Because the router is the main doorway and gateway
into your network,
both locally and via the internet,
it is a crucial component for maintaining security,
privacy and anonymity.
Routers have a very, very tainted history
of vulnerabilities and bad default configurations.
They’re often plugged in and just left running.
If they become vulnerable, you never find out
and nothing is ever done about it,
and they remain vulnerable.
Here you see some of the many examples of
vulnerable routers and incidents of vulnerable routers.
Let me introduce you to Shodan, if you are not familiar with it.
Think of Shodan as a search engine
that searches for vulnerable devices on the internet.
It’s the Google of vulnerabilities, or the Google of
internet of things if you like.
It continually scans the internet looking for vulnerabilities
and then adds it to their database
to make it searchable.
So let me give you an example here. So I’m typing in just simply “netgear”.
Both hackers and security researchers use this to find targets
and to protect their own infrastructure.
So this search query here has returned back
devices that have responded with this string, netgear.
NetGear, being one of the most popular
home router manufacturers.
So what this means is that these are open ports
on these NetGears.
So if you look here, you can see there’s 100,000
NetGears with port 8080 open,
you’ve got HTTP, you’ve got FTP,
and this is essentially the response back that they’re giving,
so it’s saying which
NetGear it is,
and it’s saying Unauthenticated, because
a username and password is not being provided.
Unless there is a very good reason,
and the device has been hardened especially for it,
no router should be allowing access
to its admin interface to the whole internet like this.
The attack surface has to be minimized.
If you need access to your admin interface,
you need to at least VPN in
to your network
in order to access the admin interface,
or preferably it should only be accessible internally.
So literally, hundreds of thousands of them,
and that’s just from one search from one string.
The sort of strings you are more likely to put into this search engine here,
are ones that indicate vulnerabilities,
so that you can find vulnerable devices.
So I’ve put in here “default password”,
meaning that these devices are responding
with the terms “default” and “password”.
And if we look down here,
let's see what we can find.
So this has given us some examples that Cisco might be the default password,
but then we’ve got this particularly interesting one
telling us that the default username is “admin”
and the password is “1234”.
And that’s on ADSL,
that’s probably Taiwan so that is
somebody's home router
that’s probably got the username
and password displayed to everyone on the internet.
Well, let's find out.
So there we are. We’re on some unfortunate person’s –
let me just zoom in – we’re on some unfortunate person’s
internal home router,
and I don't think I need to tell you
what you could do from here.
Obviously, we can start trying to compromise the internal devices,
we can start looking at the network traffic,
we can act as a man in the middle
and SSL strip his traffic, I mean essentially,
we can own the network and own his devices.
Let's have a quick look.
And there’s
his WiFi password, he has actually selected the best and strongest
method of encryption,
and let's look at why he actually has this problem,
why is this accessible?
And that’s the reason. He’s set up Port Forwarding or a DMZ,
which has enabled access to this device from the internet,
which was a mistake.
And there will be literally hundreds of thousands of
vulnerable routers,
this is just a vulnerable router in terms of
default, username and password,
but there will also be routers vulnerable
in terms of they have vulnerable code,
they haven't been patched,
and we can even search for those using Shodan.
So here I’ve done a search for NetGear,
and it’s linking to the Exploit database,
so then we can look on the Exploit database
and find Exploit code
and Exploit strings to search for
to find vulnerable routers
that we can get potential route access
or some sort of access to it,
using the various vulnerabilities hat are out there.
Are you confident that your own router is locked down and secure?
Well, we can find out.
If you find out your router’s external IP address,
you can go to “whatismyipaddress”,
you can see on Google;
you can also go to here: whatismyipaddress.com,
I’ve shown you this many times,
and then pop that into Shodan and see what you get.
This is an IP address I’ve just chosen at random
because it represents UK,
BT Local home users,
so it’s just an example one.
And as we can see here,
this is someone’s
home router by the look of it.
Now, because IP addresses are generally dynamic,
at least they are in this country,
or they certainly are with BT anyway, this means that this IP address
has had this port on it at some point.
It doesn't mean it is vulnerable now,
but it does say last update
was then, so this could very well be available
And as you can see, it’s some sort of
web server of some sort.
And that one doesn't look to be available.
So it may be that whatever the device was,
is now changed to a different IP address.
Even if nothing shows up on here for your router’s IP address,
that doesn't really necessarily tell you much.
You can go direct to the source of the information.
If you want to know what services and ports are running on your router,
you can go onto the router’s web admin interface.
To access your web interface by the way,
I mean usually it would be at http, or https
on whatever the IP address is
that you looked up.
And here’s an example, web interface for DD-WRT,
the router firmware.
It isn't always easy to see what is running,
especially if you’ve not looked much at your router.
There are lot of tabs and sometimes services could be running,
but it doesn't even tell you.
