Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've got a DD-WRT router that is running a very old build. Due to a few exploits over the past couple of years, I'm concerned about the integrity of the device. Before I flash to a newer version of the firmware, how would I go about checking if the router's existing OS has been compromised?

share|improve this question
2  
Personally, I'd back up the config and flash the firmware anyway. You've got so many possible places to look that it would become onorous. –  user3463 Jan 29 '11 at 1:47

1 Answer 1

There's no one size fits all way to check for compromises, since by nature a compromise looks legitimate to the router.

Your best bets are to check traffic logs trying to access the web interface, SSH port or Telnet. Even if they didn't exploit that specific mechanism, it might give you some identification for a machine that is trying to compromise your router, which you can then narrow down.

If you're concerned about any potential compromise continuing, make sure you take your router off the network before flashing, and then make sure to purge NVRAM (if the device uses it) and use new login credentials/authentication for the router in future, preferably secure ones.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.