How is a question about dealing with a possibly compromised router or modem an "exact duplicate" of a question about a compromised server?

Question

The closing of this question perplexes me. I understand that the question it is supposedly a duplicate of--How do I deal with a compromised server? --is basically the canonical question on here about what can be done to remediate any potentially/known-compromised server with a full, general-purpose OS on it. (And perhaps it is for general-purpose PCs as well.) And I don't think I have any real issue with it being that. But is it really the judgment of the community that dealing with a potentially compromised modem or router--especially a SOHO modem/router--is almost exactly the same thing, at a practical level, as dealing with a compromised server?

If so, I'd definitely appreciate some more guidance about what types of computational device compromises don't fall within the scope of that canonical question, at least when we're talking about the purpose of closing a new question as a duplicate of it. Cause (as someone who has done both many home/small biz gigs and some corporate-scale work) I honestly do have some trouble seeing the almost "exact" practical ( vs. theoretical) similarity myself in the case of remediating SOHO routers vs. enterprise servers.

Answer 1

My name shows up as one of the close voters of that question, but I did not vote to close it as a duplicate and I don't think it is a duplicate. I voted to close it as to broad.

Here are some things that taken together makes it a different question in my opinion:

• A home use scenario v. a proffessional server scenario requires answers on different levels.
• While both a server and a router are in fact computers, from the perspective of the OP the similarities and parallells are not obvious.
• The OP specifically says that they "cannot reset & back-up ISP modem". To tell someone to reset and back-up their modem is clearly not an answer to that... Even if you disagree with the above points, come on, you have to be with me on this one.
• Taken together, I don't think the OP or a similar person in a simliar situation would be helped by the duplicate question.

Still, the quesion deserved to be closed because it is very broad (and unclear as well). It is basically "I have a mess, how do I clean it up", not "I have a specific problem, how do I solve it".

But the close reason matters, a lot. It is how we communicate to the OP and that very important for their user experience. In this case, I think we picked the wrong one.

Answer 2

In general, and this is why I agreed with the flags and other close votes, a compromised device is a compromised device. It needs to be removed from service, imaged (if forensic investigation is going to be carried out), wiped, and rebuilt from new or from backup. There is little to be gained from trying to distinguish between a server, desktop computer or network device in most cases.

A router does carry an OS, and in many cases this isn't dramatically stripped down from a server OS. Ideally it just has the functions it requires to service its role, but this is not always the case.

Even where the router is carrying a minimalist OS, the core activities to recover from compromise are the same.