You can check for services, if there’s some sort of services tab
to see what services might be running.
If you want to know whether or not
there’s any network address translation port
forwarding and demilitarized zone,
then you want to look for those sorts of things:
port forwarding, port range forwarding,
DMZ.
This can point to ports being opened up
to the internet and this will look different,
depending on what router you have obviously.
Check on your router to see if it has this UPnP,
which is the Universal Plug and Play.
This allows port forwarding to set up automatically,
so you can imagine this may not be a good idea.
You may have some internal device, if UPnP is set up,
that communicates with your router
and opens up a port automatically without your knowledge,
and this also has a history of vendor vulnerabilities as well.
So it’s not just opening the ports automatically without your knowledge,
it also has vendor vulnerabilities.
So in your interface make sure that it is disabled
and set up port forwarding manually yourself,
if you want to do port forwarding.
If you do do any port forwarding,
whatever you port forward to
must be absolutely secure and hardened,
because that is an open doorway
to your network and to whatever device you are connecting to,
so think long and hard about port forwarding to any device.
It must be fully secure and hardened.
And while you are here, you should check to see whether or not the
router is up to date with patches.
You’ll have to look around and see whether you can find some option
to see whether or not it has been updated.
Other than web admin interface, you can try to SSH
or Telnet to the router
using the internal IP address
that you’ve got from looking up the default gateway.
We’re on a Mac here, both Mac and Linux
come with SSH,
so there we have the default gateway.
On Linux, as I said, it is “route-n” to show you the default gateway.
This is a basic SSH command to log in.
“SSH” is the command,
“root” is the username,
@ and then the IP address of the router you’re trying to connect to.
This will connect via the default port 22.
And there we are logged in.
On Windows you don't have SSH, so you can try
using a program called PuTTY,
just download and install it, it is free.
That looks like this and you simply put in the
router IP address in here,
I’m going to click Open,
and then enter your username and password.
Then, when on the root, you can attempt to look at
what ports are open
using “netstat – tuln.”
And here I can see with IPv4,
I got port 80 listening,
53, which is DNS,
and 22, which is SSH, which we just connected to.
So these are open and listening,
but these are more likely to be open and listening
for your local network and not your internet,
unless the DMZ or port forwarding has been set up
on your router.
So we do definitely want to definitively check
what ports are open on the internet side of the router,
and I’ll show you how to do that now.
What I’m going to show you are websites that do port scanning,
which probe the router’s open ports.
There are 6,535 possible open ports,
but these sites will just check well known or common ports,
or on some, like this one,
you can specify
a range, you can have a list,
or you can use the common ports.
Just a word of caution though, port scanning
could be potentially maybe illegal to do
on devices you don't own.
It’s a bit of a grey area.
In the US, under the Computer Fraud and Abuse Act
of America and the UK Computer Misuse Act of 1990,
and others in their respective countries,
although I don't ever believe there has been a conviction,
it’s just a bit of a grey area, so just bare that in mind,
but there is no issue of course port scanning on your own devices.
So this is my IP address here.
And for interest you can see if you can detect the
service version and the operating system,
I’m not going to select that, because it will take a little bit longer to do,
and let’s start the scan.
So there you go, you can actually see a number of ports.
I’m actually coming from a VPN here, so
it’s not unreasonable that there are some ports here.
If this is your home router, it should show as having no ports,
and as a demonstration,
I want you to see it’s showing some ports.
So here you can see it’s discovered
these ports here.
This site’s actually using a tool called "Nmap”, which is available in Kali,
which we’re going to talk more about later on.
For good measure you can try another site as well.
There’s this one,
this searches for common ports as well,
so there you go, it shows the same
ports.
And for good measure, there’s also Steve Gibson's ShieldsUP!
So I’ll select Common Ports.
So there you go, slightly different results there.
Another site here, you can check if your IP is in a
database of known vulnerable devices and routers.
Simply go down here
and click “Check me”.
“Good news! You are all clear.”
Now, if you do have ports open, or you are getting warnings,
then you need to investigate.
I recommend a full vulnerability scan,
which does more than port scanning,
it will check to see if the device is also vulnerable
to any exploits.
The best vulnerability scanner I can recommend
for free is Qualys FreeScan,
which is an online vulnerability scanner, which you can see here.
You will have to register and go through all that process which is a little slow,
but once you have done, you got access to actually a very powerful
vulnerability scanner.
Free scan is limited to 10 unique security scans
of internet accessible assets.
So you should be able to scan your external router, no problem.
It will provide detailed guidance on how to fix any specific
vulnerabilities that you might have,
but generally, the answer will be to patch the router,
make sure the router is up to date,
and remove any services that are open and are running,
unless you absolutely need access to them,
and if you do, those need to be secure services,
i.e. they have authentication and there’s no vulnerabilities in them,
and they are kept up to date with security patches.