Security → Is This Wifi Hack Possible?

Hi,

A Friend of Mine told me if someone obtains your IP address, he can install a program onto your wireless router to sniff your URL visits? He can do this from the internet. Is this right?

I have set my wifi router to reject adminstration access from the internet or wireless connections, Only from wired connections. I am using wddrt router software on a linksys wireless N.

Anonyposter

Some people are careless, and leave the router with the factory password. For many routers, this password is well known. There are tricks to redirect your browser and have your browser change the router settings.

If you use a good password for your router, and after accessing the router you clear your browser session (or restart the browser) so there is no memory of the password, you should be safe.

This is actually also dependent on the security of the firmware code on the router as well. At Defcon this year, there was a talk where the presenter demonstrated how XSS and CRSF "conveniently reset" the admin password to the router on older firmware versions of a certain brand of routers.

There are a lot of variables at play when discussing access of protected systems and manipulating them to gain malicious advantage. Usually it requires a little more than just knowing an address, but that's usually the starting point.

What build of DD-WRT are you using (build number)? Builds prior to 12533 have a known XSS exploit.

said by AnonyPoster :

---

I have set my wifi router to reject adminstration access from the internet or wireless connections, Only from wired connections

---

....good. Disabling Internet side admin access, disabling WiFi admin access, having WPA/WPA2 wireless encryption and good password to access router will (should) keep you safe from know today's attacks.

Well, I do not want to say anything is impossible, but from the info provided I there is no way somebody could log your web visits.

They would have to

A: have physical access to the router

B: have time to hard reset the router ( or if your ultra paranoid you could disable that - then they would have "brick" the router then unbrick then flash )

C: have absolutely no life whatsoever and wish to waste said life
by reading someone's router logs.