Orsdxy

I am buying a "new" router from an open-box sale at a company that liquidates eCommerce returns. Plan to use it for a home network at cottage.

I'm a bit nervous that it could have been modified by whoever had it last.

1. What are the main risks in this scenario?


2. What specific steps should one take before and during setup of a new router that someone else may have had access to in the past?

Short answer: do a factory reset, update the firmware, and you are good to go.

The risk is very low, bordering zero. The previous owner may have installed a custom firmware or changed its configuration, but a firmware upgrade and factory reset is enough to take care of almost every change.

The risk that the previous owner tampered with the router and his changes can survive even a firmware upgrade and factory reset is negligible.

So, don't worry, unless you are a person of special interest: working on top-secret stuff or have privileged financial information on a big enterprise. But as you are buying a used router, I bet you are a common guy and would not be a target for those attacks.

The main risk is that the firmware has been replaced by a malicious version, which could make it possible to intercept all the traffic on your network. Passwords, injecting malware, redirecting you to malicious sites, etc. That's a worst-case scenario but easy for someone to do.

You want to factory reset the device to try to clear out anything that the previous owner may have set up in the factory firmware.

But more importantly, you want to see if the firmware has been changed by looking to see if the case has been opened or tampered with and to see if the operating system of the router has changed. But that might not be enough. It is easy to simulate the OS and website on a router.

Something that you could do is to replace the firmware with one of your own. That should wipe out any malicious firmware on the device. There are open-source after-market firmware you can use.

By far, your main risk in buying an "open box" router is that the router has some subtle damage that the manufacturer didn't detect but that will ultimately reduce the lifespan of the device. That's one reason why they often have reduced warranties.

Security-wise, the risk is negligible if you do a factory reset and re-flash the firmware. That should re-write everything in programmable memory and erase anything malicious that a previous user might have loaded. In fact, this is a best practice even for new routers. I've bought new routers multiple times only to learn that they were still programmed for what was clearly a test network at the factory.

Persistent malware is a real thing, but it's not something to worry too much about. After all, a "brand new" router could have had persistent malware loaded at the factory, so this isn't a risk you can completely mitigate.

Technically there is a risk that the previous owner has installed custom modified firmware with a backdoor.

It is unlikely that the average person has installed custom firmware. Most people don't care about their routers and rarely update them, let alone upgrade them with custom firmware. IF custom firmware was installed it is most likely something benign like DD-WRT, OpenWRT or similar.

And even if they did install custom firmware, it is easily erased with a factory reset or by installing custom firmware of your own. Download the newest firmware package from the manufacturer and flash to the router before plugging the router into either the internet or your local network.

I am splitting this answer because this second case does not apply to the overwhelming majority of people.

Unless you are a UN Peacekeeper, Top Secret Government Agent, Elite Hacker under investigation, CEO of a major corporation, or otherwise have important information or many well funded enemies, stop reading now.

It is technically possible, but incredibly unlikely, that there is a threat on that router that a factory reset/reflash will not remove. This is incredibly unlikely unless you are a high value target. The overwhelming majority of people should not be concerned about this case.

If someone wants to target you, there are many better and cheaper ways to target you than discovering a new vulnerability in that router or building a fake router to trick you.

If you are worried about this incredibly unlikely scenario, then your safest bet is to buy new hardware directly from the factory.