How long has it been since you changed the router management password? I did a password physical examination for the backend, and two of the five checkpoints were compromised.

Last month, I helped my cousin check her home network and clicked on it. 192.168.1.1 I want to go into the background and change the channel. She casually gave her password: The last six digits of her broadband account number. Once I lost, I entered. Asked again, this password was set by the broadband installer three years ago, and the password for her WiFi was also the same string of numbers. It has not been replaced once in three years.

When I got home, I took a look at the backstage of my house. Although it was not as exaggerated as hers, I also discovered one thing.: My management password was created the year I set my WiFi password, and it is only two characters different from the WiFi password. It's like a thief can open the second lock if he finds a key and rubs it twice with a file. That night, I did a thorough password checkup on my family's router. I went through the five checkpoints one by one, and wrote down my ideas and corrections in this article. In just ten minutes, you can change your door lock to a real lock.

Think about one thing first: Who will try your backend password?

When it comes to password security, many people's first reaction is "I'm not a person, who can hack me when I'm free?" This is half true. It's true that no one is specifically watching you, but attacks don't require special attention for a long time.

There is a type of thing called a scanner running on the Internet, which knocks on the entire network section by section around the clock to see which IP has a router login page hanging on which port. If you find it, try it with a dictionary: admin, 123456, admin123, root, your eight-digit pure number. A machine can test tens of thousands of doors in one night. You may not necessarily do anything immediately after you try it out. You can write it down first and use it later in batches. You don't have to be a person, you just need to be a household in the "row with unlocked doors".

When I wrote about remote web management before, I mentioned the example of my colleague Lao Ji ( Do you need to enable remote web management of the router? ): He opened a Web remote management, and checked the records when he came back one week later. He found page after page of login failures, and the source IP addresses were all from overseas. Those attempts were done by the scanner, and no one knew him. There is one detail in Lao Ji’s incident that I have always remembered: The accounts tried are all admin. In other words, what stopped him was not how strong the password was, but the fact that the account happened to be not admin. Luck doesn't count as defense.

There is a closer way: Someone who has access to your router. The master who installed broadband, the relative who came to stay for a week, the neighbor kid who connected to your home's WiFi. In the eyes of people who know a little bit, your string of numeric passwords is no different from sticking it on the door. Don't overestimate the kindness of strangers, and don't underestimate the curiosity of acquaintances.

Five checkpoints, two of my family were caught

The physical examination does not require any tools, just ask yourself five questions one by one. I wrote my own results behind each item for your reference.

Among the three that were tricked (counting half), the most dangerous one was "only two characters different from the WiFi password." Because the WiFi password is known to everyone in the family, once the management password is related to it, it is equivalent to hanging the entry key next to the Internet key. The second most terrible thing is the 9-digit pure number plus the year - the dictionary attack can run this combination several minutes faster.

By the way, let me tell you a premise. Many people get stuck at this step and cannot move.: The management password and the WiFi password are two things, one goes into the background and the other goes into the wireless connection. If you still can’t tell the difference, go and see it first How to change the router password In that article, the respective entrances for the three passwords (management, WiFi, and broadband) were separated. Come back for a physical examination after you have made the distinction, otherwise you won't even know which lock you are checking.

To judge password strength, no software is needed, just use your brain

There are websites on the Internet that test password strength, but I don’t recommend that you enter your real password—don’t take your house key to someone else’s house to test. You can judge by yourself at home, just look at three things: Length, character type, source.

Length is a hard indicator. Those below 8 are basically running naked now, and 12 is the passing line. With each additional digit, the space for violent attempts increases exponentially. There are 10 billion combinations of 10 pure numbers. It sounds like a lot, but it takes an hour for the script. ； 12-digit mixed case plus numbers, dictionary + violence must be calculated in years. You don't need to remember the number of bits, just remember "more than 12 digits".

The character type determines whether the dictionary can run freely or not. Pure numbers are the weakest, followed by pure lowercase letters, mixed with uppercase and lowercase letters and numbers, and the common lexicon in the dictionary is basically incompatible. My method is crude but effective: Take a sentence that only I know, such as a bowl of noodles that I had in a certain place in a certain year and month, take the first letter of each word in pinyin, and put the year of that year in the middle. The generated stuff looks like gibberish, but I can push it all the way back in my mind and never forget it.

The source is the final cut. As long as this string of characters has any public connection with "you" - birthday, mobile phone number, house number, initials, WiFi password variations - the strength is directly discounted. Because the dictionary for password testing has long been more than just general words. Account and password tables derived from database stuffing are the main force. Whatever you have leaked on other platforms, others will try it first.

Check the log to see if anyone has knocked on the door

After the physical examination is done statically, there is still a dynamic action worth adding.: Go to the background and check the system log to see if there is any record of login failure. This step was done easily after I finished the above five steps. I was a little scared after doing it.

The entrance is different for each company. TP-Link is in device management or application management, Mercury Tenda is in system tools, and Asus is in the system log page. The specific location of each company and what words in the log are worthy of attention. I compiled a version of it when I wrote the article about disconnecting the Internet to solve the case ( 192.168.1.1 How to view router operation logs ), just look for it. There is only one word you want to search for this time: fail.

