Author Topic: can the router settings be changed by virus? If it is secured by ISP (Read 49084 times)

jraju · « **on:** January 16, 2016, 10:11:52 pm »

Hi, I want to know if it is possible to change the settings in your reuter settings by virus or trojans even if it is giving NAT mode security ISP ? Normally reuters are secured as long as you do not allow anybody to your computer. But, could it be done by virus, to stop the internet access?
Did you come across? If , how to be secured even in this.
what the virus would do to penetrate the security connections of individual bband wifi

Boggin · « **Reply #1 on:** January 17, 2016, 12:53:15 am »

This router infection was found in 2014 but others may not be restricted to Linksys routers.

http://www.pcworld.com/article/2880189/watch-out-for-malware-on-your-router.html

I think there was something else going around that affected certain router chipsets but I can't find the thread anymore on www.billion.uk.com/forum where users were posting their concerns.

Generally, keeping your router's firmware up to date should protect you, but there was a White Hat infection doing the rounds at one time that actually protected routers from infection.

http://www.theverge.com/2015/10/1/9434521/router-virus-fights-off-malware-security

jraju · « **Reply #2 on:** January 17, 2016, 03:54:10 am »

Hi, How could i update the firmware, is it not risky. all the settings have been done by them for me. Is it not? If suppose, i update the firmware, would it not amount to their security being touched without their consent.
Please tell . if i can , how to to in router website

Boggin · « **Reply #3 on:** January 17, 2016, 04:06:28 am »

It depends upon whether you are using an ISP supplied router or not and whether the ISP is up on threats, but checking the firmware level of your router and Googling for firmware for your make & model otherwise, can show if you have the most current.

jraju · « **Reply #4 on:** January 17, 2016, 04:10:23 am »

Hi, Router , you mean modem. Ofcourse, i have purchased teracom modem from them. I access the router page thro the general access at the said gate point.
I did see some options in the pages of the server connection details there. But i just checked as was told by the ISP.

Boggin · « **Reply #5 on:** January 17, 2016, 04:25:01 am »

In some areas, separate modem and routers are still used by ISPs but they are gradually moving over to modem/router combos where you just have one device.

In the UK ISP devices are usually combos.

Terminology is another thing - some people still call their combo routers, modems.

What are you using ?

jraju · « **Reply #6 on:** January 17, 2016, 04:29:13 am »

Hi, I am using the terra com modem, on which both bb and wifi settings are configured by the ISP.

Boggin · « **Reply #7 on:** January 17, 2016, 04:32:49 am »

Then you would be reliant upon your ISP keeping abreast of things for their firmware updates, but you could contact your ISP to see if your device is up to date.

jraju · « **Reply #8 on:** January 17, 2016, 04:36:21 am »

hi, when my son tries to connect thro wifi using his android phone, a security alert he received by avast . On scanning that, it shows Rom O vulnerability found. What is that? Please say, how it would have been possible to affect my router. Is that mean, all the router of this ISP are affected, or a particular machine like mine.

Samson · « **Reply #9 on:** January 17, 2016, 04:49:00 am »

Here you go J. Expand the 3rd section "Details". Contact your iSP for any firmware update/ patch.

https://help.avast.com/en/ws_android/1/alert_vulnerable_router.html

jraju · « **Reply #10 on:** January 17, 2016, 05:08:39 am »

Hi, Samson.
Thanks for the link. I want to know, whether it is common attack for this kind of modem or only my modem.
Is there any thing that would get rid of it , by scanning thro computer to which the wifi modem is attached.?

Boggin · « **Reply #11 on:** January 17, 2016, 05:15:19 am »

You could try factory resetting it if it has that facility but you would first need to log into it for the details that needed to be input when it was first set up, but I'd contact your ISP for advice.

jraju · « **Reply #12 on:** January 17, 2016, 05:19:23 am »

Now, my network is shown as Public, with a bench icon. Can i change to Home , with home icon without affecting the internet access or wifi access

Boggin · « **Reply #13 on:** January 17, 2016, 05:32:25 am »

Yes, just click on it and change, but Public is the most secure of all.

However, if you are on a Home group then I believe it needs to be set to Home.

jraju · « **Reply #14 on:** January 17, 2016, 05:38:32 am »

Hi, I do not understand a bit. I just selected Home group when i first installed the OS . Thats all. How Public is secured.
What is meant by Home group. Is it sharing between members having computers more than one at home. How Public is better. How it is assigned home or public? How come my Home changed to Public, when i configure the modem after advice from ISP

Boggin · « **Reply #15 on:** January 17, 2016, 09:50:13 am »

I'm not sure why yours changed from Home to Public - mine has done that before, but you are right in that a Home Group is sharing between computers in the home environment.

