Wireless hacked again...i think?

[seanDoe]

Hey ppl,

i'm having a bit of a scumbag hacking problem!
Had a Netgear wireless router sitting there for years with little or no maintenance done to its security - had WPA2-PSK set but with a relatively weak password - and i decided to attend to it back in April. So, i changed the admin password and the wireless password and tinkered with a couple of basic settings. Went back a few days later and i couldn't access it using the new password. So, i figured hey, that's not on...some thieving git must have been leeching my internet for years and decided, when i took back a little control, to take over the admin rights of my router!!
Anyways, i reset it, changed the SSID, changed the ip, stopped broadcasting and set up much stronger passwords (there wasn't much else i could do with this dated router, i think)
It seemed to be working ok until the possible DOS attacks(?) started getting more and more frequent and unexplained fluctuating speed rates.
So, i updated my router to a TP-Link about a month ago and initiated all the security feature bells-and-whistles i possibly could. Everything seemed to be working peachy until tonight. The wireless suddenly cut off, so i tried to connect with ethernet...and no joy! No ping response...it simply ignored both my laptops and my phone.

My question is this: How can i be certain it's one of 3 possible neighbours raping my router and not some random, devious hacker over the internet

Security implemented:

- strong passwords
- mac filtering
- alternate router ip
- SPI firewall
- DOS protection
- ICMP-Flood attack filtering
- UDP-Flood filtering
- TCP-SYN-Flood attack filtering
- Ignore ping packet from WAN port
- Forbid ping packet from LAN port

 

[Dark Lord of Tech]

Use WPA2 Security.

 

[ChiefScooter]

I believe your router should store logs on it. Try looking at these and seeing where the attacks are coming from. If you don't see much coming over the internet, you will know that it is one of your neighbors.

 

[seanDoe]

Yep, as stated, i always use WPA2 security.
As to my logs, i had been monitoring them and there appeared to be nothing out of the ordinary.
Also constantly checking the wireless statistics tab which states the number of machines connected to router - never more than 1!
And, i had no access to the logs when i was locked out of the router and had to reset.

 

[seanDoe]

Oh, and where's my manners?
Thanks for replies.
Just trying to figure out/confirm it's a local hack and not some internet deviant!

 

[seanDoe]

Yep, after thinking about it - if i have no access to the log there's no traceablility right!?
I know there is possibly an option to instantaneously upload the log onto admin pc.....but, if the fecker takes over the router while i'm not logged on or, seemingly, even when i am, i lose all communication with the router, so...
Anyways, anybody know of any decent freeware, basic intrusion detection programs?
Or can anybody reccommend more stringent security measures to implement?
Ideally i'd like to identify the prick and brick his/her machine with the nastiest piece of malware crap i can find...but hey, dream on i guess - i'd need a crash course in hacking myself!

 

[bill001g]

You also need to disable WPS. You can turn it on only when you need it and then off. There is a fundamental flaw in the protocol. You also need to patch to the latest firmware on some routers the bug will tell you is disable but it actually is still on. The flaw in WPS allows someone to use brute force guessing in a couple of hours to obtain your WPA2 pershared keys.

It may not be a attack, you will see many post on this forum about routers all the sudden locking up or getting slower and slower.

Best to try newer firmware or if your device supports it dd-wrt firmware. There are many more firewall/intrusion options in the dd-wrt release.

 

[seanDoe]

Nice one bill001g,

sounds like good, useful advice,

will try immediately,

thanks

 

[seanDoe]

Hey, anyways, just to check back in.....had latest firmware installed, disabled WPS and dd-wrt not supported on TL-WR842ND.
Have a more rational less frustrated/paranoid outlook on issue now
Got isp to change ip and reverted back to old Netgear (also not dd-wrt supported) router and ....happy days, no more trouble.
So....i'm making the wild assumption that it wasn't a local attack (?), but some malicious random, spotty little nerd i offended in some chat room somewhere!
I believe it wasn't hardware/software related as it started out with a lock out of the Netgear then 5 times the TP-Link! - too much of a coincidence.
Anyways, problem resolved although possibly temporarily.....baited breath and all that!