Printable View
Most people seem to be fairly confident in routers with NAT, but just how hard is it to get into a home users machine if it is guarded by one?
I have a Linksys 4 port router (latest firmware updates) as well as a software firewall, but I can't help but be paranoid about someone penetrating my router. Is this possible without a Trojan on the machine, and if so, how difficult would it be for an attacker of any skill set to accomplish this?
Depends on which services/ports you have open... if any.
If you don't have any open, then just make sure to enable logging and keep an eye on the logs.
Its good that you have the software firewall too. I use a similar setup and it works well.
Just make sure you don't have trojans and make sure to configure the firewalls correctly.
Deny everything and then allow as you need. Just make sure you know what you are allowing.
Fun stuff!
Yes, I have the logging turned on and I monitor the logs quite often. No Trojans, and just like you stated, I deny everything at my firewall and just allow what I need. Mozilla, mail, etc..
My question is though, what is the difficulty level of getting past a router such as the one we're talking about here? Have you ever read anywhere or heard anything about that on another message board? So far I haven't heard much at all about successes against these types of routers; am I safe to assume you need to be uber or something to do this and should just probably relax about it?
I have no ports open at all. Of course until I open up my browser or check my mail or something like that. When I do a netstat -an it looks like this:
http://www.google.com/search?sourcei...acking+routers
(kept me entertained for veritable minutes)
Just wanted to point out that when you do a netstat -an it shows your local machine. It doesn't show what ports are open on your router. You may want to have a friend scan your gateway to see if there is anything open there... or check your config.Quote:
I have no ports open at all. Of course until I open up my browser or check my mail or something like that. When I do a netstat -an it looks like this:
Yes, I also have a Linux box that I scan myself with as well as the router; no ports open at the router.Quote:
Just wanted to point out that when you do a netstat -an it shows your local machine. It doesn't show what ports are open on your router. You may want to have a friend scan your gateway to see if there is anything open there... or check your config.
i dont know if that linksys has remote administration but if it does disable it or make sure its a very strong password
They do have remote administration, but it is disabled by default.Quote:
Originally posted here by Tedob1
i dont know if that linksys has remote administration but if it does disable it or make sure its a very strong password
Hopefully by now, they have changed the default password anyway.Quote:
They do have remote administration, but it is disabled by default.
There are a ton of lists out there listing the default passwords for every piece of hardware and software under the sun.......makes you wonder just how hard it really is to get into Joe User's home network.....
Yes, but unless you enable the remote administration, then they cannot access your box even with a password. (At least with the Linksys boxes)Quote:
Originally posted here by IFixDaWindoze
There are a ton of lists out there listing the default passwords for every piece of hardware and software under the sun.......makes you wonder just how hard it really is to get into Joe User's home network.....
There are two things you need to know about these kinds of router/firewall, (Linksys, Dlink and any other of the consumer grade NAT routers). Firstly they are exactly that... consumer grade. They are designed to protect, as best as possible, from the "easy" attacks. But they, for the sake of ease of use, do not deny any outbound connection. Thus, if the user self infects with a "call home" functioning Trojan/malware the router is going to allow the outbound connection.... That isn't good..... But it is better than having the computer available for the whole world to see and attack.
Secondly, these routers tend not to be stateful. Stateful is a router that compares the connection state with a state table of internally initiated connections to confirm that the incoming packets really belong to a "legal" connection. Many of these routers don't do this. So, technically, it would be possible to bypass one of these routers..... However, while it may be possible there would have to be a series of circumstances and knowledge of current connections outbound by and attacker in order to successfully exploit this "hole" that it is practically impossible, (with emphasis on the "practically").
IME and IMO, these consumer grade router/firewalls are an excellent, cost effective, solution to many of the security woes faced on the internet.... It's only a matter of time before the lawyers realize there is money to be had by suing the little people who do not secure in any way their high speed connections and become part of an attackers "inventory" of zombie machines that await his/her "call".
Good information Tiger Shark!
This has given me a better perspective on this topic.