Definition

A router is a device that connects our home to the internet and often provides a Wi-Fi network. Many people have a router at home, yet few know exactly what tasks it actually performs. For many who do not come from the IT field, it may be surprising that the router has many more functions than just establishing a connection to the internet.

The router serves as a central interface between the home network and the internet. It acts as a mediator between different networks and is primarily responsible for forwarding data packets selectively, whether to the internet or within the internal network. Providing a Wi-Fi network is merely an additional function that enables devices to connect wirelessly to the network.

Example

Let's take an example: You are at home and connect to the Wi-Fi on your phone. With this step, you have created the opportunity to communicate with others via your phone.
Now other family members connect to the same Wi-Fi. Thus, the entire family is in the same network, which is also referred to as the internal network.

If you want to send a message to your family members via your phone, the message is sent to your router, and the router forwards it to the recipients. The sending process is exactly the same when you want to communicate with people outside your network.

Attack Scenarios

Now that we have dealt with what routers are and how they work, we will now discuss the various ways criminals can attack routers from the outside.

The configuration of a router is quite simple via a web interface. You just need to enter the login credentials and can make any desired settings.

When the router is new, a default username and password are stored for the first login. These login credentials should be changed immediately. Unfortunately, very few do this.
And here lies a major weakness: If an attacker knows these default login credentials, e.g., because he has spied them out through spyware, he can log into your router and change settings.
Another attack point is the firmware built into the router. It may contain vulnerabilities that can be exploited by an attacker. This way, he can gain access to your router and, for example, monitor your network traffic.

Another attack scenario is a DoS attack. In this case, the router is flooded with vast amounts of requests. The goal is to reduce the router's performance so much that it can only respond very slowly to other requests, or not at all – or, in the worst case, it crashes.

A variation of the DoS attack is the DDoS attack. Here, the requests are not sent from just one computer, but from a multitude of computers. A botnet can also be used for a DDoS attack. For more information on botnets, please read the article “Malware: What is it?”.

Recommendations for Protecting Your Router

Finally, here are some recommendations on how you can protect your router:
As described in the attacks above, the default login credentials should be changed. Additionally, a strong password that is not easy to guess should be used.

The Wi-Fi name should also not contain any information about the device because such information can be used to carry out targeted attacks on the router.

Another recommendation is to set up a guest Wi-Fi. This way, visitors have their own network area and cannot access resources in the other network area. For example, this prevents a guest from infecting the main network with malware, only the guest network.