Router Vulnerability Scanning (Shodan, Qualys)

Because the root is the main doorway and gateway into your network both locally and via the internet is a crucial component for maintaining security, privacy and anonymity routers have a very, very tainted history of vulnerabilities and bad default configuration.

They're often plugged in and just left running.

If they become vulnerable, you never find out and nothing is ever done about it.

And they remain vulnerable here.

You see some of the many examples of vulnerable routers and incidents of vulnerable routes.

Let me introduce you to showdown.

If you're not familiar with it, think of showdown as a search engine that searches for vulnerable devices on the internet.

It's the Google of vulnerabilities or the Google of internet of things.

If you like it continually scan the internet.

Looking for vulnerabilities and then adds it to their database to make it searchable.

So let me give you an example here.

So I'm typing in just simply netgear.

Both hackers and security researchers use this to find targets and to protect their own infrastructure.

So this search query here has returned back devices that have responded with the string net gear, net gear being one of the most popular home router manufacturers.

So, what this means is that these are open ports on these net gears.

So if you look here, you can see there's a hundred thousand net gears with port 80, 80 open.

You've got HTTP, you've got FTP.

And this is essentially the response back that they're given.

So it's saying which net gear it is.

And it's saying on authenticated because our username and passwords not being provided, unless there is a very good reason and the device has been hardened, especially for it.

No router should be allowing access to his admin interface to the whole internet light.

The attack surface has to be minimized.

If you need access to your admin interface, you need to at least VPN in to your network in order to access the admin interface or preferably it should only be accessible internally.

So it literally hundreds of thousands of them.

And that's just from one search from one strict.

The sort of strings, you are more likely to put into the search engine.

Here are ones that indicate vulnerabilities so that you can find vulnerable devices.

So I've put in here default password, meaning that these devices are responding where the terms default and password.

And if we look down here, Let's see what we can find.

So this has given us some examples that Cisco might be the default password, but then we've got this particularly interesting one telling us that the default username is admin and the password is 1, 2, 3, 4, and that's on ADSL.

Well, it's not like probably Taiwan.

So that is somebody's home router.

That's probably got the username and password displayed to everyone on the internet.

Well, let's find out.

So there we are. We're on some, Unfortunate persons.

Let me just zoom in.

We're on Unfortunate person's internal home router.

And I don't think I need to tell you what you could do from here.

Obviously we can start trying to compromise the internal devices.

We can start looking at the network traffic.

We can act as a man in the middle and SSL strip is traffic.

I mean, essentially we can own the network and own his device.

And the wifi password, he has actually selected the best and strongest method of encryption.

And let's look at why he actually has this problem.

Why is this accessible?

And that's the reason he's a setup port forwarding or a DMZ, which has enabled access to this device from the internet, which was a mistake.

And there'll be literally hundreds of thousands of vulnerable routers.

This is just a vulnerable router in terms of default username and password, but they'll also be routers of vulnerable in terms of they have vulnerable code.

They haven't been patched and we can even search for those using showdown.

So here I've done a search for net gear and it's linking to the exploit database.

So then we can look on the export database and find exploit code and exploit strings to search for, to find vulnerable routers that we can get potential root access or some sort of access to it.

Using the various vulnerabilities that are out there.

Are you confident that your own router is locked down and secure?

Well, we can find out if you find out your router's external IP address, you can go to.

And go to what's my IP address.

You can see it on Google.

You can also go to here.

What is my IP address.com.

I've shown you this many times and then pop that into showdown and see what you get.

This is an IP address I've just chosen at random because it represents UK BT, local home users.

So it's just an example one.

And as we can see here, this is someone's.

Home router by the look of it now, because IP addresses are generally dynamic.

At least they are in this country or they certainly, I would BT.

Anyway, this means that this IP address has had this port on it.

At some point, it doesn't mean it is vulnerable now, but it does say last update was then.

So this could very well be Available.

And as you can see, it's some sort of web server of some sort. 

And that one doesn't look to be available.

So it may be that whatever the device was, is now changed to a different IP address.

Even if nothing shows upon here for your route is IP address that doesn't really necessarily tell you much.

You can go direct to the source of the information.

If you want to know what services and ports are running on your router, you can go onto the router's web admin interface.

To access your web interface, by the way, I mean, usually it would be at HTTP or HTTPS on whatever the IP addresses that you looked up.

And here's an example, web interface for DD. WRT the root of firmware.

It isn't always easy to see what is running, especially if you've not looked much at your router.

