Comment Re:Interesting - I have 3 of these (Score 1) 68
Consider this scenario.
1. Evil hacker creates some malicious javascript that does three things: it attempts to connect to a local Asus router; upon finding one it reconfigures it to allow external access; after successfully hacking a router it opens a connection to his server to report another victim.
2. Evil hacker sets up a rogue WiFi hotspot in a coffee shop near your office, and lures people into connecting to his evil open proxy (check out the WiFi Pineapple if you want to see how such a device works, or if you just want to purchase one.)
3. The evil proxy injects the javascript into the bottom of whatever pages the victims visit, and modifies the cache-control directives to cache those pages for a long time. This is called a cache poisoning attack.
4. The evil hacker waits for one of those victims to return to your office with their poisoned laptop, reconnect to your network, open their browser, and re-visit one of the poisoned sites in their cache. The malware script launches in the user's browser, attacks your router from within the trusted side of your network, then visits his site to report "mission accomplished, here's the IP address of another hacked router." All of this is of course invisible to the average random coffee-drinking employee.
5. ???
6. I don't know exactly what happens in step 5, but it is likely nothing you would consider good.
This type of attack was fairly common when google was using http instead of https, and evil proxy operators could count on lots of people visiting the google page. It's still easy enough to do, and remains one of the biggest risks of trusting any unsecured wifi networks.
More often than not, the evil hackers are just phishing for random victims. But by setting up his access point in a coffee shop frequented by your employees, this is one way the evil hacker could target you specifically.