Vulnerable Wi-Fi routers lead to attacks and fake websites

It was recently discovered that millions of ADSL routers were hacked in Brazil to create a large botnet chain. This is an unprecedented move that goes to show that not even our routers are safe from attackers. Many homes and offices use Wi-Fi routers for web access today so it is important to understand the need to keep these devices protected.

Unfortunately, attackers have now come up with innovative methods to infect a router. A compromised router is dangerous because an attacker can direct a victim to fake pages that derive information and convince him to install malicious programs. Moreover, such pages can also contain drive-by downloads or malicious Java applets that can infect a system. Advanced attackers can even make use of spyware and other tools to record keyboard strokes, real-time videos through the webcam, audio recordings through the microphone and other data.

What makes a router vulnerable?

These nefarious incidents occur when an infected router leads to a malicious DNS server. Routers that are vulnerable to such attacks can be remotely accessed from the web and then programmed to direct machines to fake websites.

Malicious DNS Server

The primary cause of this vulnerability is that a majority of users do not change the default username and password for routers that they own. They simply use the default entries provided by a manufacturer instead. This username and password is required to access the configuration of the router and it can only be accessed by visiting a unique IP address that the manufacturer provides.

Moreover, security patches and fixes for router vulnerabilities are released very rarely. So if there is a vulnerability present, it takes a long time to resolve. Most users are also unaware about the need to update the firmware in their routers and this prolongs the time period for which a router can be exploited.

Steps to ensure router safety

The following steps need to be adhered to in order to prevent a router from getting hacked:

  • The default password provided by the manufacturer must be changed. The way to implement this can be learned from the router user manual or a Google search or a call to the support team.
  • If a firmware update for the router is available, it should be installed immediately.
  • If a router has a hardware firewall, it should be implemented. This Internet firewall protection can be enabled from the router settings configuration page.
  • The WAN ping feature from the configuration page should be disabled. This feature allows hackers to check if a WAN IP address is valid.
  • Security encryption like WPA2 or WPA (Wi-Fi Protected Access) must be enabled. This ensures that no party can access a WiFi connection and router without the password.

The best system protection software is essential for complete computer security, but there are certain manual steps that need to be taken as well. Attackers can only infect routers and machines if there is some form of vulnerability for them to exploit and such vulnerabilities can only be found on unpatched machines. It is strongly recommended that you upgrade to Quick Heal 2013 for protection against the latest malware threats and attack methods exploited by attackers.

Rahul Thadani

Rahul Thadani

You may also like...

Interesting news updates from the last week

FormBook

FormBook Malware Returns: New Variant Uses Steganography and In-Memory Loading of multiple stages to steal data

An in-depth analysis of a new, emerging “.url” malware campaign – by Quick Heal Security Labs

87 Comments

Your email address will not be published.

CAPTCHA Image

  1. Avatar Sameer • October 19, 2012 at 5:22 PM

    Thanks rahul for en-lighting the Router vulnerabilities and the need to update the firmware.
    Another one more attack technique on network…!!!

    Reply
  2. Avatar ombir singh • October 19, 2012 at 5:56 PM

    Thanks rahul for en-lighting the Router vulnerabilities and the need to update the firmware

    Reply
  3. Avatar seeraj sharma • October 19, 2012 at 6:18 PM

    Thnkes ,thankes dear rahul.

    Reply
  4. Avatar Ajay • October 19, 2012 at 6:44 PM

    thanks for the information

    Reply
  5. Avatar Naresh • October 19, 2012 at 7:05 PM

    Thanks, Rahul, for this latest threat information. I use a wi-fi modem, and have got my user id and password changed by the service provider. Is that enough? I also use Quick Heal Internet security AV in my system.

    Can you also let m know about this anti-logger software available on the net? Does it help, if installed? Something about this will also help.

    When you respond, will it be possible to mail a copy to me too?

    Thanks.

    Reply
    • Rahul Thadani Rahul Thadani • October 20, 2012 at 11:51 AM

      Hi Naresh,
      We cannot comment on this software. It is good that you have changed the user ID and password. Update your antivirus software regularly and your system will remain protected.
      Regards.

      Reply
  7. Avatar pratamesh1@gmai.com • October 19, 2012 at 8:34 PM

    Thanks for the Info :-)) …..

