My Wifi has been hacked :(

[camalbitboy]

Hi All,

Just looking for a bit of advice on trying to track down who has hacked my wifi / stop it happenening again.

I have a netgear wifi router that I connect multiple deviced to but have recently noticed I have had some major go slows so tonight i did a bit of investigating.

I discovered that an unrecognised mac address was on my network, and I was only getting 2Mb rather than the 10 I should.

I recognised all the other mac addresses so went and made sure they were all turned off (2 phones, 2 other desktops, 2 laptops, Wii, PS3), refreshed the network table and was just my pc and the unknown mac address on the network. Still only 2mb speeds afetr a few minutes of monitoring.

So next i put the unknown mac address in a blocked list, saw it dissapear from the network list, and voila, 10mb speeds again (well 9200kbps, so close enough). Turned PS3 Wii and phones back on and they all work fine.

My concern is that from my understanding mac address spoofing is pretty easy and so the hacker will be back in again soon I expect.

I'm currently set up with WPA Personal TKIP connection, but also the option of WPA2 Personal and WPA2 mixed mode. I hadn't gone for those before as I was struggling to set them up (with Wii or PS3 can't remember which) so don't really want to have to reset everything.

If the hacker gets back in again is there any way to see what is being downloaded or identify them?

Any advice gratefully received.

Cam

[dave87]

Have you changed the WPA key since the issue? That would be my first port of call

[camalbitboy]

Have you changed the WPA key since the issue? That would be my first port of call

Gonna do that in the morning as too tired now. But even if I do, its been hacked once, they'll just hack it again unless I change some other security aspects surely.

I wouldn't really mind about sharing bandwidth except for the impact on my speeds and the possibility of a lawyers letter / knock on the door from the old bill. I'm in an area that everyone will be able to afford broadband, so if they are hacking mine odds are that its for dubious purposes

[ik9000]

I'm in an area that everyone will be able to afford broadband, so if they are hacking mine odds are that its for dubious purposes

not necessarily, some people are simply tight fisted scrooges and would do anything to avoid parting with their beloved money. Wealthy doesn't mean generous. Some of our richest clients are the hardest to get to pay.

[ik9000]

depending on your router you might be able to set up logging to see where different machines go. I'm considering doing it on mine,

[camalbitboy]

not necessarily, some people are simply tight fisted scrooges and would do anything to avoid parting with their beloved money. Wealthy doesn't mean generous. Some of our richest clients are the hardest to get to pay.

Hmm and thinking about it prime suspect is teenager next door. His dad is pretty IT clued up and the kid has learnt alot I know. Rest of the neighbours are all in their 80's so doubt its them.

Mind you it could be someone further away I suppose.

Well best change security protocol in the morning then

[camalbitboy]

depending on your router you might be able to set up logging to see where different machines go. I'm considering doing it on mine,

Ah now that is interesting. My router does have a log function, not entirely clear on what it logs, but will look into that in the morning. Cheers for that, exactly what i was looking for.

[dave87]

If you worried about it then it would be worth turning off wireless completely and hardwire things.

Otherwise, write down all the MAC addresses on your network and set up MAC address filtering which allows only the listed MACs to connect, hide the SSID to your network (after changing it) and rest easy.

Depending on how tech savvy you are you could even segregate the wireless to the rest of the network/lan and put a proxy server which requires a log in to prevent all but the most determined of intruders at bay.


Ie

Router ---- CAT5 ---- Everything
¦
Proxy Server
¦
Wireless AP

Then use your wireless for only the things that really need it.

[jimbouk]

Wait till they log on again and then see if you can extract anything interesting from their computer! Or let them on it and block all their traffic (make sure the router password is something long and random).

[camalbitboy]

Wait till they log on again and then see if you can extract anything interesting from their computer! Or let them on it and block all their traffic (make sure the router password is something long and random).

Thats what I want to know though. If/when I do see them on mine again how do I get into their computer to see who they are and what they are doing.

Figured out the router logging already so i can see what they do, would be good to get into their pc and reformat c:/ though.....

[ik9000]

Thats what I want to know though. If/when I do see them on mine again how do I get into their computer to see who they are and what they are doing.

Figured out the router logging already so i can see what they do, would be good to get into their pc and reformat c:/ though.....

sadly, much though this would be just deserts for the pikey intruder, this is probably illegal and you could be done for maliciousness or whatever the legal term is. It's the same madness that sees a homeowner banged up for beating up an intruder who tied up his wife and kids - because he chased him down the road he was deemed to have not been acting in self defense, and therefore prosecutable!?!?!

This country is a mess.

[ik9000]

if they're running a robust firewall it may be difficult to actually get into their machine. in theory you should be able to intercept their web traffic - including passwords - if you know what you're doing.

[CAT-THE-FIFTH]

I assume you have changed the default login name and password for the router??

I would also disable broadcast of the SSID and change it to something you know. Also change the WPA key too.

[Singh400]

I personally wouldn't bother with trivial things like disabling SSID and MAC filtering. I just use a really strong encryption key something like:

5}Do#c.q&w5<<'F:tAX&2h~*#>pH6k+BqCgzm;"|@)1$E{p*mTd'6N_~42r[l@{

[dave87]

sadly, much though this would be just deserts for the pikey intruder, this is probably illegal and you could be done for maliciousness or whatever the legal term is. It's the same madness that sees a homeowner banged up for beating up an intruder who tied up his wife and kids - because he chased him down the road he was deemed to have not been acting in self defense, and therefore prosecutable!?!?!

This country is a mess.

Instead of dragging the thread off topic - I've posted in QT:

http://forums.hexus.net/question-tim...-property.html

[ik9000]

If I recall correctly, said pulped person had a significant criminal record, and was acting in a gang of 5, of whom NONE of the others involved in the raid has ever been identified, charged or brought to justice.

They only got this one because the guy got his hands on him. True, he hit him with a cricket bat over the head so hard the bat snapped, (again from memory) but this guy just tied up his family infront of him and threatened to kill them. The judge at the appeal noted this was caused by the stress of the situation and was out of character. The guy who broke in, well I struggle to have any sympathy...

[ sounds like this is being continued in a new thread - please reply there if you feel so inclined ]