While at home, the Home setting should be fine.

http://www.digitalcitizen.life/network-locations-explained

jraju · « **Reply #16 on:** January 17, 2016, 04:28:04 pm »

Hi, samson,How can i disable the wifi, when i do not want it. It is the question. Avast confirmed that the router is affected with Rom vulnerability, which it says that it prevents from ROM memory to totally erase when RAM has to cease to exist, when powering off.
i followed the instruction to trial vpn, by them. But it has not resolved my issue, instead downloaded their sub softwares to the phone.
I went to the LInk by samson, which i think that it goes to the check page of avast check on my router page. It also lists the vulnerability and it says to update firmware or contact ISP.
Hi, boggins.
If the router is affected, it means the modem of the particular person is affected. Is it correct , pl confirm.
Or if the router is affected that it affects all the router pages of the service provider
Actually we are least bothered about problems in secured connection, but when this sort of sudden change of internet access to nil, we have to think of getting rid of so called wifi attacks.

jraju · « **Reply #17 on:** January 17, 2016, 04:33:29 pm »

Hi, Samson,
This is the Details in that page
We have identified the following problems with your router:

ROM-0
Severity: High

This vulnerability allows an attacker to easily gain control of the router and therefore your Internet connection. The attacker can use a specially crafted HTTP request to download all important and secret data stored in your router -- your router login/password combination, your Wi-Fi password and your configuration data.

To overcome this vulnerability, aside from applying the firmware update that addresses the issue, there is one more technique that can be used: setting up port forwarding for port 80 on the router to an unused IP address on your network. To do that, enter your router configuration page and find the "Port forwarding" section. Here, set up a rule that tells the router to send all http traffic to an unused local IP address (for example 192.168.0.255, if this address is not used by any other device on the network).
I wish to bring to your notice the ONe more technique, which says change the port settings of 80 to some numbers if this address is not used by any other device on the network. Ok, can i do that in router settings.
Pl clarify, that it is the ultimate control of the service provider or the user. How to know the device used by the said ip address. pl educate

Boggin · « **Reply #18 on:** January 17, 2016, 04:43:13 pm »

I'm not sure about that - you could disconnect the router and wire directly to the modem and see what Avast reports then.

If you log into the router, there may be a manual wireless settings page where you can uncheck the box for Wireless, but your ISP will be better able to advise on this, but you should contact them anyway and report the infection and they may send you out another router with upgraded firmware.

jraju · « **Reply #19 on:** January 17, 2016, 04:47:36 pm »

hi, so you mean the router is nothing but my modem. So it gives the settings inside the modem. Avast report that in his android phone, but of course, in the link Samson gave.
But i have panda antivirus and malware bytes, which i think they never touch router.
Eset online scanner is also not touching the router.

Boggin · « **Reply #20 on:** January 17, 2016, 04:53:44 pm »

Do you have two devices as in http://www.tp-link.com/en/faq-618.html or just the one with a number of LAN ports ?

Samson · « **Reply #21 on:** January 17, 2016, 04:59:52 pm »

If you can access the modem interface via 192.168.1.1 search for admin> firmware upgrade > check for updates

Is you ISP BNSL?

What is the modem model number?

jraju · « **Reply #22 on:** January 17, 2016, 05:02:18 pm »

Hi, Boggins.
I have only one device that is bbwifi modem.
It has DSL,Power, and lan 5nos provision in the back.
It has, powerlight, dsl light, internet light, lanlight and wlanllightWhen i power on with telephone wire in DSL and ethernet cable then i get all the light glows including wlan. I think, i made it clear

jraju · « **Reply #23 on:** January 17, 2016, 05:06:25 pm »

Yes samson. the modem no. is TDSL 300 w2 (type ws),adsl+cpe/wireless router, made by terocom

Samson · « **Reply #24 on:** January 17, 2016, 05:31:06 pm »

So have you tried to update the firmware?

The warning from Avast on your son's android device was not saying that your modem is infected, but highlighting a potential vulnerability, which may or may not have been exploited. I would be very wary aabout using such a device, you said earlier that you have an older non wifi modem that you could use?

I would certainly contact your ISP and politely inform them about the situation and request a safe replacement, either a firmware upgraded or newer model.