Disable UPnP in the router settings. In theory, that should close the hole.

Disable remote maintenace / web access. Many router web UIs have exploitable flaws that can be used to bypass password authentication.

Ensure that you are always running the latest firmware version. If there are no up-to-date versions / the router is too old, you might complain to the ISP. However, they might try to sell / rent you the latest and greatest router model then.

It looks like this exploit gets around disabled remote maintenance, since it makes remote traffic seem local.

Disabling upnp will do it. I’m going to set up blocking all inbound on 1900 on ISP’s router stopping traffic before it gets to my home router. I might finally be grateful for being forced by the isp to use their hardware for nothing other than a hop between my network’s router and the isp’s network.

> Disable remote maintenace / web access

By this do you mean a public remote address/login or the generic 192.168.0.X login page when on the serving network?

Side note: If there's one tech support job for friends and family I don't mind doing it's helping them replace the slow modem their ISP is "renting" them.

I was paying $60 per year for a DOCSIS 2 modem. Replaced it with a DOCSIS 3 for $90. Huge speed boost for almost free.

I've been begging my wife for years to let me upgrade the crap modem that the ISP is loaning us. She's terrified that if I touch anything, it's all going to break, and since she works out of the house, she won't be able to get online. Sigh...

And based on the last 3 providers I've had, you were getting a steal at $60/yr

Make sure companies care about their products and not only about money. My Swiss ISP is providing in-house developed hardware and it's quite good. I was quite surprised.

Probably not talking about USP or Swisscom then :) I use init7 now for a while with my own router and seriously never had so few networking issues ever.

I have no issues with the Swisscom box.

Well the one my ISP gave me did not only crash regularly but also auto enabled WPS, and a remote telnet administration port every other day which was insecure as fuck. These were only the obvious flaws.

Sometimes your only choice is changing the ISP.

Disable upnp. Define port forwarding statically where necessary.