There are lots of tabs and sometimes services could be running, but it doesn't even tell you.

You can check for services.

If there's some sort of services tab to see what services might be running.

If you want to know whether or not there is any network address, translation, port forwarding, and demilitarized zone, then you want to look for those sorts of things.

Port forwarding, port range, forwarding the DMZ, this component to ports being opened up to the internet.

And this will look different depending on what router you have.

Obviously. Check on your route or to see if it has this U P N P, which is the universal plug and play.

This allows port-forwarding to set up automatically.

So you can imagine this may not be a good idea.

You may have some internal device.

If UPNP is set up that communicates with your router.

And opens up a port automatically without your knowledge.

And this also has a history of vendor vulnerabilities as well.

So it's not just opening the ports automatically without your knowledge. It also has vendor vulnerabilities.

So in your interface, make sure that is disabled and set up.

Port-forwarding. Manually yourself, if you want to do port-forwarding.

If you do do any port forwarding, whatever you put forward to most be absolutely secure and hardened because that is an open doorway to your network and to whatever device you are connecting to.

So think long and hard about port-forwarding to any device.

It must be fully secure and harden.

And while you're here, you should check to see whether or not the router is up to date with patches.

You'll have to look around and see whether you can find some option to see whether or not it has been updated.

Other than the web admin interface, you can try to SSH or Telnet to the router using the internal IP address that you got from looking at the default gateway running Mac here, both Mac and Linux come with SSH.

So there we have the default gateway on Linux, as I said, it's route - N to show you the default gateway.

This is a basic SSH command to login.

SSH is the command route is the username at, and then the IP address of the route you're trying to connect to this will connect via the default port 22.

There We are logged in.

On windows, you don't have SSH.

So you can try using a program called putty just download and install it.

It is free that looks like this.

And you simply put in the router IP address in here, click open, and then enter your username and password.

Then went on the route or you can attempt to look at what ports are open

using netstat minus T U L N. Um, here I can see with IPV four got port 80 listening. 53 DNS and 22 wishes, SSH, which we've just connected to. So these are open and listening, but these are more likely to be open and listening for your local network and not your internet, unless the DMZ or port forwarding has been set up on your router.

So we do definitely want to definitively check what ports are open on the internet side of the router, and I'll show you how to do that now I'm going to show you our websites that do port scanning, which probe the router's open ports.

There are 6,535 possible open ports, but these sites will just check well-known or common ports or on some like this one, you can specify a range.

You can have a list.

Well, you can use the common ports, just a word of caution though.

Port scanning could be potentially, maybe illegal to do on devices.

You don't own.

It's a bit of a gray area in the U S under the computer fraud and abuse act of America and the UK computer misuse act of 1990 and others in their respective country.

Although I don't ever believe there has been a conviction.

It's just a bit of a gray area.

So just bear that in mind, but there is no issue of course, port scanning on your own devices.

So this is my IP address here.

And for interest, you can see if it can detect the service version and the operating system.

I'm not going to select that because it will take a little bit longer to do.

And let's start the scan.

So there you go.

You can actually see a number of ports. I'm actually coming from a VPN here.

So it's not unreasonable that there are some ports here.

If this is your home router, it should show as having no ports.

And, but as a demonstration on what would you to see? It's showing some ports.

So here you can see it's discovered these ports here.

This site is actually using a tool called N map, which is available in Kali, which we're going to talk more about later on for good measure.

You can try another site as well as this one, the searches for common ports as well.

So there you go. It shares the same ports.

And for good measure. There's also Steve Gibson's shields up.

So there you go, slightly different results. There.

Another site here you can check.

If your IP is in a database of known of vulnerable devices and routers to simply go down here and click check me. 

Good news. You're all clear.

Now, if you do have ports open or you are getting warnings, then you need to investigate.

I recommend a full vulnerability scan, which does more than port scanning.

It will check to see if the device is also vulnerable to any exploits.

The best vulnerability scanner I can recommend for free is, is free scan, which has an online vulnerability scanner, which you can see here.

You will have to register and go through all that process, which is a little slow, but once you have done, you've got access to actually a very powerful vulnerability scanner free scan is limited to 10 unique security scans of internet accessible assets.

So you should be able to scan your external router.

No problem. It will provide detailed guidance on how to fix any specific vulnerabilities that you might have.

But generally the answer will be to patch the router to make sure the router is up to date and remove any services that are open and are running.

Unless you absolutely need access to them.

And if you do those need to be secure services, I, they have authentication and there's no vulnerabilities in them and they are kept up to date with security patches.