Because the router is the main doorway and gateway 2
into your network, 3
both locally and via the internet, 4
it is a crucial component for maintaining security, 5
privacy and anonymity. 6
Routers have a very, very tainted history 7
of vulnerabilities and bad default configurations. 8
They’re often plugged in and just left running. 9
If they become vulnerable, you never find out 10
and nothing is ever done about it, 11
and they remain vulnerable. 12
Here you see some of the many examples of 13
vulnerable routers and incidents of vulnerable routers. 14
Let me introduce you to Shodan, if you are not familiar with it. 15
Think of Shodan as a search engine 16
that searches for vulnerable devices on the internet. 17
It’s the Google of vulnerabilities, or the Google of 18
internet of things if you like. 19
It continually scans the internet looking for vulnerabilities 20
and then adds it to their database 21
to make it searchable. 22
So let me give you an example here. So I’m typing in just simply “netgear”. 23
Both hackers and security researchers use this to find targets 24
and to protect their own infrastructure. 25
So this search query here has returned back 26
devices that have responded with this string, netgear. 27
NetGear, being one of the most popular 28
home router manufacturers. 29
So what this means is that these are open ports 30
on these NetGears. 31
So if you look here, you can see there’s 100,000 32
NetGears with port 8080 open, 33
you’ve got HTTP, you’ve got FTP, 34
and this is essentially the response back that they’re giving, 35
so it’s saying which 36
NetGear it is, 37
and it’s saying Unauthenticated, because 38
a username and password is not being provided. 39
Unless there is a very good reason, 40
and the device has been hardened especially for it, 41
no router should be allowing access 42
to its admin interface to the whole internet like this. 43
The attack surface has to be minimized. 44
If you need access to your admin interface, 45
you need to at least VPN in 46
to your network 47
in order to access the admin interface, 48
or preferably it should only be accessible internally. 49
So literally, hundreds of thousands of them, 50
and that’s just from one search from one string. 51
The sort of strings you are more likely to put into this search engine here, 52
are ones that indicate vulnerabilities, 53
so that you can find vulnerable devices. 54
So I’ve put in here “default password”, 55
meaning that these devices are responding 56
with the terms “default” and “password”. 57
And if we look down here, 58
let's see what we can find. 59
So this has given us some examples that Cisco might be the default password, 60
but then we’ve got this particularly interesting one 61
telling us that the default username is “admin” 62
and the password is “1234”. 63
And that’s on ADSL, 64
that’s probably Taiwan so that is 65
somebody's home router 66
that’s probably got the username 67
and password displayed to everyone on the internet. 68
Well, let's find out. 69
So there we are. We’re on some unfortunate person’s – 70
let me just zoom in – we’re on some unfortunate person’s 71
internal home router, 72
and I don't think I need to tell you 73
what you could do from here. 74
Obviously, we can start trying to compromise the internal devices, 75
we can start looking at the network traffic, 76
we can act as a man in the middle 77
and SSL strip his traffic, I mean essentially, 78
we can own the network and own his devices. 79
Let's have a quick look. 80
And there’s 81
his WiFi password, he has actually selected the best and strongest 82
method of encryption, 83
and let's look at why he actually has this problem, 84
why is this accessible? 85
And that’s the reason. He’s set up Port Forwarding or a DMZ, 86
which has enabled access to this device from the internet, 87
which was a mistake. 88
And there will be literally hundreds of thousands of 89
vulnerable routers, 90
this is just a vulnerable router in terms of 91
default, username and password, 92
but there will also be routers vulnerable 93
in terms of they have vulnerable code, 94
they haven't been patched, 95
and we can even search for those using Shodan. 96
So here I’ve done a search for NetGear, 97
and it’s linking to the Exploit database, 98
so then we can look on the Exploit database 99
and find Exploit code 100
and Exploit strings to search for 101
to find vulnerable routers 102
that we can get potential route access 103
or some sort of access to it, 104
using the various vulnerabilities hat are out there. 105
Are you confident that your own router is locked down and secure? 106
Well, we can find out. 107
If you find out your router’s external IP address, 108
you can go to “whatismyipaddress”, 109
you can see on Google; 110
you can also go to here: whatismyipaddress.com, 111
I’ve shown you this many times, 112
and then pop that into Shodan and see what you get. 113
This is an IP address I’ve just chosen at random 114
because it represents UK, 115
BT Local home users, 116
so it’s just an example one. 117
And as we can see here, 118
this is someone’s 119
home router by the look of it. 120
Now, because IP addresses are generally dynamic, 121
at least they are in this country, 122
or they certainly are with BT anyway, this means that this IP address 123
has had this port on it at some point. 124
It doesn't mean it is vulnerable now, 125
but it does say last update 126
was then, so this could very well be available 127
And as you can see, it’s some sort of 128
web server of some sort. 129
And that one doesn't look to be available. 130
So it may be that whatever the device was, 131
is now changed to a different IP address. 132
Even if nothing shows up on here for your router’s IP address, 133
that doesn't really necessarily tell you much. 134
You can go direct to the source of the information. 135
If you want to know what services and ports are running on your router, 136
you can go onto the router’s web admin interface. 137
To access your web interface by the way, 138
I mean usually it would be at http, or https 139
on whatever the IP address is 140
that you looked up. 141
And here’s an example, web interface for DD-WRT, 142
the router firmware. 143
It isn't always easy to see what is running, 144
especially if you’ve not looked much at your router. 145
There are lot of tabs and sometimes services could be running, 146
but it doesn't even tell you. 147
You can check for services, if there’s some sort of services tab 148
