How to take Malware off Router?

[viel]

Hi,
title says it all, how do I take malware off my router?

I am pretty confused right now :/

I am also wondering is Wifi safer than Ethernet?

Thank you.

 

[ispx]

i would say it is the other way round, ethernet is safer.

hard resetting the router is my best bet for you.

 

[cruelsister]

Viel- It depends on the malware infecting your router. Typically malware will try to access the router by trying the usual default passwords, and if successful will change the default setup (like switching DNS to Blackhat command, displaying Fake Facebook or Banking websites, etc), If infected in this way a hard reset and return to default router parameters will be indicated.

If the malware is one that exploits a known router vulnerability like in the Puma 6 chipset, then a simple reset will clear the malware but it may be infected again as the initial exploitable atmosphere still exists.

Then there can be infected firmware. As a rule these can be simply removed (assuming that they were detected in the first place!) by updating the firmware to a clean copy. However there does exist infected malware that will only allow firmware updates by new versions of infected firmware from Blackhat command. Currently used by actual Pros, I'm sure it's only a matter of time before some riff-raffy criminal gang develops them also.

Prevention is always the best way of preventing this crap:

1). ALWAYS CHANGE default router logon credentials.
2). Use a non-popular good quality brand (like Buffalo) where messing with the firmware just isn't worth doing by the Blackhats.

 

[ForgottenSeer 58943]

Hi,
title says it all, how do I take malware off my router?

I am pretty confused right now :/

I am also wondering is Wifi safer than Ethernet?

Thank you.

Wifi is far less safe than ethernet. If you have the option, always plug in. No 'home/consumer' grade gear I am aware of offers full WIDS (Wireless Intrusion Detection) or RAPS (RogueAP Suppression) so WiFi can basically be a trojan horse into your home for anyone with moderate or higher skill. For the home user the best way to secure their WiFi is to use a longer SSID, include _optout_nomap in the SSID, and use a strong password for all of the SSID's since the encrypt keys are salted using rainbow tables from the SSID and Password. Most of the common SSID names already have been broken, you can actually purchase an extensive list of broken passkeys for all of the default SSID names, and commonly used ones such as 'MyHome', etc.

A good SSID may look something like this; wn8ULUS8KGUyZ9_optout_nomap 14 characters - random, the _optout_nomap is added to prevent Microsoft WiFisense and other tracking, optout is to exclude your SSID from Google Location Services, etc.

The easiest way to secure a home router is to change the login name and password. All of the default login names are obviously known and increase threat surface. In addition, use a strong password for the router itself. Second, most consumer routers allow you to turn off HTTP redirect for admin - turn that off. Enforcer HTTPS admin access to the router so your password isn't transmitted in plaintext. In addition, MANY consumer routers allow you to change the admin port. In this case, make the port something like 10100. To login you will need to then use something like this: https://192.168.1.1:10100. Disable WDS, SSH, Telenet, UPNP on the routers. Disable any cloud features. Disable USB drive use if not needed. Point your DNS to a better than default ISP dns, like DynDNS or whatever after doing all of this.

One of the best ways to keep a consumer router more secure is to constantly update firmware. The NSA/CIA (and others) have their own firmware builds for all of the common consumer grade routers (TAO) and they can replace for full compromise. However if you keep your firmware up to date this subverts that method which assumes consumers never upgrade firmware. Hackers themselves usually rely on redirect exploits, default credentials, etc. to compromise so if those are changed that vector is largely closed off. If the firmware won't update via a factory reset then throw away the router or if under a return policy, return it and get another one. Broken capability to update firmware is often a sign of a compromise, either by hackers or state actors.

If you think a router is compromised perform a factory reset on it, load an updated firmware and make the above stated adjustments and you should be fine.

 

[viel]

Viel- It depends on the malware infecting your router. Typically malware will try to access the router by trying the usual default passwords, and if successful will change the default setup (like switching DNS to Blackhat command, displaying Fake Facebook or Banking websites, etc), If infected in this way a hard reset and return to default router parameters will be indicated.

If the malware is one that exploits a known router vulnerability like in the Puma 6 chipset, then a simple reset will clear the malware but it may be infected again as the initial exploitable atmosphere still exists.

Then there can be infected firmware. As a rule these can be simply removed (assuming that they were detected in the first place!) by updating the firmware to a clean copy. However there does exist infected malware that will only allow firmware updates by new versions of infected firmware from Blackhat command. Currently used by actual Pros, I'm sure it's only a matter of time before some riff-raffy criminal gang develops them also.

Prevention is always the best way of preventing this crap:

1). ALWAYS CHANGE default router logon credentials.
2). Use a non-popular good quality brand (like Buffalo) where messing with the firmware just isn't worth doing by the Blackhats.

