Asus Router App Security Warning!

[cmillar6]

So I thought I would experiment with the Asus Router app on my iPhone. To my surprise the app has Remote Connection enabled by default and it goes ahead and enables DDNS for you without even asking. I would think they should at least warn you of this.

 

[scjr]

Thank you for this post. I’m just learning and indeed, the app turns those services on. I tried the app briefly and didn’t like it. I turned both off.

Thanks again!

 

[bbunge]

Have not experienced this with either the Android or iOS version. However, I have https access in the router set before I connect the Asus app.

Sent from my P01M using Tapatalk

 

[maxbraketorque]

Have not experienced this with either the Android or iOS version. However, I have https access in the router set before I connect the Asus app.

Sent from my P01M using Tapatalk

As has been discussed in other threads, https should not be considered secure for these routers, and it advised to to not allow connection to the router interface from outside of the router network by https. A properly configured VPN tunnel is the only safe means.

 

[bbunge]

As has been discussed in other threads, https should not be considered secure for these routers, and it advised to to not allow connection to the router interface from outside of the router network by https. A properly configured VPN tunnel is the only safe means.

I said nothing about connecting from the WAN. My intent was to state that the app did not turn on WAN access! I have noticed the app likes to use https even on the LAN connection so I enable https, actually both, when i configure the router. There is no reason to consider the Asus router app insecure.

Sent from my P01M using Tapatalk

 

[maxbraketorque]

I said nothing about connecting from the WAN. My intent was to state that the app did not turn on WAN access! I have noticed the app likes to use https even on the LAN connection so I enable https, actually both, when i configure the router. There is no reason to consider the Asus router app insecure.

Sent from my P01M using Tapatalk

ok. I was assuming that since you are connecting by https that you connect from outside the network.

 

[bbunge]

I can confirm that the app, both the iOS and Android, will turn on "Enable Web Access from WAN" and DDNS with a generated "Host Name." I had occasion to reset my RT-AC66U B1 to factory settings and decided to see what happened.
I can also confirm that the apps do not mess with these settings if "Authentication Method" is set to both before you try to connect to the router with either app.
Still, having the app turn on WAN access and randomly set a DDNS is not a good idea at all from a security standpoint. Most home users have no clue what the risks are! I had my DDNS turned on the other day and within a short time the router was probed from two IP addresses from Sao Paulo, Br. AiProtection caught both.
Has anyone filed a complaint to Asus about this?

 

[fax]

Using the app and here there is no modification whatsoever on WAN access or DDNS. Very weird what is happening there.



Sent from FRD-L19 with Tapatalk