topic Re: My router was reset by someone else in My Router

My router was reset by someone else

JMak — Tue, 24 Dec 2024 12:29:22 GMT

I came home one day and I connected to the internet for a second on my phone and got some emails coming through then suddenly I was offline and couldn't connect to the router on any of my devices. The devices were saying the password was incorrect. I tried to go to the admin page but someone had changed the password. I reset the router and changed the passwords and had to update the password on every device. I'm worried the admin page is too easily accessible and someone outside my house can reset the router. How do I turn off WiFi admin so only the LAN admin is accessible? Also one of my devices only connects using the WPS button, it won't work by entering the password manually, is this a security risk? How could they have accessed both my WiFi router and admin page, are the same default passwords used for multiple routers?

Re: My router was reset by someone else

Townman — Tue, 24 Dec 2024 12:48:55 GMT

This sounds fishy! To do what is thought to have happened here, someone would have...

Been close enough to jump on your Wi-Fi
Known (or being able to guess) the Wi-Fi passcode
Known (or being able to guess) the router admin credentials

Many off the shelf routers do ship with standard user names and passwords - typically 'admin' and 'password'. All Plusnet routers ship with unique admin passwords and Wi-Fi passcodes. You did not indicate the make and model of router being discussed.

Netgear? See My WiFi password got changed automatically - NETGEAR Communities

Re: My router was reset by someone else

Baldrick1 — Tue, 24 Dec 2024 14:17:41 GMT

@JMak wrote:
..... I tried to go to the admin page but someone had changed the password. I reset the router and changed the passwords

Are you saying that you do not use the admin password printed on the label in the pull out tab?

@JMak wrote:
I reset the router and changed the passwords and had to update the password on every device.

Again, do you not use the preset password?

How do I turn off WiFi admin so only the LAN admin is accessible?

You can't unless you switch off WiFi completely

@JMak wrote:
... one of my devices only connects using the WPS button, it won't work by entering the password manually, is this a security risk?

WPS is only active for a couple of minutes whilst the WPS light is flashing.

@JMak wrote:
How could they have accessed both my WiFi router and admin page, are the same default passwords used for multiple routers?

They could have had sight of the pull out label if you use the default passwords. All passwords are unique to that single Hub.

As an alternative theory, if you have changed these defaults, the Hub firmware might have had a crash, which can trigger an automatic hard reset back to factory settings. This would have reset the passwords to the defaults as written on the pull out label.

Re: My router was reset by someone else

JMak — Tue, 24 Dec 2024 23:07:11 GMT

Apparently with WPS enabled it is possible to brute force access in about a day by continually guessing the pin code.

https://www.howtogeek.com/176124/wi-fi-protected-setup-wps-is-insecure-heres-why-you-should-disable-it/

It is a Plusnet Hub Two router.

Re: My router was reset by someone else

JMak — Tue, 24 Dec 2024 23:17:38 GMT

@Baldrick1 I was using the default password for the WiFi connection and admin.

I doubt anyone can see the router login information from outside but it's a slim possibility.

What I mean is WPS might be fundamentally less secure as it only requires two 4 digit numbers to be guessed once you've paired a device with it. It is more vulnerable to a brute force attack than a password.

Since the event I have now changed the default passwords and I am thinking of turning off WPS, as that might be the problem.

Re: My router was reset by someone else

Townman — Wed, 25 Dec 2024 02:17:01 GMT

@JMak wrote:

I doubt anyone can see the router login information from outside but it's a slim possibility.

What I mean is WPS might be fundamentally less secure as it only requires two 4 digit numbers to be guessed once you've paired a device with it. It is more vulnerable to a brute force attack than a password.

The cited security concern refers to WPS PIN connections. AIUI the Hub Two only supports Push-Button WPS, which the article states is intrinsically more secure, as the WPS signal is only available for a very short period.

There have been stories of people placing their routers on windowsills ... leaving the router's credentials clear to read from the street.

Re: My router was reset by someone else

JMak — Wed, 25 Dec 2024 09:15:25 GMT

@Townman If I go to my devices in router admin, I can see a computer listed that I don't recognise, that was previously connected. The word "desktop" is in the name, and it was connected by WiFi. My desktop only has ethernet and I recognise all my devices in the list. I don't know how they accessed it but there's various videos and articles online about how to crack WiFi, e.g. Hackaday has one here: https://hackaday.com/2020/09/30/automated-tools-for-wifi-cracking/

There's also something called "war driving", with tutorials on YouTube, so maybe they used one of those methods?

