Tutorial: ADSL Router Security

[ItalicBold]

Hi guys I have decided to write a tutorial on how to secure your ADSL routers. This is written specifically for the Marconi routers, however the security issues it deals with is relevent to all ADSL routers. This tutorial is only relevant if you are using the PPP over Ethernet Sub-interface. If you dial out from your desktop you are using the EoA Bridge interface and this tutorial does not apply to you. What ever interface you are using I HIGHLY recommend that you install the supplied Nortan Internet Security software on all your machines. If you do, it is essential to keep this software up to date (use Live Update). I also suggest you regularily use windows update to patch your machines if they run on a Microsoft OS.

This article assumes that you are using the default modem ip of 192.168.10.200 with the default user name ("root") and password ("root"), and is written with the modems web interface in mind.

Running a router with the default settings can allow anyone on the Internet to steel your ISP info (and thus abuse your cap). This can be done by going to http: //root:[email protected]/ clicking on <u>Basic Config</u> and then <u>ISP</u>. Then select a listed ISP and click "Modify". The right click anywhere on the right frame and click "View Source", if you shift through the HTML code, you will see your ISP username and password in plain text.

They can also set up PAT using the range of IP addresses listed in your DHCP configurtaion to open ports on any pcs connected to the router if they aren't running a firewall (such as Nortan Internet Security).

The first thing to do is to set up a user name, password and to change the port of the web interface. To do this go to http: //root:[email protected]/ click on <u>Basic Config</u> and then <u>System</u>. Change the Supervisor ID and Supervisor Password to something unpredictable. For this tut I will use a Supervisor ID of "Super" and a Supervisor Password of "Tutorial". Now scroll down and change the port of the web interface to something unpredictable. For this tut I will use a port of 923. Now before u click finish, go to your desktop and righ click. Choose "New" and then click "Shortcut". Now enter in the url of your modem in the following format http: //USERNAME[email protected]ORT/ the tut url would look like this http: //Super:[email protected]:923/, click next. Give the shortcut a name like "ADSL Modem" and click finish. Now go back to the webinterface and click finish. Save and restart the router. You can now use your shortcut to access the modem with a simple double click. You may want to hide this link away if you go to a LAN so that no one can get hold of your modem information.

If you delete this link by acident and forget your username, password or port, all you have to do is go to the modem and hold the reset button for 5 to 10 seconds to reset the modem to the factory defaults. Your modem can then be accessed by the default http: //root:[email protected]/. I recommend you follow this tut again to secure your modem if you end up doing this.

The next thing to do is to secure yourself from a Telnet attack. To do this, double click on your new link to open the web interface. Click on <u>Basic Config</u> and then <u>Telnet / Console</u>. First remove any existing user profiles one at a time by selecting their ID and clicking "Delete". Now set "MAX User:&lt;1~5&gt;" to 0 aswell as the port to 0. Now click Finish, save and restart the router. You might want to remove the default PAT and NAT entries in a similar manner, just for the sake of cleanliness.

Please feel free to post corrections or comments below.

 

[daredevil]

Sounds good to me
I have accidentally stumbled across a few routers and gained access
by using root root.

I have no idea how the web interface came up over the internet. Its only supposed to come up for internal connections. Any ideas why that happened?

 

[ItalicBold]

Just remove the " " from between the "http:" and the "//" in the links for them to work. Unfortunately these forums mess up the url as it has too many ":"s I think.

 

[pdos]

Another way, which I use, is to use PAT to point ports 80, 21, 23 and 110 to a none existent machine on the subnet.
If anyone probes these ports they will get no reply, what Gibson Research calls 'stealth mode'.

 

[ItalicBold]

Yes that is also true, which is why with the default PAT settings you should'nt be able to access the router externally throught the web interface. This explains why daredevil has not always been abble to access routers. It depends on weather they left the defaul PAT settings. BUT the default settings don't protect you from telnet access.

Through telnet one could edit the remove the default or PAT setting and then access the router through the webinterface, thus steeling the isp info. I am not 100% sure on weather or not you can gain the isp password through telnet, but you can through the webinterface.

 

[pdos]

OOPS !!

Please cancel my terrible advice.

My tests show that with PAT, if the router does not find the destination machine then port forwarding is disregarded and the router accepts the connection.

I actually had a firewall on the other side that was dropping the connections, fooling me.

 

[pdos]

Now I am getting dizzy, changing my mind so often.
More tests and using PAT to an imaginary machine does indeed seem to work, putting the ports in stealth mode.

I would appreciate input from others more knowledgeable

 

[ItalicBold]

This is something that is pretty hard to test ones self as, even if you are forwarding to a valid machine, you WONT be able to access the port IF you are behind the router, and if you are forwarding to an invalid machine you will STILL be able to access the web client IF you are behind the router and using your external ip. LOL.

 

[pdos]

Yes, that is a problem.
My workaround was to use www.grc.com to scan my ports.
That seems to work.