The result of digging it up at home: There were a total of seven failed logins, spread over two nights. Those were the two times I entered the wrong password with my hand and the few times the browser automatically filled in the old password. That's right, false alarm. The only way to judge is this - whether the number and time of failures match up with the actual input errors of family members. That's right, he's one of our own ； If it doesn't work, for example, if you haven't failed at all, but there are a series of failures in the log, that means someone is interviewing outside. If you encounter the latter, don't research who it is, just change the password. After changing it, take a look to see if the remote management switch is turned off. Other signs of being compromised - pop-up ads, abnormal traffic in the middle of the night, etc. What are the signs that your router has been hacked? There is a complete self-check list in that article, so you can go through both articles together.

I have to tell you some bad news in advance: Only the most recent hundreds to thousands of logs are saved, and they are cleared when the power is turned off. If you have never looked through it, you may not be able to find anything. This is normal. Just pay attention to it from today on. Don’t expect it to be used as a historical account book.

Make changes: Ten minutes, three routes to choose from

After the physical examination, it’s time to take action. Changing the administrative password is not difficult in itself. The difficult thing is not to lock yourself out after changing it. I'll go through the process and give you the order.

The first step is to think about and write down the new password before taking action. Don't wait until you enter the page to change the password in the background to think about it. It would be embarrassing if the power was cut off halfway and the old one was invalid and the new one was not set. The new password should be formed as above, with more than 12 digits and zero overlap with the WiFi password. You choose where to store it: Mobile phone memo, password manager, write it on a piece of paper and stick it under the router. This note may seem silly, but for the door in your home, the key attached next to the lock is not a leak - outsiders cannot touch your weak current box.

The second step is to make changes in the background. The entrance is in "System Settings" or "Administration Settings" and has various names. Look for the ones with the words "Administration Password" and "Login Password". Mobile phones can also be modified, but the background of mobile phones is a castrated version. Some people cannot find this entrance. It is recommended to open a computer to modify. Specific paths for each company, How to change router management password In that article, both methods for mobile phones and computers are mentioned, just follow the instructions.

The third step is, don’t rush to close the page after making changes. Do three things first. This is a pitfall I have stepped on.: First, the apps tied to the phone (Mijia, TP-LINK, etc.) will be disconnected. Please log in again and use a new password. ； Second, the old password saved in the computer browser will automatically fill in the wrong password. Don’t panic if you can’t log in for the first time. It’s not that you’re locked, but the browser is filling in the old password. Manually clear it and re-enter it, and update the password saved in the browser. ； Third, if you have saved a background password on a relative's mobile phone before, think about who else has the old key and notify them, or don't notify them at all - the old password is no longer valid anyway.

Just tell me the frequency of changes and leave.: There is no need to change it every day, just change it once a year, plus "change it at any time if there are any suspicious signs", that's enough. More important than frequency is strength. A 12-digit mixed password that is not changed for three years is more secure than an 8-digit pure number that is changed every month. Don't think of "frequent changes" as diligence, intensity is the capital.

After the modification, I added two locks

The password is the main lock, with two auxiliary locks, and the level of protection is completely different. It's all a matter of a few clicks in the background.

The first step is to confirm that remote web management is turned off. Once this switch is turned on, your backend will be connected to a port on the public network (commonly 8080), and scanners from all over the world can knock on the door. It is not the same thing as remote management via mobile app - the app uses the outbound channel of the router to actively connect to the cloud, and the door is closed. ； Web remote is inbound, which is equivalent to opening a window to the whole world. The vast majority of households do not have access to Web remote management, and turning it off will not affect your use of apps to manage your home from outside. I have discussed the difference between the two things in the remote management article, so I won’t repeat it here.

The second step is to turn off WPS. For the one-click connection function of WPS, the PIN code is an 8-digit pure number, and the verification method of the old firmware has loopholes, so it can be tried out in a few minutes. If no one at home uses one-click connection, turning this function on is purely a backdoor. Where to shut it down and why it was shut down on the same day? When I wrote the WPS article, I went through my own experience ( What does router WPS mean? ), after reading it you will be as quick as me.

ending: One form to collect the whole family process

The whole family process took less than twenty minutes to complete. That time at my cousin's house, after I changed her password and turned off the switch, she asked me if I could also change the WiFi password. I told them not to do anything today, but to fix things one at a time. If something went wrong, I would know where it was. The next day, her TV box couldn't connect to the Internet, so she came over and asked me. I said, look, this is why only one variable is changed at a time - here are the ideas for troubleshooting the aftermath of changing the password. After changing the WiFi password, the connection at home dropped. In that article, you won’t be able to read it until that day.

Let me finish by telling the truth.: A router will protect all your family's traffic from the day you buy it. The management code is the only door, and nine out of ten doors have not had their locks changed since the day they were installed. If you spend twenty minutes changing it, it will be worth it no matter how you calculate it.