Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got a DD-WRT router that is running a very old build. Due to a few exploits over the past couple of years, I'm concerned about the integrity of the device. Before I flash to a newer version of the firmware, how would I go about checking if the router's existing OS has been compromised?

share|improve this question
Personally, I'd back up the config and flash the firmware anyway. You've got so many possible places to look that it would become onorous. – user3463 Jan 29 '11 at 1:47

There's no one size fits all way to check for compromises, since by nature a compromise looks legitimate to the router.

Your best bets are to check traffic logs trying to access the web interface, SSH port or Telnet. Even if they didn't exploit that specific mechanism, it might give you some identification for a machine that is trying to compromise your router, which you can then narrow down.

If you're concerned about any potential compromise continuing, make sure you take your router off the network before flashing, and then make sure to purge NVRAM (if the device uses it) and use new login credentials/authentication for the router in future, preferably secure ones.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .