Worst of all is Wi-Fi Protected Setup (WPS), an ease-of-use feature that lets users bypass the network password and connect devices to a Wi-Fi network simply by entering an eight-digit PIN printed on the router itself. Frankly, if you get any response back, I would throw the router out." The WPS threat "Go to /HNAP1/, and, hopefully, you'll get no response back, if that's the only good thing.
"As soon as you get home, this is something you want to do with all your routers," Horowitz told the tech-savvy crowd. ( Linksys quickly issued a firmware patch.) In 2014, a router worm called TheMoon used the HNAP protocol to identify vulnerable Linksys-brand routers to which it could spread itself.
#Medialink router settings full
In and of itself, it's not such a big deal," Horowitz said.īut, he added, "UPnP on the internet is like going in for surgery and having the doctor work on the wrong leg."Īnother problem is the Home Network Administration Protocol (HNAP), a management tool found on some older consumer-grade routers that transmits sensitive information about the router over the Web at IP address]/HNAP1/, and grants full control to remote users who provide administrative usernames and passwords (which many users never change from the factory defaults). "UPnP was designed for LANs, and as such, it has no security. Millions of routers throughout the world, even some of the best ones, have the Universal Plug and Play (UPnP) networking protocol enabled on internet-facing ports, which exposes them to external attack. Some other devices will not accept passwords longer than 16 characters - the minimum length for password safety today.
#Medialink router settings Patch
Many consumer-grade home-gateway devices fail to notify users if and when firmware updates become available, even though those updates are essential to patch security holes, Horowitz noted.
"A compromised router can spy on you," Horowitz said, explaining that a router under an attacker's control can stage a man-in-the-middle attack, alter unencrypted data or send the user to "evil twin" websites masquerading as often-used webmail or online-banking portals.
0 kommentar(er)
