Router DNS hijacking

Your router tells every device on the network which DNS servers to use. Change that one setting and every device follows, without any of them being touched, and with nothing on any device indicating that anything changed.

That makes the router a high-value target and an under-examined one, since most people configure it once and never look again.

How routers get hijacked

Default credentials. Many routers ship with a known administrator password and many are never changed. Where the management interface is reachable from the internet, this is the entire attack.

Unpatched firmware. Consumer routers receive few updates and are replaced rarely, so known vulnerabilities remain exploitable for years.

Cross-site request forgery. A malicious page in your browser submits a request to your router's interface, from inside your network, using whatever session your browser has. Modern routers defend against this; older ones do not.

Malware on a device, which then reconfigures the router from inside.

What the attacker gains

Every DNS lookup in the household, which is a complete list of the sites everyone visits.

The ability to answer any lookup with an address of their choosing, which is the foundation for a convincing fake site — though TLS certificates make actually impersonating a site hard, and a browser will warn.

The ability to block, which is used in some campaigns to prevent devices reaching security update servers.

Checking yours

Look at the router's DNS settings. Log in to the admin interface and check the WAN or internet DNS entries. They should be your ISP's or a resolver you deliberately chose. Anything unfamiliar is worth investigating.

Run the DNS leak test from a device on the network with no VPN running. It reports which resolvers actually answered. An operator you do not recognise is the finding.

Check the admin password has been changed from the default, and that remote management is disabled.

Check for firmware updates, and note when the model last received one. A router with no updates in three years is a liability regardless of whether it has been compromised.

Hardening

• Change the admin password to something unique.
• Disable remote management and UPnP unless you specifically need them.
• Update firmware, and replace routers that no longer receive updates.
• Set DNS explicitly to a resolver you chose, so an unexpected change is visible.
• Use a separate network for smart-home devices if the router supports it.

What a VPN does about it

A tunnel with its own resolver bypasses the router's DNS entirely: lookups go through the tunnel and are answered by the resolver the tunnel configures, so a hijacked router setting has nothing to act on for that device.

That protects the devices running the tunnel. It does nothing for the ones that are not, which in most households is most of them — the television, the thermostat, the speaker, the printer.

A tunnel on the router itself covers everything, at the cost of the throughput ceiling that router hardware imposes. The router guide covers the trade.

Encrypted DNS as the cheaper answer

Setting DNS over HTTPS or DNS over TLS on a device means its lookups go to a resolver of its own choosing, over an encrypted channel, ignoring whatever the router said. That neutralises router DNS hijacking for that device, free, in about two minutes.

It is the highest-value thing most people can do about this specific attack, and it is worth doing on every device that supports it whether or not you also run a tunnel.

What it looks like when it happens

Rarely dramatic. The most common symptom is nothing at all, because a surveillance-oriented hijack is designed to be invisible and simply forwards every query after recording it.

Where there is a symptom it tends to be one of these: certificate warnings on sites that normally work, advertising appearing in unexpected places or replaced with different advertising, or specific sites — often security vendors and update servers — becoming unreachable while everything else is fine.

That last pattern is the most diagnostic. A network where updates fail and nothing else does is worth investigating at the router.

Why it is harder than it used to be

Two changes have narrowed what a hijacker can do with the position.

Widespread HTTPS means answering a lookup with the wrong address usually produces a browser warning rather than a working fake site, because the attacker cannot present a valid certificate. HSTS makes many of those warnings unskippable.

And devices increasingly resolve names themselves over encrypted channels, ignoring the router entirely.

The remaining value to an attacker is therefore mostly observation and blocking rather than impersonation — which is still worth defending against, and is a smaller prize than it was a decade ago.

If you find one

Change the DNS settings back, change the admin password, update the firmware, and reboot. Then check whether remote management was enabled, because that is usually how it happened.

If the router is old enough that no firmware update exists, replacing it is the proportionate response. A device that cannot be patched sits on the boundary of your network and answers for every other device on it.