Wireless security should be one of the main concerns for anyone that uses/connects to a wireless network. Besides password cracking, a lot of attacks are concentrated against wireless routers, in order to gain access to the entire network.

 

Today we are going to talk about the Edimax AR-7284WnA router and how to increase it’s security.

One of the weakest points for any kind of security system it’s the authentication method. In this case, the router provides a username/password method. By default, the router comes with 3 accounts: admin, user and support, but only one (admin) can have it’s default password (1234) changed to one of your choosing. The other two accounts have the password set by the manufacturer and it’s not available to regular users. We will show you how to override this flaw and set a password of your choosing for those two accounts (user and support accounts).

The first thing is to backup your router settings and save the configuration file to your hard disk. Then open the file using an editor of your choosing (eq: wordpad) and search for the following text “<X_EDIMAX-COM_Authentication”. You should be able to see a section like this:

<X_EDIMAX-COM_Authentication type=”object” Writable=”0″>

[.....]

<1 type=”object”>

<UserName type=”string” Standard=”0″ Writable=”1″>admin</UserName>

<Password type=”string” Standard=”0″ Writable=”1″>hash_password1</Password>

<Level type=”unsignedInt” Writable=”0″ Standard=”0″>1</Level>

</1>

<2 type=”object”>

<UserName type=”string” Standard=”0″ Writable=”1″>user</UserName>

<Password type=”string” Standard=”0″ Writable=”1″>hash_password2</Password>

<Level type=”unsignedInt” Writable=”0″ Standard=”0″>2</Level>

</2>

<3 type=”object”>

<UserName type=”string” Standard=”0″ Writable=”1″>support</UserName>

<Password type=”string” Standard=”0″ Writable=”1″>hash_password3</Password>

<Level type=”unsignedInt” Writable=”0″ Standard=”0″>3</Level>

</3>

</UserList>

</X_EDIMAX-COM_Authentication>

You need to copy the “hash_password1” and replace “hash_password2” and “hash_password3”. Now the other accounts (user and support) will have the same password as the admin account and no one else will be able to login without your permission by using the default passwords. Also, make sure that you change the default password for the “admin” account from “1234” to something else.

–

Andrei Saygo