Router security 1

[colinrharris]

Is it possible to access a Router from outside the LAN if the admin username / password are not set or left at the default values and Remote Admin has not been setup? Would the answer be different if the WAN ip address was known?

 

[Sympology]

What type of router? By what interface do you mean? By saying outside the LAN, do you mean the WAN interface? If so, yes you would need to know the address, doesn't me you can get in.


Only the truly stupid believe they know everything.
Stu.. 2004

 

[colinrharris]

The Router happens to be a Draytek Vigor but my question is really a general one. On a Draytek, Netgear, D-Link or similar Router used for home or small office networks, is it possible for an intruder to get into the Routers web interface and change settings. Some Routers have a setting for remote admin and for the purpose of this question, this has not been setup.

The reason behind my question is this: I have been acused of leaving a client's network vulnerable to intrusion because I did not, in this instance, change the default admin username and password. I dont beleive this to be so but I would appreciate any comments. The Router is not wireless.

Thanks

 

[cdogg]

If the remote administration option on the router was not turned on, then the answer is no.

It is possible for a highly skilled hacker to get into any router, password protected or not, by hijacking packets that are sent to and from the WAN side of the connnection. However, this would have nothing to do with the setting you are referring to.

~cdogg
"Insanity: doing the same thing over and over again and expecting different results." - Albert Einstein
[tab][navy]For general rules and guidelines to get better answers, click here:[/navy] faq219-2884

 

[Sympology]

Technically, you have left it open. A skilled person may of gotton through your router and onto a client machine (maybe using a Trojan for example). Then would be able to get back into the router from there.

By default most DSL "routers" are actually router firewall combos, and not a "pure" router as such and as such, in there standard form are usually set to reject direct connections from the WAN interface.

On a basic level, I would change:

Admin User Name
Password
Internal address from the default 192.168.0l.

Not fool proof, but makes it a little harder to get in.

Only the truly stupid believe they know everything.
Stu.. 2004

 

[colinrharris]

Thanks for your reply. I normally change the default password but not the LAN address range. I will do that in future.

If we ignore the skilled hacker for a moment, would it be easy for say a competitor of my client (probably another small business) to find their way in to this network or to change the Router settings?

What would you need to know about me for example to get into my network? What I am trying to establish is what measures are "good practice" and what are critical because they would leave a network wide open to anyone. I would alsways setup encryption on a wireless network as anyone could gain access so that would come under the heading of "critical" but entering mac addresses of allowed computers might be classed as "good practice".

 

[Sympology]

Try this, may help:

http://www.firewall.cx/articles-network-security.php

Only the truly stupid believe they know everything.
Stu.. 2004

 

[Kemisco]

Hi colinrharris and StuReeves,

I'd like to add to your discussion with an additional step in security that is easy to take. Set up passwords and addresses inside of a router, using a computer that will never be using it. A computer that does not go online, for example. That way you leave all keystrokes on the other machine.

Kemisco

-----


Take your computer outdoors when blowing out the dust; it's mostly skin dust. A clean computer is a cool computer.

 

[colinrharris]

Thanks everyone for your valuable comments.

 

[cdogg]

Changing the LAN address range does nothing to improve security. If someone gains control of your router, they will be able to see whatever range you set.

Also realize that most intrusions these days occur through the use of trojans that compromise PC's behind the firewall. They turn the workstation into a beacon, making it easy to find. In addition, they can open a port to allow easy access. Unless you have all unused ports locked down tight (inbound and outbound), you can't rely on the router by itself to protect you. Remember, most basic routers don't have many good options to monitor or block outgoing requests (that is, a request that goes from the LAN to WAN side). That's why having a 3rd-party software firewall running on each workstation is a good idea, or for larger networks, using a proxy server.

~cdogg
"Insanity: doing the same thing over and over again and expecting different results." - Albert Einstein
[tab][navy]For general rules and guidelines to get better answers, click here:[/navy] faq219-2884