Advisory
How to Protect your Router from Hackers
28 November 2024
Do you know hackers can compromise the Wi-Fi router in your home and infect them with malware? These routers will then become part of a botnet - a network of hijacked devices that hackers can control to carry out cybercrime such as Distributed Denial-of-Service (DDoS) attacks.
Upon gaining unauthorised access to your unsecured router, attackers may continue to launch attacks to compromise other connected devices. These compromised devices may then be used as bots to launch DDoS attacks to overwhelm other targeted devices, services or networks with fake traffic, thereby rendering them inaccessible to users. Attackers can also exploit compromised routers to intercept unencrypted network traffic and access sensitive information like your passwords and browsing activity. You should secure your routers by:
1. Changing the Default Password
When setting up a router, create a complex, unique password with a mix of uppercase and lowercase letters, numbers, and special characters. Weak passwords like "admin" and "password" are easy for attackers to guess. Even default passwords that come with the router may not be secure, as they may follow a specific algorithm that may be known to others. As such, it is important that you create a strong, unique password so that only authorised users can access your network.
• For New Routers: Make a request to the technician to change the default password to one of your choice. Ensure that they do not have access to the new password.
• For Second-Hand Routers: To reset your router to factory settings, press and hold the 'Reset' button. The duration needed can vary by model, you may refer to your router’s manual or contact your Internet Service Provider (ISP) for the exact reset procedure. Once reset, use the default username and password (typically printed on a label on the router) to log in and update the default credentials to a secure one.
2. Enabling Automatic Firmware Update
Outdated firmware can expose your router to attacks that exploit known vulnerabilities. To ensure your router stays up-to-date without performing manual checks, consider enabling automatic firmware updates. This helps you to avoid missing out on critical security patches. Refer to your router’s user manual or search online for “[Your Router Model] firmware update” to learn how to enable this feature.
3. Blocking Remote Access
Disable remote management access unless absolutely necessary. This prevents unauthorised users from accessing and controlling your router from outside the network. If remote access is needed, use secure methods like a Virtual Private Network (VPN) and restrict access to trusted IP addresses. You can disable "Remote Management" (or similar settings) to configure these options.
4. Restarting or Rebooting Regularly
Restart your router every 1 to 2 months for preventive maintenance or when experiencing connectivity issues like slow speeds or dropped connections. You may do this by unplugging it from the power source or holding the power button until the lights stop flashing. Wait a few seconds before turning it back on. Rebooting clears temporary glitches, refreshes the connection with your ISP, and frees up the router's memory, helping to resolve connectivity issues.
However, if you suspect that your router is compromised or part of a botnet, resetting it to factory settings is more effective. This process erases all custom configurations, including any malicious scripts or unauthorised settings installed by attackers. After resetting, be sure to secure your router with new credentials and settings. Refer to your router's user manual for detailed instructions.
For more information on how you can secure your routers, read the advisory here.
References:
https://www.cyber.gov.au/protect-yourself/staying-secure-online/secure-your-wifi-and-router
https://www.cisa.gov/news-events/news/home-network-security
https://www.cisa.gov/audiences/high-risk-communities/projectupskill/module5