Introduction[edit]

Based on the threat posed by a Whonix-Gateway ™ compromise, those who have administrator control over the home network are strongly recommended to lock down the web interface of the home router and apply the strictest settings possible.

The State of Router Insecurity[edit]

Most routers provided by ISPs and those widely available in electronics stores are profoundly insecure, have outdated software and firmware, enable settings by default that open exploit opportunities, and remain vulnerable if appropriate steps are not taken. ^[1]

Many experienced users who are concerned about computing security overlook these problems. Instead, they focus on general operating system and networking solutions, rather than this weak endpoint frequently targeted by attackers (including state-level adversaries). Compromised routers can easily spy on activities, conduct man-in-the-middle attacks, alter unencrypted data, or redirect connections to websites that masquerade as webmail or on-line banking portals. ^[2]

Suitable Hardware and Router Configurations[edit]

Experts routinely advise that low-grade routers should be avoided, since cheap models often come with these limitations:

• Notification failures regarding firmware updates that patch security vulnerabilities.
• Restrictions on password length for administrator access.
• The less-secure, combined modem/router devices are common.

As a sensible investment in security, give consideration to purchasing a commercial-grade router that is normally intended for small businesses. It is also safer to have a personally owned routing device that connects to an ISP-provided modem/router because this maximizes administrative control over routing and wireless features of the home network.

Before the final purchase, check the router has firewall capabilities and that it supports Network Address Translation (NAT), so internal systems cannot be directly accessed from the Internet. Also check whether the router can be configured off-line, which is an advantage. Disconnect or turn-off routers/modems when they are not in use. ^{[2] [3]}

Accessing Router Settings[edit]

To access and change router settings, the router's IP address must be typed into the web browser address bar. Next, enter the administrative login and password when prompted. If the default login credentials are unknown, check the following list ^[archive] and search by manufacturer and model.

Routers usually have a common address like: 192.168.1.1, but there are many variations depending on the make and model. Check the router manual to determine the correct address or alternatively research the manufacturer's website to discover it. ^[4] If it is still not possible to identify the relevant router address for access, terminal commands can be used to trace the IP route or various networking tools can be accessed to discover it.

Linux[edit]

On Linux operating systems, run the following command in a terminal. In Qubes-Whonix ™, this command is run in the NetVM terminal.

ip route

The output starting with "default via XXX.XXX.XXX.XXX" is the relevant router IP address for changing settings.

Another alternative is to utilize the network icon, which is available on most Linux desktops: Right-click the network icon → Select "Connection Information" or similar.

The IP address displayed next to "Default Route" or "Gateway" is the relevant address required. ^[5]

macOS[edit]

In a terminal, run. ^[6]

ifconfig

This command will show all the interfaces and their respective IP and MAC addresses.

Alternatively, look for the relevant network settings under: System Preferences → Network → TCP/IP (hardwired) or Wi-Fi (wireless) section. ^[7]

Windows[edit]

To find the router IP address in Windows, open a command prompt: Start → Search box → Type cmd

In the terminal, run.

ipconfig

The output should reveal the relevant IP address next to the "Default Gateway."

Alternatively, look for the relevant network settings under: Control Panel → Network and Internet → View network status and tasks → Left-click on the appropriate connection → Left-click on "Details".

The router's IP address is to the right of the IPv4 Default Gateway.

Recommended Router Settings[edit]

General Router Settings[edit]

The following settings are recommended to lock down the router.

Table: Router Access, Configuration, Management and Service Recommendations ^{[1] [2] [8]}

Wireless Network Router Settings[edit]

Wi-Fi Warning[edit]

Contemporary research has discovered a number of faults with the WPA2 and WPA3 security protocols. For instance:

• This 2016 paper ^[archive] found faults with WPA2 encryption due to flawed 802.11 random number generation (generating insufficient entropy), downgrade attacks on group keys transmitted in the 4-way handshake (forcing usage of RC4 encryption), decryption of the 128-bit group key, and injection of group traffic into unicast traffic. This meant unicast wifi traffic could be decrypted. ^[10]
• The KRACK attack ^[archive] family of vulnerabilities demonstrated a fatal flaw in the way WPA2 handshakes were negotiated allowing an attacker to decrypt (but not modify) data on the Wi-Fi LAN. The efficacy of the fixes are platform dependent and were mitigated provided that the devices received updates after it was announced. Suggestions have been made to the Wi-Fi Alliance standard body to guard against it in the future.
• In 2019, five vulnerabilities were announced in the Wi-Fi WPA3 standard ^[archive] as well by the same researchers behind the KRACK attacks; two downgrade attacks, two-side channel information leaks and one denial of service attack. Consequently, adversaries in range of the user's network can discover the Wi-Fi passphrase for infiltration purposes. These attacks also work against the Extensible Authentication Protocol that is supported in the previous WPA / WPA2 Wi-Fi authentication standard. ^{[11] [12]}
• In 2021 a devastating flaw was discovered in the WiFi standard impacting all devices on the market that implement WEP through WPA3. FragAttacks (fragmentation and aggregation attacks):

  ...encompasses plaintext injection vulnerabilities, the frame aggregation feature of WiFi potentially leading to an aggregation attack, the frame fragmentation feature of WiFi leading to a possible mixed key attack, and the WiFi frame fragmentation feature being exploited for a possible fragment cache attack. A dozen CVEs in total were issued for this FragAttacks research.

  ^{[13] [14] [15]} Fortunately it is difficult for attackers to abuse these faults because it requires either user interaction or the use of uncommon network settings.

Although various countermeasures are reported and software is available which corrects these problems, they also require firmware updates from Wi-Fi product vendors. These may be rare or impossible depending on the product in question. The researchers still view WPA3 as an improvement over WPA2, but criticize the opaqueness of the standardizing bodies in making flawed decisions that have been considered beforehand.

Recommendations[edit]

Table: Wi-Fi Configuration, Services and Protocol Recommendations ^{[2] [4] [8]}

Router Firmware[edit]

Strong consideration should be given to flashing the wired/wireless router with an open-source GNU/Linux distribution. Solutions such as OpenWrt ^[archive] and DD-WRT ^[archive] provide firmware that is suitable for a large variety of wired and wireless routers and embedded systems.

The strengths of this approach are openness, regularly updated firmware images, greater functionality (fully-featured options), less bloat and more control over router behavior. The downside is that open-source firmware is not free of bugs; careful research is required before attempting this procedure. Check the online guides for instructions on how to proceed and whether the home router is compatible with the available firmware.

References[edit]

	100px
Fosshost	About Advertisements

Search engines: YaCy | Qwant | ecosia | MetaGer | peekier | Whonix ™ Wiki

Follow:

Support:

Donate:

Priority Support | Investors | Professional Support

Whonix ™ | © ENCRYPTED SUPPORT LP | Freedom Software / Open Source (Why?)

The personal opinions of moderators or contributors to the Whonix ™ project do not represent the project as a whole.