to see what services might be running. 149
If you want to know whether or not 150
there’s any network address translation port 151
forwarding and demilitarized zone, 152
then you want to look for those sorts of things: 153
port forwarding, port range forwarding, 154
DMZ. 155
This can point to ports being opened up 156
to the internet and this will look different, 157
depending on what router you have obviously. 158
Check on your router to see if it has this UPnP, 159
which is the Universal Plug and Play. 160
This allows port forwarding to set up automatically, 161
so you can imagine this may not be a good idea. 162
You may have some internal device, if UPnP is set up, 163
that communicates with your router 164
and opens up a port automatically without your knowledge, 165
and this also has a history of vendor vulnerabilities as well. 166
So it’s not just opening the ports automatically without your knowledge, 167
it also has vendor vulnerabilities. 168
So in your interface make sure that it is disabled 169
and set up port forwarding manually yourself, 170
if you want to do port forwarding. 171
If you do do any port forwarding, 172
whatever you port forward to 173
must be absolutely secure and hardened, 174
because that is an open doorway 175
to your network and to whatever device you are connecting to, 176
so think long and hard about port forwarding to any device. 177
It must be fully secure and hardened. 178
And while you are here, you should check to see whether or not the 179
router is up to date with patches. 180
You’ll have to look around and see whether you can find some option 181
to see whether or not it has been updated. 182
Other than web admin interface, you can try to SSH 183
or Telnet to the router 184
using the internal IP address 185
that you’ve got from looking up the default gateway. 186
We’re on a Mac here, both Mac and Linux 187
come with SSH, 188
so there we have the default gateway. 189
On Linux, as I said, it is “route-n” to show you the default gateway. 190
This is a basic SSH command to log in. 191
“SSH” is the command, 192
“root” is the username, 193
@ and then the IP address of the router you’re trying to connect to. 194
This will connect via the default port 22. 195
And there we are logged in. 196
On Windows you don't have SSH, so you can try 197
using a program called PuTTY, 198
just download and install it, it is free. 199
That looks like this and you simply put in the 200
router IP address in here, 201
I’m going to click Open, 202
and then enter your username and password. 203
Then, when on the root, you can attempt to look at 204
what ports are open 205
using “netstat – tuln.” 206
And here I can see with IPv4, 207
I got port 80 listening, 208
53, which is DNS, 209
and 22, which is SSH, which we just connected to. 210
So these are open and listening, 211
but these are more likely to be open and listening 212
for your local network and not your internet, 213
unless the DMZ or port forwarding has been set up 214
on your router. 215
So we do definitely want to definitively check 216
what ports are open on the internet side of the router, 217
and I’ll show you how to do that now. 218
What I’m going to show you are websites that do port scanning, 219
which probe the router’s open ports. 220
There are 6,535 possible open ports, 221
but these sites will just check well known or common ports, 222
or on some, like this one, 223
you can specify 224
a range, you can have a list, 225
or you can use the common ports. 226
Just a word of caution though, port scanning 227
could be potentially maybe illegal to do 228
on devices you don't own. 229
It’s a bit of a grey area. 230
In the US, under the Computer Fraud and Abuse Act 231
of America and the UK Computer Misuse Act of 1990, 232
and others in their respective countries, 233
although I don't ever believe there has been a conviction, 234
it’s just a bit of a grey area, so just bare that in mind, 235
but there is no issue of course port scanning on your own devices. 236
So this is my IP address here. 237
And for interest you can see if you can detect the 238
service version and the operating system, 239
I’m not going to select that, because it will take a little bit longer to do, 240
and let’s start the scan. 241
So there you go, you can actually see a number of ports. 242
I’m actually coming from a VPN here, so 243
it’s not unreasonable that there are some ports here. 244
If this is your home router, it should show as having no ports, 245
and as a demonstration, 246
I want you to see it’s showing some ports. 247
So here you can see it’s discovered 248
these ports here. 249
This site’s actually using a tool called "Nmap”, which is available in Kali, 250
which we’re going to talk more about later on. 251
For good measure you can try another site as well. 252
There’s this one, 253
this searches for common ports as well, 254
so there you go, it shows the same 255
ports. 256
And for good measure, there’s also Steve Gibson's ShieldsUP! 257
So I’ll select Common Ports. 258
So there you go, slightly different results there. 259
Another site here, you can check if your IP is in a 260
database of known vulnerable devices and routers. 261
Simply go down here 262
and click “Check me”. 263
“Good news! You are all clear.” 264
Now, if you do have ports open, or you are getting warnings, 265
then you need to investigate. 266
I recommend a full vulnerability scan, 267
which does more than port scanning, 268
it will check to see if the device is also vulnerable 269
to any exploits. 270
The best vulnerability scanner I can recommend 271
for free is Qualys FreeScan, 272
which is an online vulnerability scanner, which you can see here. 273
You will have to register and go through all that process which is a little slow, 274
but once you have done, you got access to actually a very powerful 275
vulnerability scanner. 276
Free scan is limited to 10 unique security scans 277
of internet accessible assets. 278
So you should be able to scan your external router, no problem. 279
It will provide detailed guidance on how to fix any specific 280
vulnerabilities that you might have, 281
but generally, the answer will be to patch the router, 282
make sure the router is up to date, 283
and remove any services that are open and are running, 284
unless you absolutely need access to them, 285
and if you do, those need to be secure services, 286
i.e. they have authentication and there’s no vulnerabilities in them, 287
and they are kept up to date with security patches.