    Reply
  8. Avatar Kuldeep Kumar Mishra • October 19, 2012 at 9:27 PM

    thank you for information
    i have ADSL Type 2 Router With WiFi

    Reply
  9. Avatar RUCHI SOLANKI • October 19, 2012 at 9:29 PM

    I RECIVE THIS MASAGE DAILY WHAT WILL I DO FOR REMOVE THIS “MALWARE AND FIEWALL” WHAT WILL I DO???PLZ GIVE ME SOME SUGGETION?? HOW CAN I PROTECT MY PC AND NETWORK

    Reply
  10. Avatar Apoorva • October 19, 2012 at 9:30 PM

    Thanks for the info.

    Reply
  11. Avatar B M JAWAHAR • October 19, 2012 at 9:48 PM

    Thanks Mr.Rahul sir, how can get firmware update me.please give your advice always.Thanks again.

    Reply
    • Rahul Thadani Rahul Thadani • October 20, 2012 at 11:56 AM

      Hi,
      You must check the website of the manufacturer of your router to check for firmware updates. Alternately, you can speak to their support numbers also to know about these updates.
      Regards.

      Reply
  12. Avatar Praful Tarkar • October 19, 2012 at 9:58 PM

    One more Security measure is enabling MAC address filtering.

    Reply
  13. Avatar anant bhutoria • October 19, 2012 at 10:29 PM

    thnx for help

    Reply
  14. Avatar Rajiv • October 19, 2012 at 10:31 PM

    Can you confirm that Quick heal servers are malware proof? And online update must take of that..either Quickheal 2012 or 2013….!!

    Reply
  15. Avatar Mohammed Naushad • October 19, 2012 at 11:24 PM

    Thanks for informing.

    Reply
  16. Avatar Bhaskar Basak • October 20, 2012 at 1:28 AM

    Good

    Reply
  17. Avatar goku • October 20, 2012 at 1:32 AM

    thanks for the info …. nice……work ……

    Reply
  18. Avatar jafar • October 20, 2012 at 2:56 AM

    please send me the license key of quick hill

    Reply
  19. Avatar v sivaramakrishna • October 20, 2012 at 5:54 AM

    very very thanking you

    Reply
  20. Avatar abhijit haldar • October 20, 2012 at 8:21 AM

    Thanks,,
    Hey Rahul I have 27 computer in my office and it’s connected WORKGROUP,and I have WI-Fi Router.. So what is problem?
    please mail me!

    Reply
  21. Avatar Manish Ruparel • October 20, 2012 at 8:22 AM

    Rahul,

    Thanks for the information. We appreciate it as it is helpful to millions out there who are not very tech savy. Great work. Keep posting such info for benefit of all.

    Reply
  22. Avatar Somesh Sharma • October 20, 2012 at 9:17 AM

    Thanks for this important News Yesterday i face many problems with Wi-Fi

    Reply
  23. Avatar P.MANIKANDAN • October 20, 2012 at 9:30 AM

    PLZ THIS PROBELM CLEAN.

    Reply
  24. Avatar punit • October 20, 2012 at 10:21 AM

    Thanks for share information……..

    Reply
  25. Avatar Ankit • October 20, 2012 at 10:43 AM

    Thanks for this important News Today. i face many problems with Wi-Fi router. thnnx. .

    Thnx and best regards

    ankit verma
    frontier Agencies pvt.ltd.
    lucknow.220005

    Reply
  26. Avatar Mahender Garg • October 20, 2012 at 10:45 AM

    thank sir for inform that us…..please solve this problums….I request you.

    Reply
  27. Avatar Thulasidas • October 20, 2012 at 10:55 AM

    Your article on router vulnerability will certainly help the users to take more precautions.

    Reply
  28. Avatar khemnath sharma • October 20, 2012 at 11:24 AM

    good

    Reply
  29. Avatar Amit J. • October 20, 2012 at 11:59 AM

    Thanks for the imformation Rahul.. another grate security setting is that MAC ADDRESS BINDING ENABLE ON YOUR ROUTER.

    Reply
  30. Avatar shashikant • October 20, 2012 at 12:17 PM

    Thank you Mr Rahul providing us with valuable information regarding malware.

    Reply
  31. Avatar milan • October 20, 2012 at 12:29 PM

    i need this

    Reply
  32. Avatar Rajendra Joshi • October 20, 2012 at 1:20 PM

    I have my PC in my house with Router & I have quickheal software of total security. Should I change User ID & Password.

