MacDirectory Magazine

116 MacDirectory FEATURE three involved cracking these hashed passwords, thus gaining the ability to log in to these computer networks remotely. Finally, stage four: use these hacked credentials to take over the router altogether. They would then map out the internal network available to the device, modify its firmware to give them broader control and execute man- in-the-middle attacks by redirecting a user's requests through servers controlled by the hackers. Ultimately, these "pwned" routers would then serve as a launchpad for future attacks. Through control of these routers, hackers had a clear view of all the traffic passing through them. In other words, if the bad guys could break into a corporate network and take over one of the main routers, they could see all its traffic, both internal and external. This allowed them to harvest website login credentials, intellectual property, and reams of other sensitive internal data. Yet, despite the complexity of this undertaking, the hackers didn't have to come up with anything new to do it; they used no new exploits or zero- day vulnerabilities to carry out these attacks. Instead, all they had to do was use known vulnerabilities in existing routers, relying on the fact that many people rarely think to upgrade or update the firmware on this hardware. In fact, some older routers can't even receive patches these days, either because the company that made it has gone out of business or because it's just too old. So, was this a targeted attack? In some sense, yes — it looks like the hackers were primarily trying to find intellectual property to steal, alongside other high-value data. However, they hit everyone from big corporations to home offices. It's possible that they struck so many targets to hide their true purpose, or it could be that they only looked for any opportunity and ran with it to see how far they could go. In either case, this was a significant event. So how can you keep yourself safe? What can you do to protect your system? The answer to that question is: it depends, mostly on where your router came from initially and how old it is now. Did your router come from your ISP? These are usually modem/router combination units, and you don't often have much choice in which model you'll receive. These come standard and often feature relatively "locked down" firmware that limits what you can do to change it. However, some ISPs allow you to "bring your own," in which case you can purchase a third-party combo unit instead of paying to rent the hardware. In this case, your options for good security practices are a little more open. Of course, there are some instances when you might not be able to access your router at all, such as if you live in a place that provides building-wide Wi-Fi. This is particularly common in college dorms and some apartment complexes. If you're dealing with an ISP- provided router or building- wide Wi-Fi, you're at the mercy of the ISP and/or the building operator. In these cases, it's up to your ISP itself to make sure that the router stays patched and up to date. The good news is that most major ISPs are very good about staying up to date on this, and there's nothing you have to do to make sure that your router has its updates applied. Because the modem from your ISP should be capable of receiving automatic updates, it will patch itself whenever the ISP sends out the data. However, if your current model is very old, that may not be the case; more on that in a moment. If you "brought your own" router to the game, then you'll need to log in to the router itself and manually install firmware updates. Typically, one would do this by simply opening up your browser and typing the router's IP address on your network into the URL bar. There is often a sticker on your modem or router that shows its default IP address and usually the default password you'll need to log in as well. If you've never touched these settings before, chances are good the defaults are still in place. Don't see a sticker and still don't know how to access your router? It's not too difficult to find out, especially if you connect over Wi-Fi. If you're on your Mac, all you need to do is hold down the option key and click the Airport menu bar icon that pops up in the resulting menu. In the information, the resulting pane will show you, you can see the router address clearly displayed in the data. Take that number and plug it in to your browser to begin the login process. If you instead use a wired Ethernet connection to get your Mac online, finding the address takes a few more steps, but it is still relatively easy. Follow this quick checklist: 1.Click on the Apple menu, available in the upper left- hand corner of your screen 2. Select "System Preferences" 3. Now click on "Network," being sure to the select the active connection that you use to browse the Internet 4. On the resulting pane, click the "Advanced" button 5. Now select the "TCP/IP" tab, and you will be able to see the IP for your router. If you're on iOS and want to check on things with your router from a mobile device or an iPad, tap settings, then tap Wi-Fi. Select the info button (a small circle containing a lowercase "i") next to the network you're connected to, and the next page of information will provide the IP address. Once you've logged in, you should be able to apply any updates, if available. Most modern routers will display an alert when its firmware is out of date or when you can download an update. A word of warning, though: upgrading firmware can be tricky, and if you don't do things properly, it can "brick" your device, rendering it completely useless. Meaning that if you do choose to update it yourself, you should

• 1
• 2-138