Wireless Hijacked!

[#1]

Most, if not all, routers will identify the wireless devices connected to the router (by their mac address http://en.wikipedia.org/wiki/MAC_address ).  Now it's possible to spoof a mac address but that does not defeat counting so if your router says you have three attached wireless devices and you only own two then you know your network really has been hacked and it's trivially simple to know.  This method won't detect spys, just people who have broken in, but only the latter can consume your bandwidth.
.

[#2]

Quote

After a few days of me changing my wireless password and disabling name broadcast, my hijacker has gone off air and I've not seen him since.

Again, you have no evidence that your wireless has ever been hijacked. inSSIDer does not, and can not, show you this.

[#3]

What you have seen is:

• More usage of your broadband capacity allowance than you can account for - but are you sure that has now ceased?


• What appears to be a neighbour's wireles router that tracks the wireless channel of your own wireless router - but if that is something spying on your wireless network then it is doing so by hiding in plain sight when genuine concealment is more easy.

What you have not seen is:

• Any "extra" devices connected wirelessly to your router - and they should be there to be found by anyone who bothers to look.

[#4]

It is trivial to change your ethernet (MAC) address for spoofing or security purposes.

[#5]

A version of DD-WRT firmware that I use to run on a Linksys router use to show all access points and the devices connected to each access point..

[#6]

Quote from: A

It is trivial to change your ethernet (MAC) address for spoofing or security purposes.

But what good does that do?  Any router that allows mac address filtering will show you the mac address of all connected wireless devices.  If you own two and the router says that you have three connected devices then you know your network has an intruder.  The fact that you don't know its genuine mac address is immaterial.

[#7]

However,
If you had 6 devices and only 2 are shown then you haven't a clue, have you?

[#8]

If one changes one's MAC address to spoof the neighbour's MAC controls on their wireless LAN it is evidence of criminal intent in the misuse of computers. Why get a criminal record for a fiver a month?
However nothing I've seen on this thread suggests hijacking of the waves.

[#9]

Sorry, Jeremy, but I fail to see how your recent comments are pertinent.  If I have six wireless devices and they are all switched on and awake then I will see six devices (barring intruders).   

[#10]

Quote from: AlaricAdair

If one changes one's MAC address to spoof the neighbour's MAC controls on their wireless LAN ...

Surely the only way you could do this would be to use the mac address of a device that is sometimes attached to the network but which is not in use.  I don't see how a router could cope with routing to two devices that have the same mac address on the same physical channel.  So if, for example, you switch off a computer but notice that its mac address still appears to be active then you know you have an intruder.  But that cannot be hard to spot on a home network, can it?

[#11]

True.
But why would you learn your MAC addresses of by heart?

[#12]

You don't memorise yours?  pft.

[#13]

Just the binary, none of this wimpy Hex.

[#14]

Quote from: ReedRichards

I don't see how a router could cope with routing to two devices that have the same mac address on the same physical channel.

In the strictest sense of the word, a Router does not give a fig about MAC addresses.  Routers route between cable segments, which are identified by IP subnet addresses.  MAC addresses live well below the IP layer and a Router knows nothing of them.  
Your ADSL router is, though, integrated with a Network Switch which connects the network devices electrically.  On a wired connection the MAC address lives between the physical layer (electrical layer) and the data link layer (lowest software layer).  The MAC is physical connected to a port on the hub or switch, which connects the devices on the cable segment together.  Sure enough, two devices with the same MAC will cause all sorts of electrical confusion, which then interferes with the operation of the entire cable segment.  
Now replace the cable segment with a radio.  
The physical, electrical, layer has been replaced by an electro-magnetic layer.  The electrical confusion, that produced the interference, that prevented two devices with the same MAC operating simultaneously on a wired network segment, no longer exists!  The MAC address is now being carried within a radio signal, which is being transmitted through an air space full of other radio signals trying to interfere with it.  The job of a radio receiver is to filter out all the other radio waves, thus reproducing the original transmitted signal in electrical form.  The receiver is perfectly happy passing on signals from different devices transmitting on the same radio channel and goes to the trouble of ensuring that devices transmitting at the same time do not interfere with each other.  So when two wi-fi devices with the same MAC operate simultaneously, the radio receiver in the access point sorts out any confusion before sending the MAC address onward in electrical form.  Two devices transmitting on the same channel with the same MAC just appear as one device to the receiving access point.
If you did not quite keep up with the explanation, the short of it is that spoofing a MAC on a Wi-Fi segment is very easy to do and very difficult to detect

[#15]

Quote from: mssystems

If you did not quite keep up with the explanation, the short of it is that spoofing a MAC on a Wi-Fi segment is very easy to do and very difficult to detect

I didn't keep up!  But what happens when you switch off the real device leaving only the intruder spoofing its mac address?  The router still thinks it is there, so will tell you it is there but you know you switched it off.  That strikes me as trivially easy to detect!