday and Sent the other back with the courier that collected.

      Anyway my Internet provider phoned this morning and spoke to the missus and told her that the Router had been  compromised with suspect firmware ?

      Now I know it doesn't sound good as "Compromised" and "Suspect" set the alarm bells ringing, but what the F**k does it mean ?

      I wish I'd spoke to them, so I could ask them a few questions so come on techy's give me a hand me here.

      Bier
      • Guest
      Re: Router compromised with suspect firmware ?
      Reply #1: Jan 26, 2012 12:21:13 pm
      Not an expert on routers, but seems to basically mean your router was hacked. Similar to how computers can get hacked with malware. It's hard to say what kind of malware it was, there's probably alot of possibilities.

      For example, some things I found online:

      Quote
      More worrisome than host file attacks is the compromise of a local network router.
      ...
      An attacker could specify a DNS server under his control instead of a legitimate one. All subsequent resolutions will go through the bad server. A scenario involving malicious JavaScript that changes the router's DNS server is called Drive-By Pharming.
      ...
      Like malware on desktop systems, a firmware replacement (on a router) can be very difficult to detect. A stealthy implementation will appear to behave the same as the manufacturer's firmware; the administration page will look the same, settings will appear correct, etc.
      ...
      Once administrative access is granted, all of the router's settings including the firmware itself may be altered.
      ...
      Pharming is only one of many attacks that malicious firmware can mount; others include eavesdropping, active man in the middle attacks, and traffic logging. Like misconfiguration, the entire LAN is subject to these actions.

      Quote
      Why Attack The Router?

      Attacking the router will enable you to monitor network activity with a much higher level of stealth. As most people think the router is a dumb device which simply does NAT translation, it will not be considered a device with a high security risk. Most intrusion analysts at this time will not even consider the router as the place where the malware is hiding.
      Further, most people will keep the router on 24/7. Most people shut down their PCs in the evening before they go to bed, or when they leave the office. Also, since the malware has ultimately wound up on the router, you can monitor all network traffic with a decreased likelyhood of setting off any intrusion alarms. Infact, the highest level of risk is getting the dropper onto a host PC to launch your attack against the router with.
      ...
      Once the stage1 malware is running in RAM, one could take several strategies. The first, would be to outright bruteforce the router, trying many different shellcodes and passwords to get access. The second would be to outright ask for the router username and password if you are disguising your malware as a “network accelerator” tool.

      If the stage1 malware succeds in getting a shell on the router, it should use the router to download the stage2 malware from the distribution site. The stage2 malware, being the real malware, would do whatever you wanted it to do. Ideally, it would install itself so that reinfection is not necessary. At this point, the stage1 malware should terminate itself.
      ...
      The stage1 malware may stay
      around though to ensure that the router remains infected.
      ...
      As long as all of the problems discussed are handled, a rootkit on a NAT appliance could remain permanent, and be fully undetected.

      Should give you an idea.

      You seem to avoid this by not getting any malware on any computers within the network, having remote access disabled on the router, and having a very long and strong password for the router.

      That's what I found anyway.

      Quick Reply