magazine

ROUTER ATTACKS:
FIVE SIMPLE TIPS TO
LOCK CRIMINALS OUT
By Alan Martin, We Live Security contributor
Cybercriminals always look for the
weakest link when planning their attacks
– often it’s human error, such as weak
passwords or opening phishing emails,
but failings in home routers can allow
another “way in”.
Over the past year, researchers have repeatedly
shown that the devices can contain “backdoors”
which allow attackers access to your private
data. Once known, this information will circulate
rapidly among cyber gangs. We also don’t
help ourselves. A study of 653 IT and security
professionals and 1,009 remote workers found
that 30% of IT professionals and 46% of remote
workers do not change default passwords on
their routers. So far, router attacks are a new
and evolving phenomenon – but it’s worth
protecting yours.
1) Don’t leave your username as ‘admin’
The first, and most important step, is to change
your router’s password from its default. Routers
ship with a Web page allowing users to adjust
settings, with default passwords and usernames
such as “admin”. These are widely known to
hackers, and should be changed immediately.
2) For extra security, change the firmware
A recent survey found that around 80% of
the top-selling “small office/home” routers
on Amazon shipped with known “critical”
vulnerabilities, making them easy prey for
cybercriminals. ESET Malware Researcher
Olivier Bilodeau says, “For the relatively
advanced consumer: install an alternative
open source firmware on your router.” These
are replacement versions of the official
firmware – and often more secure. This is not
for beginner PC users, but clear instructions
can be found online as to how to install.
Bilodeau recommends:
Tomato: www.polarcloud.com/tomato
DD-WRT: www.dd-wrt.com/site/index
Open-WRT: https://openwrt.org/
Around a third of IT professionals admit to never
changing the default settings on routers, giving
cybercriminals a potential ‘way in’ to networks.
38 welivesecurity.com