How would I know if my ADSL modem/router (HG532c Echolife) has been hacked?
You can download - if it is possible - configuration and/or firmware and binary compare them to original/previous copies. You can also load original firmware and reconfigure modem(1)(2). Unfortunately it can be hacked to serve original configuration/firmware or not load uploaded ones. Of course also original firmware can have backdors ;) So for peace of you mind you shouldn’t concern this much and make any actions only if you have justified suspicions.
- Uploading firmware may brick you modem!
- It is the most certain way to go.
I have heard that it might be more secure to set the modem to bridge-only mode and use a separate router, but that still leaves the modem open to attack/capture and I still cannot tell if it has been.
Is using bridge mode more secure? If so, how would I configure that?
IMO there are more critical actions:
- Change password from default to adequately complicated one.
- Disable access to your modem administration interfaces (WWW, telnet, ...) from WAN side.
- Secure your Wi-Fi properly.
- Use hardware with good vendor support (firmware updates, long lifespan). Unfortunately I don't know vendors that fulfil that requirements for home use, so I privately trying to use hardware with open source support.
If you set-up your modem/router to bridge mode you have to have another router to make NAT on it. As this additional router will be next layer in your network architecture and potentially will be more secure than you modem/router - than yes it should be more secure.
After quick look to your modem manual...
You have got two options:
- Accessing the Network Through the Embedded PPP Dial-Up Software on the
HG532c
- Accessing the Network Through the PPP Dial-Up Software on Your Computer - this one is a bridge mode.
Personally I will stick to Embedded PPP Dial-Up with good password, admin interfaces inaccessible from WAN and secure Wi-Fi configuration. You can additionally consider to power-on modem only if needed.
"disabling from the WAN side" - I tried Shields Up from GRC.com and it shows all ports in "stealth" mode. Is that what you mean or is there something else. As an additional router, I have an Apple Time Capsule which can do NAT. I don't know how to change the HG532c to bridge mode though.... – William Morris – 2015-11-15T01:07:36.253
I mean disabling access to modem admin interface from WAN. After quick look into your modem manual - it suggests that admin interface is only accessible from LAN, but I suggest you to check it anyway. I can't tell if Apple Time Capsule will be more or less secure. I will edit and extend my answer for a few moments. – g2mk – 2015-11-15T12:03:03.067
Thanks, good advice. I looked at OpenWRT, Tomato etc but I don't have a suitable router and I decided I didn't know enough about it and lost interest. But I still have lingering doubts about my modem, partly just prejudice because it is Chinese. I turn it off whenever not using it so it might be an unrewarding target for attack. – William Morris – 2015-11-15T23:57:48.973