My router was reset by someone else

[JMak]

@Champnet The name looks like the actual device name, "DESKTOP-TA407A3" the number looks like the motherboard. They are probably a neighbour trying to get free WiFi. It's 5GHz, and I can't account for it. I know all the others on the list. Tell me how else I can convince you.

[JMak]

@jab1 That's the first thing I did once I realised none of my devices could connect.

[Dan_the_Van]

On the Hub two My network list a device name with "unknown_<mac address of the device>" is likely be a network card with a randomised MAC address such as a smart phone and tablets or a device where the Hub Two does not recognise the manufacture of the network device be it wired or wireless.

[Champnet]

@JMak  Input the MAC address in https://www.macvendorlookup.com/ it may help to identify  the device by it’s manufacturer.

[Baldrick1]

@JMak I believe that some-one else has got access to your network, my scepticism concerns the assumption that it has been hacked.

Apart from someone getting a look at the settings from the hub pull out tab, I have another theory.

Do you use any powerline devices to transfer Ethernet data over the mains wiring? If so, it is not unknown for these to be used with their default passwords, which are not unique. There have been reports in the past of people finding that they are connected to their neighbours network by accident due to both using powerline.

[Townman]

That might explain how an unknown device shows up in the LAN attached DHCP lease table, but would not explain how they hacked the router admin page to change the password.

[Dan_the_Van]

@JMak 

It is possible to pause a devices access to the internet.

Go to Advanced settings >Access control >Pause

In the devices list select the device that is unknown to you, select the time period you wish to pause it. It can be paused for 1 or 2  hours or a custom period.

The device will see this message when using a browser

[Baldrick1]

---

@Townman wrote:

That might explain how an unknown device shows up in the LAN attached DHCP lease table, but would not explain how they hacked the router admin page to change the password.

---

It would be interesting to get feedback back from @JMak. How’s this for another wild theory: in the event that there are two interconnected networks, the alleged ‘hacked’ router is actually the second (neighbour’s) router on the network?

[Dan_the_Van]

@Baldrick1 

The two joined networks would need to be the same network 192.168.1.0/24, there would also be two DHCP servers on the network. If both routers are 192.168.1.254 this would result in a duplicate IP Address, this would cause further issues.

It would indeed be nice to have an update from @JMak as to the current status.

[Townman]

@Baldrick1

Excellent thought / detective work in Sherlocks own words “when the probable has been eliminated then the improbable must be true!”.

If two Plusnet users (neighbours) were using unencrypted dLAN devices, this scenario becomes explainable.

Third party at some time gets a lease allocated by @JMak ‘s router as has been reported.

If the devices which stopped working were connected via dLAN they could have been working via either router. When investigated it’s possible that @JMak was looking at the other router … to which the would indeed be unable to log into … bringing about the appearance of everything reported.

So @JMak do you have in your network setup dLAN devices (aka Ethernet over power adapters)? If yes reread the set up instructions (look on the internet if you have lost them) and ensure that they have security encryption set between them and are not being run “out of the box”.

[Townman]

Though the above might explain what has been reported, as Dan states, one would expect to see a whole host of other issues too … but from experience of similar (two DHCP servers dishing out different gateway addresses consequent to a TP-Link router being used as a WAP resetting itself on power cuts) such issues might not always easy to discern were there’s one SSID across multiple WAPs.

Have a few burnt fingers in this space, which does bring about the recognition of such improbabilities.

[Dan_the_Van]

---

@JMak wrote:
the actual device name, "DESKTOP-TA407A3" the number looks like the motherboard. They are probably a neighbour trying to get free WiFi. It's 5GHz, and I can't account for it. I know all the others on the list.

---

Rereading this post I sort of wonder if this thread has taken an unnecessary diversion with powerline adapter devices between properties theories, where the OP has only ever mentioned a wireless device they didn't know about.

The outstanding question for me is does the OP still having a foreign to them connection since the Hub two was factory reset.

[Baldrick1]

@Dan_the_Van 

You're quite right, it could be no more than a diversion. I was simply looking at this from a different angle.

I remember spending hours looking for an unknown device that was connected to my network. My first assumption was that I had been hacked. I eventually found it to be my other half's very old Kindle that had been stuffed in a drawer months previously and forgotten about, after an update to a better version. Turned out that it wasn't dead, it was just sleeping!

[JMak]

@Baldrick1 I do use an ethernet only power line device but it wasn't on when this happened and I only switch it on temporarily when using an ethernet cable. The unknown device was not listed under ethernet, only 5GHz. I will look into this further and see if I can secure the power line device with a password, as it could be vulnerable, as you say.

[JMak]

@Dan_the_Van The unknown device hasn't connected again since I changed the passwords. I'll try it and see if any of my devices stop working.