    Rajendra Joshi.
    20/10/2012

    Reply
    • Rahul Thadani Rahul Thadani • October 20, 2012 at 4:33 PM

      Hi Rajendra,
      Yes it is advisable to change your user ID and password for the router in your scenario.
      Regards.

      Reply
  33. Avatar S.Prempiyaran • October 20, 2012 at 1:31 PM

    Thank you. Hope of the best

    Reply
  34. Avatar Bartwal • October 20, 2012 at 1:47 PM

    A lot pf thanks the latest threat information

    Reply
  35. Avatar imran khan • October 20, 2012 at 3:29 PM

    thanxxx 4 tha help

    Reply
  36. Avatar RAVI • October 20, 2012 at 3:42 PM

    THANK YOU

    Reply
  37. Avatar Dhruv • October 20, 2012 at 7:08 PM

    Thanks for the information

    Reply
  38. Avatar Payal • October 20, 2012 at 9:37 PM

    I want to update QHIS 12 but an error occured A dialog box appears that shows ” Unable to complete the download process due to internet disconnected from remote side please check the internet connection ” but the internet is connected i cant understand the problem please solve the issue.

    Reply
  39. Avatar Haji Khurshid Anwer • October 20, 2012 at 10:14 PM

    Thanks for information,I sure u r realy great person,god bless you.Haji Khurshid Anwer

    Reply
  40. Avatar Rajiv Kumar Sharma • October 20, 2012 at 11:09 PM

    I received a mail with subject UPS member. But when I open attachment file with mail. My pc suddenly restart and Guardian antivarus give me massage that my saystem atack with virus and theft data online. I immedaitly log off my system and load the fresh window and load Quick Heal antivirus . plz suggest what happen now .

    Reply
  41. Avatar yogesh • October 20, 2012 at 11:14 PM

    i am running a site through my thru wamp server… should i change the id pass?
    i have quick heal total security installed

    Reply
    • Rahul Thadani Rahul Thadani • October 22, 2012 at 10:20 AM

      Hi Yogesh,
      You can change the password as a preventive measure if you feel that you are susceptible to attacks like this.
      Regards.

      Reply
  42. Avatar rishabh parashar • October 21, 2012 at 9:46 AM

    think if some one crack our password then how we will come to know

    Reply
    • Rahul Thadani Rahul Thadani • October 22, 2012 at 10:16 AM

      Hi Rishabh,
      It is very hard to find out if someone has discovered a password or not. The best thing to do when in doubt, is to change the password immediately.
      Regards.

      Reply
  43. Avatar Nikhil Goswami • October 21, 2012 at 3:02 PM

    Hi Rahul,

    Thank you for details & preventive care suggested regarding Wi-fi Routers. At present we are using Quick Heal Total Security 13.00 on our system & are using Zyxel Wi-fi Router. I think we are victims of the issue. We are facing similar problems as discussed by you.

    We are directed to different websites & also, display of web pages of certain websites takes long time. Some websites ask us to login again & again. We did not faced such problems earlier. Our Internet Connectivity is excellent.

    Also, We are located in Nashik & We have observed on Internet
    (i.e google & Facebook )our Location is displayed as Aurangabad.
    during day i.e between 9AM to 8.30 PM & it displays Nasik at night i.e 8.30 PM to 9AM.

    We will be obliged if you suggest extra preventive actions also.

    Regards,
    Nikhil G.

    Reply
    • Rahul Thadani Rahul Thadani • October 22, 2012 at 10:15 AM

      Hi Nikhil,
      If this attack has occurred on your router, it is a very serious issue. You need to take corrective steps immediately. We recommend that you visit our support page and submit a ticket – https://www.quickheal.com/submitticket.asp. Our support team will get back to you. You can also call our support team for further analysis. You should also update the firmware of your router immediately.
      All the best.

      Reply
  44. Avatar abhishek agnihotri • October 21, 2012 at 4:47 PM

    thnx rahul

    Reply
  46. Avatar raaj sharma, dhanbad • October 21, 2012 at 5:59 PM

    Rahul sir,, i think someone is trying to hack my computer, i used quick heal total security. can it protect my laptop from these type of hackers or i should have to change my antivirus software, please give me some suitable direction in my mail as soon as possible.

    Thanks

    Raaj computers
    dhanbad-826004
    Jharkhand

    Reply
  47. Avatar kishor dulal • October 21, 2012 at 7:03 PM

    thanks for giving me a valuable information.i have also got problem in my pc

    Reply
  48. Avatar Ramesh kumar • October 21, 2012 at 11:40 PM

    thanx for information help

    Reply
  49. Avatar Mayuri • October 22, 2012 at 2:16 AM

    Thanks for informing about this….!!