Resetting the router may help I am going to try it.
Thanks
PS:
Do you have a youtube channel by any chance? I have seen that Profile picture and a similar name on a youtube channel before, but this channel was called cruelsister1

 

[viel]

Thanks for your help guys

 

[cruelsister]

Hi Viel- Yeah, that's my channel. And also don't forget to change the login on your router when doing the reset, as there could be the possibility that the original malware that infected the router is still hiding on your system waiting to have a second chance.

 

[ispx]

@cruelsister,

does any of the popular anti-virus have the ability to scan modems / routers, ethernet & wifi ?

or if you know of a stand alone scanner that can do the above & which you would recommend ?

 

[cruelsister]

There really would be nothing to scan on the router itself as either the default settings would just be changed or the firmware would be compromised, either of which scenario would be invisible to any scanner.

The important thing is to prevent the initial infective vector to compromise the router in the first place, which would mean having an excellent security solution that isn't definition based on your system.

 

[viel]

There really would be nothing to scan on the router itself as either the default settings would just be changed or the firmware would be compromised, either of which scenario would be invisible to any scanner.

The important thing is to prevent the initial infective vector to compromise the router in the first place, which would mean having an excellent security solution that isn't definition based on your system.

Would a good router password minimise the chance of it getting infected?

 

[ForgottenSeer 58943]

Would a good router password minimise the chance of it getting infected?

A good password can sometimes be all that's required. Everything else discussed above reduces and in some cases eliminates threat surface.

Remember, there are few methods to magically compromise a router from remote unless the login credentials are known or easily guessed or you practiced bad IT. Your gateway IP is leaked everywhere. In your postings, gaming, chat clients, email clients, websites you visit. So your GW is entirely known. An attacker generally can't magically compromise your gateway unless you leave it open by leaving the router default or have a simplistic username/password combination. There millions of automated hacking systems scanning the internet for default/open routers (SHODAN, etc), commercial or otherwise. I can show you logs of an attack on a visible router that show 10,000 brute force attempts from remote per day. In that particular case the sloppy IT left SSH open and on Port22. So the remote hackers discovered it and added the GW IP to their auto-hack systems. Endless 'Root' and 'Admin' username/password combinations attempted.

Some additional ways to secure a home router are to eliminate WAN access to admin. Just do it locally on a local machine or VPN to the local network and access the router through there. Many compliancy and pentest doesn't permit access to admin through WAN. In my case, I allow admin access through WAN but only timed from 9AM-5PM when I am at work and even then HTTP redirect is disabled and there is a custom port with a 30 character password. Any other time admin access is completely disabled through anything but a single local IP. Some consumer routers have the ability to limit admin access to a specific IP address (ASUS, not sure about others). That's a good way to eliminate a huge number of threats.

Let's break it down like this;

Reckless - Default.
Acceptable - Unique, long password on router.
Better - Unique username, long password on router.
Excellent - No HTTP redirect, Unique Admin Port, Unique username/password.
Superb - No WAN access for admin (HTTP, HTTPS, SSH, etc all disabled on any WAN IP), unique username/password, unique port for admin on LAN.
Astounding - No WAN access for admin, Unique username/password, restricted admin access to a single IP on LAN, unique port for admin on LAN.

Take your pick.

One last thing.. Most of you are probably on modems set to DHCP with no statics. If you have a static it's much easier for someone to lock on to you. Since you are probably DHCP if you unplug your cable from your modem, turn off the modem and wait a bit, then plug everything back in you'll grab a totally new IP address in most cases. Most cable firms have a very very low lease time on IP addresses. Once your IP flips, sometimes to a different scope, you've dropped off the radar again. At least temporarily. A good hacker can find you again but it can take 2-8 days, then you can just flip it again. I cycle my GW IP every Sunday as a simple, easy threat reduction method.

 

[ForgottenSeer 58943]

Finally, in terms of WiFi security for consumers, not much there unless you use one of the newer UTM's coming out from Norton, F-Secure, Bit Defender, Gryphon, whatever.

In the near term, you can explore the following for your Wireless settings;

AP/WiFi Isolation
Guest Network Segregation

These are two different things..

AP Isolation keeps your wireless devices from having the ability to communicate with each other. For example if your childs cell phone or laptop got compromised, it wouldn't be able to communicate to another wireless laptop or device.

Guest SSID/Guest Setting - what this does is prevent any device on that specific SSID from communicating with your internal NETWORK.

So ideally, you want AP/WiFi Isolation ON AND you want to use Guest SSID's. Simply secure the Guest SSID like a normal SSID with a strong SSID name and Password, then connect your devices to that. Remember, any device connected to Guest SSID won't see anything internally on your subnet OR be able to communicate. So if you need to print from a laptop, this won't work. The best WiFi security for a home user is AP/WiFi Isolation + Guest Network for all of your WiFi devices if feasible.

In the enterprise realm we use AP Isolation, then use policy routing for specific IP/Port/Protocol if needed. Then we use tagged VLAN's instead of Guest Network and generally segregated DHCP server for Guest. Multiple levels of segregation and isolation are paramount for internal network infrastructure security.

Hope that helps.