Does Security Software Protect Your Router?

Which Security Suites Protect Routers?

As usual, we'll start with some terms and definitions. A firewall protects your computer and other connected devices from both inbound and outbound attacks. Your router acts as a firewall, protecting you from attacks from the outside (the Internet). We call this a "hardware firewall." If everything is working as it should, your router's hardware firewall effectively makes all your computers and other connected devices invisible to the outside world.

A software firewall resides on and protects a specific computer from attacks originating from the inside -- such as malware on your computer, or other devices on your home network. We'll focus first on software firewalls, and then discuss some alternatives to your router's hardware firewall.

Let's start with the built-in security tools that Windows provides. In Windows 10, Microsoft confuses users by lumping all of its security features under the label “Windows Defender Security Center.” Windows Defender does not defend routers; it is merely a signature-based antivirus detect-and-kill program.

However, Windows Firewall prevents outbound connections to the router from programs that are not authorized to do so. Windows Firewall settings are found in the Windows Defender Security Center. On a Windows 7 computer, look for "System and Security" in the Control Panel, and you'll see the Firewall settings there.

The Windows firewall can be turned on or off from its Settings panel. It should always be ON, unless you have installed another anti-malware tool that provides firewall protection.

Avast Free Antivirus does not include firewall protection. But Avast Premium and Avast Internet Security do. The firewall is enabled by default so there is nothing you need to do if you have either of these products. Your router and all other devices on your home network are protected against unauthorized connections.

AVG Antivirus, which is owned by Avast, does not have router protection in the free version. Firewall protection is available from AVG only in the AVG Internet Security suite. ($69.99/year).

Avira Free Antivirus includes firewall protection. BitDefender Total Security 2018 includes a firewall; after a 30-day free trial, one year of protection costs $44.99. MalwareBytes AntiMalware Premium has a firewall; after 14 days, it costs $39.99/year.

Insider Attack Protection

A firewall does not protect your router against attacks launched from devices inside the network. One of the most common attacks employed by hackers is called “cross-site request forgery” (CSRF), and a firewall will not stop it. Here is how a CSRF attack works: Your browser fetches a page from a web site and displays the things the page’s HTML describes, because that’s what browsers do. But embedded in that page is some Javascript code that attempts to access your router’s administrator console; that Javascript does not display anything onscreen so you have no clue what it’s doing.

Because this Javascript is inside your network, running in a browser on one of your devices, a firewall does nothing to block the malicious Javascript’s connection to the router’s administrative console. The Javascript then tries one or more default username/password combinations in hope of gaining access to the router’s settings.

If it is successful, the malicious Javascript goes on to change your router’s settings in ways that make it easy to compromise other devices on the network. Usually, it will turn off your firewall, allowing outside connections to be made to your router and other devices. It’s as if a small burglar slipped into your home inside an Amazon delivery box and opened the front door to let the whole gang of thieves ransack your home.

Thwarting a CSRF attack is one reason to configure your router so that its administrative console can be accessed only via a hardwired Ethernet connection. Javascript cannot fake a physical cable.

Avast Home Network Security has protected routers against CSRF attacks since June, 2016. The Home Network Security features are implemented through Avast’s WebShield module which is enabled in all versions of Avast security software, including Avast Free Antivirus.

Some Hardware Firewall Options

Avira SafeThings is a security program that is installed on a router, either at the factory or by the consumer. SafeThings discovers all devices on a network – including the router that manages it – and learns the normal behavioral patterns of each device. SafeThings blocks unusual behavior that may indicate a device has been compromised. It’s an interesting approach to Internet of Things security.

The second-generation Bitdefender Box is a router designed to be secure. Or it’s a security appliance that can function as a router if need be. The Box can plug into an Ethernet port on an existing router to scan all inbound/outbound traffic, and protect network devices (including the router) with Bitdefender’s multilayer security. If you own a high-performance router, this is the way to go. If you use a gateway device provided by your ISP, you can configure it to act as a modem only, and use the Box in “router mode.”

It’s important to guard your router against attacks, now more than ever. As the Internet of Things grows, the value of home networks to bad guys will also grow. Even if you don’t have any smart home appliances, your home network will still be targeted more and more by sophisticated malware seeking such things. A firewall that looks for attackers only “out there” is not enough; you also need security software that looks for attacks on your router that originate from other machines on your home network.

Your thoughts on this topic are welcome. Post your comment or question below...