    Reply
  50. Avatar Mayuri • October 22, 2012 at 2:19 AM

    Thanks for informing about these viruses…..

    Reply
  51. Avatar Rits Singh • October 22, 2012 at 10:04 AM

    hello,

    I have a probel with blue screen and dump memory problem…Blue screen appears and it says that it is due to caching.Please provide solution with this problem..

    Reply
  52. Avatar Rits Singh • October 22, 2012 at 10:14 AM

    hey
    we have problem with blue screen and dump memory..
    There is a problem of Caching..

    Please provide solution for it.

    Reply
  53. Avatar rajesh • October 22, 2012 at 12:09 PM

    thanks for information

    Reply
  54. Avatar umesh • October 22, 2012 at 1:39 PM

    thnks 4 new trick

    Reply
  55. Avatar raaj sharma, dhanbad • October 22, 2012 at 10:18 PM

    thnaks rahul sir ….

    Now i want to introduce a new problem which is happening in my laptop. while watching movie in laptop , the screen is automatic looks like scratching type. Is it problem of virus affected or other ??????? my laptop is of Dell compay model number INSPIRON 15R . when i reached the shop where i bought my laptop and told him about the problem then he adviced me that it is due to software ,we cant help you anytype .he told me that we only give the warranty of hardware not for software. Now what should i do rahul sir,, please tell me ??????????????????/

    Reply
    • Rahul Thadani Rahul Thadani • October 23, 2012 at 1:05 PM

      Hi Raaj,
      The chances that this is happening due to software are very low. Check if the screen has physical signs of damage. If not, use a different program to watch movies. Or view a different video file, maybe the file you saw was corrupted.
      Regards.

      Reply
  56. Avatar ASHISH AHUJA • October 23, 2012 at 2:40 PM

    Thank you, for informing, I’ll be more careful about that !!

    Reply
  57. Avatar Anshu • October 23, 2012 at 4:35 PM

    how can i change my default password provided my manufacturer to my com from vulnerablre wi-fi router?????

    Reply
    • Rahul Thadani Rahul Thadani • October 25, 2012 at 11:28 AM

      Hi Anshu,
      If you have a user manual for the router, the steps will be mentioned there. If not, you can visit their website and get the steps. If that does not work, you will need to call their support number.
      Regards.

      Reply
  58. Avatar kunalkaushal • October 23, 2012 at 6:57 PM

    dear sir,
    thankyou for

    Reply
  59. Avatar vijay chouhan • October 24, 2012 at 9:42 AM

    Hello Sir, Please Repeir my Anti Vourous.
    Thanks.

    Reply
  60. Avatar vijay chouhan • October 24, 2012 at 9:44 AM

    Hello Sir, What is Wi-Fi Routers.

    Reply
    • Rahul Thadani Rahul Thadani • October 25, 2012 at 11:21 AM

      Hi Vijay,
      Wi-Fi routers are wireless modems that allow your laptop/mobile/other devices to connect to the Internet wirelessly.
      Regards.

      Reply
  61. Avatar ABHINAV ANKUR • October 24, 2012 at 6:29 PM

    thanks

    Reply
  62. Avatar ds vishwakarma • October 26, 2012 at 11:10 PM

    Thank you Rahul for awaring Wi-Fi router threat. It is a great tip to protect our system. Again many – many thanks and with regards.

    Reply
  63. Avatar ds vishwakarma • October 26, 2012 at 11:16 PM

    thanks for useful information. I certainly ensure its implementation.

    Reply
  64. Avatar ds vishwakarma • October 26, 2012 at 11:22 PM

    Thanks.

    Reply
  65. Avatar ds vishwakarma • October 26, 2012 at 11:26 PM

    thanks for guiding us on a new threat through Wi-Fi.

    Reply
  66. Avatar mkpathak • October 29, 2012 at 11:22 PM

    Wow. good initiative to alert common man.

    Reply
  67. Avatar saif • November 3, 2012 at 10:39 AM

    thanks dude

    Reply
  68. Avatar rohit sarkari • September 23, 2014 at 10:11 PM

    After I update the router ………… default username and password is not working ……. help me please

    Reply

This website uses cookies to ensure you get the best experience on our website. Learn more