The router is on the windowsill but there's a closed blind behind it, so it shouldn't be visible unless someone has their face up against the window for several minutes.

Re: My router was reset by someone else

Baldrick1 — Wed, 25 Dec 2024 10:10:16 GMT

@JMak wrote:
The router is on the windowsill but there's a closed blind behind it, so it shouldn't be visible unless someone has their face up against the window for several minutes.

Or a phone with a decent camera?

Re: My router was reset by someone else

JMak — Thu, 26 Dec 2024 11:36:42 GMT

There's also some shrubbery in the way, so they would have to stand in that while pointing the phone down the tiny slit in the blinds.

Re: My router was reset by someone else

Champnet — Thu, 26 Dec 2024 15:56:48 GMT

@JMak Ask yourself why would anyone want to hack your home system ?
I reckon you’re spending too much time looking outside your network when the answer’s probably inside it….

Re: My router was reset by someone else

JMak — Thu, 26 Dec 2024 17:01:20 GMT

@Champnet I imagine it's the same reason anyone would hack any network. To obtain personal information or to use the network themselves, or general harassment. I have the evidence; a device listed in the admin page that isn't mine. I have their IP and Mac address.

Re: My router was reset by someone else

jab1 — Thu, 26 Dec 2024 17:15:02 GMT

One question, @JMak - have you tried a factory reset?

Re: My router was reset by someone else

Anonymous — Thu, 26 Dec 2024 17:18:02 GMT

@JMak

" I have their IP and Mac address. "

I don't think that the IP address proves anything, that is allocated by your router, (isn't it?).

Also, device MAC addresses can be spoofed.

Re: My router was reset by someone else

Champnet — Thu, 26 Dec 2024 17:30:58 GMT

@JMak If someone was pulling info from your system you wouldn’t expect them to advertise it. Also, various devices can use multiple MAC addresses each given a difference IP address from DHCP. ‘Desktop’ in the router device list is probably a generic name used as a best guess…

Re: My router was reset by someone else

JMak — Fri, 27 Dec 2024 12:25:00 GMT

@Anonymous what would prove to you that a device I don't own has connected to my WiFi? If you don't accept an unknown in the device list, what else is there? Are you suggesting it is one of my devices and I'm imagining the password being changed? All devices were unable to connect due to incorrect password and I had to reset the router and change the password on every device. These are facts. I know about routers resetting themselves and going back to the default password but that doesn't apply here, as I was already using the default passwords.

Re: My router was reset by someone else

JMak — Fri, 27 Dec 2024 12:40:15 GMT

@Champnet The name looks like the actual device name, "DESKTOP-TA407A3" the number looks like the motherboard. They are probably a neighbour trying to get free WiFi. It's 5GHz, and I can't account for it. I know all the others on the list. Tell me how else I can convince you.

Re: My router was reset by someone else

JMak — Fri, 27 Dec 2024 12:42:59 GMT

@jab1 That's the first thing I did once I realised none of my devices could connect.

Re: My router was reset by someone else

Dan_the_Van — Fri, 27 Dec 2024 12:51:43 GMT

On the Hub two My network list a device name with "unknown_<mac address of the device>" is likely be a network card with a randomised MAC address such as a smart phone and tablets or a device where the Hub Two does not recognise the manufacture of the network device be it wired or wireless.

Re: My router was reset by someone else

Champnet — Fri, 27 Dec 2024 12:59:44 GMT

@JMak Input the MAC address in https://www.macvendorlookup.com/ it may help to identify the device by it’s manufacturer.

Re: My router was reset by someone else

Baldrick1 — Fri, 27 Dec 2024 15:05:21 GMT

@JMak I believe that some-one else has got access to your network, my scepticism concerns the assumption that it has been hacked.

Apart from someone getting a look at the settings from the hub pull out tab, I have another theory.

Do you use any powerline devices to transfer Ethernet data over the mains wiring? If so, it is not unknown for these to be used with their default passwords, which are not unique. There have been reports in the past of people finding that they are connected to their neighbours network by accident due to both using powerline.