Overview:

Home routers are common targets for hackers. A compromised router puts your entire home network, including personal data and connected devices, at risk.  SLU strengthens its cybersecurity by educating remote users on how to secure their home routers. Hackers often exploit weak default settings in ISP-provided routers to launch malware attacks and steal data. To reduce this risk, SLU promotes good cyber hygiene by offering clear guidance, helpful tools, and easy reporting steps, empowering users to protect themselves and the university from router-based threats.

How Can a Hacker Break Into Home Routers?

Hackers often use the following techniques to compromise home routers: 

Major Attacks on Consumer/Home Routers

1. VPNFilter (2018) : Hackers infected over 500,000 routers (Linksys, Netgear, TP-Link) to steal data and permanently disable devices.
2. Mirai Botnet (2016) : Attackers took control of IoT and home routers with weak passwords to launch massive DDoS attacks reaching 1.5 Tbps.
3. AyySSHush Botnet (2025) : Cybercriminals used command injection to open hidden SSH backdoors in ASUS routers, gaining silent remote access. 
4. Cyclops Blink (2022) : Threat actors replaced firmware on ASUS and WatchGuard routers to install malware that could survive reboots and avoid detection.
5. ZuoRAT (2022) : Hackers hijacked small office/home (SOHO) routers (ASUS, Cisco) to spy on users, hijack DNS, and move into internal networks.
6. GhostDNS (2018) : Criminals attacked over 100,000 routers in Brazil, changing DNS settings to redirect users to fake, malicious websites.

Why Home Router Security Matters? 

Home router risks are serious because they can affect both your personal safety and SLU’s systems. Here’s why securing your router is important: 

• Hackers can spy on what you do online, including your personal and school activities. 
• They can redirect you to fake websites to steal your usernames, passwords, or other private info. 
• They can install malware that stays on your network and infects your devices. 
• They can use your router in big attacks like DDoS, slowing down or crashing into other systems. 
• They can reach SLU’s systems through your VPN or cloud access, putting university data at risk. 

How to Know If Your Router Is Hacked? 

• Look for strange behavior – Slower internet, random disconnections, or the router rebooting on its own can cause trouble.  
• Check router login – If we can’t access router settings or if the admin username/password has changed, someone else may have taken control.  
• Watch for weird redirects – If our browser takes us to unfamiliar or fake-looking websites, your DNS settings may have been hijacked.  
• Scan for unknown devices – Log into router (usually at 192.168.0.1 or 192.168.1.1) or your provider app and check for devices we don’t recognize on our network.  
• Use free security tools – Apps like F-Secure Router Checker, Avast Home Network Security, or Trend Micro House Call can help detect hijacks, open ports, or malware. 

How to Keep Yourself and SLU Safe

SLU can stay safe by taking these simple but important steps: 

• Secure Admin Access: Change the default admin username and password to a strong, unique combination to prevent unauthorized logins.
• Keep Firmware Up to Date: Manually check router settings or app to ensure the latest firmware is installed, even if your ISP provides automatic updates.
• Disable Unsafe Remote Features: Turn off features like Remote Management, UPnP, Telnet, and WPS to reduce the risk of external attacks.
• Strengthen Wi-Fi Security: Use WPA2 or WPA3 encryption and set a long, complex password. Enable a guest network for visitors and smart devices.
• Use Trusted DNS and Monitor Devices: Configure secure DNS (e.g., Google or Cloudflare) and regularly review connected devices using router or ISP app to block unknown access.
• Use SLU-Specific VPN Guidance: SLU uses Global Protect VPN and provides setup instructions.
  1. Connecting to Global Protect VPN Before Logging on to Windows Computer 
  2. Remote Access VPN (Global Protect) Request for Students or Contractors.
• Include SLU, in any Incident Reporting: Users should report suspected router compromises to ask.slu.edu or the ITS Help Desk (click here for more info)