What's new

Hack my own Asus router?

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

explorer200

Occasional Visitor
I'm wondering how hackers are able to steal information once they get access to a router? Is there a way I can hack my own router to test my network security and see firsthand what sort of data a hacker could access on my network once they have access to my router?

Running an AX88u
 
I'm wondering how hackers are able to steal information once they get access to a router? Is there a way I can hack my own router to test my network security and see firsthand what sort of data a hacker could access on my network once they have access to my router?

Running an AX88u

You want Asuswrt hacker instruction... here?

OE
 
You want Asuswrt hacker instruction... here?

OE
Just curious what could actually be done if somebody hacked my router. I know they can see websites visited and servers connected to, but how much could they see and how easy would that be once they had admin credentials?

Is it mostly a matter of running scripts via SSH?
 
What about harvesting browser data? Like logins, passwords, etc. Can they access this via the router?
99.9% of your login data is sent through https, meaning it's encrypted and they have no access to it, even if they were inside your router.
 
Hacked routers could conduct DNS hijacking. More dangerously, hacked routers could also be maliciously flashed with compromised firmware.
 
I'm wondering how hackers are able to steal information once they get access to a router? Is there a way I can hack my own router to test my network security and see firsthand what sort of data a hacker could access on my network once they have access to my router?

Running an AX88u
Don't trust your router.
 
Time to make a hat and blanket for the router:

Alum Foil Hat.JPG
 
Some basic steps will prevent 99.9% of "router" security issues (there's always that REMOTE chance, even if you follow best practices, that someone is persistent enough to "break in")...

1. Always change the default administrator router username and password (use a lengthy phrase for your password, such as "the$heepjump3dovertheFence"...longer passwords are tougher to crack) on your router...admin/admin begs for problems, and changing the password a few times per year won't hurt.
2. Keep port forwarding OFF.
3. Don't allow remote management of your router from the WAN.
4. Keep your firmware updated...back doors/security holes/vulnerabilities are discovered occasionally, keeping things up-to-date will minimize risk of security compromises through firmware
5. Use hidden SSID's for your Wifi so that you're not publishing your Wifi network name out to your neighbors or passer-by's, and use lengthy passwords for your Wifi network(s).

There are dozens of other "best practices" measures you can take, but the 5 above should make life quite difficult for an unwanted guest trying to exploit your router. Of course, getting phished or clicking on one of those "you have a virus" pop-up windows on your laptop or tablet/phone will flush your great router hygiene down the crapper.
 
Last edited:
There’s one way to profit from a hacked router, and was a serious problem once because routers used to trust accesses from the LAN side and users keep the default passwords.
They change your DNS settings by XSS or other similar means. As a result, most the websites you visit will have ads displayed over them.
This way more profitable, sustainable, and scalable, and harder for average users to spot when compared to stealing their credit card or login information.
 
the$heepjump3dovertheFence
Unfortunately that’s longer than ASUS routers allow…

Additionally I think it is current advice to not do simple replacements (like $ for s and 3 for e) and to not combine words that together make a well known (or logical) sentence.

(Still, by being “long”, using lowercase, uppercase, a special character, and a number, this password might already be better than average?)
 
... "the$heepjump3dovertheFence"...
Unfortunately that’s longer than ASUS routers allow…
That used to be the case (16-char maximum limit) *before* the changes made in F/W versions using GPL 43129 or later, released last year. So if you have updated your ASUS router with the latest F/W versions since then, a 26-char password like "the$heepjump3dovertheFence" is no longer a problem WRT length.

 

Latest threads

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!
Top