Hacker News Reader

Does someone need to have control of the router to do this? Or how could it work otherwise?

It's in the article. He spoofs the MAC address to trick the gateway into thinking the attacker is the victim.