Router being hacked

modo77

modo77

modo77

Soldato
Joined
31 Aug 2004
Posts
3,658
Location
Sol System
I've got an issue which i have been looking into for a mate, he is getting his SSID and passphrase changed constantly. Using WPA.

This has happened on 2 different ISP's and a 3rd party router. Last night he disabled his wireless on the router as he was only using ethernet, but when he got home from work tonight the wireless was re-enabled and the details where changed again.
The passphrase is changed to youllneverchatchme or something along those lines. Now he has had some fraud on his bank while this has been ongoing but probably nothing to so with this.

Any ideas folks? I've checked for processes, startup items and ran hijackthis, but nothing in those.
No one else has access to his house.
 
There has to be something on the computer if the wireless was re-enabled? Try running malwarebytes on it.
 
Change the Router IP from say 192.168.0.1 to 192.168.1.1 or something, as well as change or add (if there isn't already) the user login details for the router; set the password as something hard.. Then change the Wireless password yourself again to something completely different and hard.

Also, turn of Remote Access to the router as well as Wireless Access to Router if it has that specific feature, I know a few do.. Basically, you can not access the router's config from a computer outside of the network as well as anyone on a wireless connection - is unable to access the router unless wired straight to the router and on your network of course, it is worth looking into.

That should definately sort you out, hope that helps. :)
 
http://forums.overclockers.co.uk/showthread.php?t=18167347

ffsm.gif
 
Cheers all, he doesn't have a remote access function on the router.
It has always been wpa enabled.
I'll get him to run malwarebytes (forgot about that :p)
I'll get the ip and password changed aswell.

Also noticed that he can block certain macs, so going to block the others in his list. we'll see what happens..
 
you should be able to make it so your router allows config access only to hard wired computers.

mine is set up this way by default

Also noticed that he can block certain macs, so going to block the others in his list. we'll see what happens..
Click to expand...
yea turn mac address filtering on so the router only allows the computers you want access to
 
Last edited:
It's most likely WAN access, to be sure unplug all LAN machines and see if the router gets hacked again.

What is the the router? Maybe flashing a newer firmware may close some odd vunerability?
 
You want This page to setup your WPA passkey and your Password to access the Router. Every time you go to the page a unique key is created for you and you alone. 64 completely random characters that you could copy so you don't need to type it in.
 
It doesn't have MAC access control list unfortunatly. The only option is to block ones which are connected.

Its a Tompson router from o2, forget the model at the moment. Thing is it happened on his old netgear from sky aswell.

Should have an update tomorrow..
 
Sounds like his system may be compromised.
If not, then tell him to stop broadcasting his SSID, and to change his SSID to something odd.
After he does that change the password for wireless to something secure.
Then change the login detaisl to his router from the standard manufacturer details, root/root, admin/admin not good for security.
Activate WPA2 instead of 1 if he can, as I recall WPA had a linux based exploit where it could be opened in 3-4 minutes, thsu why WPA2 was generated so quickly after WPA to plug the hole.
 
Hmmmm both routers had the same issue? Beginning to sound more like a comprimised PC. I'd be tempted to connect to it with another PC and change the settings and see if that helps

If the main machine is comprimised then you could change the password and the hacker could be keylogging to capture the new password
 
PistolPete said:
Hmmmm both routers had the same issue? Beginning to sound more like a comprimised PC. I'd be tempted to connect to it with another PC and change the settings and see if that helps

If the main machine is comprimised then you could change the password and the hacker could be keylogging to capture the new password
Click to expand...

Yep that's what I was thinking or someone has remote desktop or such like meaning they will have bypassed the wifi and using ur pc to do it. Does he turn his pc off?

Class--
 
You have eliminated the obvious I take it: that it's not someone in the same house, or with access to the house? But start with the router password.


M
 
You must log in or register to reply here.
Back
Top Bottom