5

I kust realized that some other PC is also getting assigned a IP address (DHCP Lease) from my modem. I am sure this is not one of the PCs in my home.

My modem was using WEP security. I know WEP is far less secure and WPA is better, but this actually is a borrowed modem, and I did not know that WEP was used.

I immediately did the following : On My Modem

  • Changed the encryption mode from WEP to WPA
  • Changed the password

After this I do not see the intruder PC on the DHCP list.

On my Mac:

  • Changed the permissions on the public folder to "everyone - no access"
  • Turned off "File Sharing" in System Preferences (But I would want to turn it back on sometime)

My mac is the one that is always on, Both the admin user and the user I normally use are password protected.

Is the above sufficient? Should I do something more?

Also, is WPA security sufficient? Should I take other steps?

Improve this question

3 Answers 3

Reset to default
4

WPA (if possible, with CCMP/AES, this may be presented to the end-user as WPA2) is sufficient, provided you have an unguessable password. I recommend using a password generator, or a short unguessable sentence. If all devices support it, disable TKIP.

As to the host systems on your network, check that neither is compromised. In theory, this works by either comparing their state with a known good state, or resetting them to a known good state. Since this is probably not feasible for a home user, monitor their connections (from a different system), and consider setting up privilege restrictions as you already did by changing you Mac's file sharing options.

You should also change the password of your router and all (email, facebook, ...) passwords that were transmitted without encryption.

Improve this answer
1
  • Thanks. I have done all. But I still somehow see the other machine (IP: 192.168.1.6) active, at least through Wireshark. Asked another question on that(superuser.com/questions/328968/…). Still, thanks.
    – Nivas
    Aug 28, 2011 at 10:50
1

In general, I advice you against ever transmitting passwords or any other sensitive data unencrypted in wireless network. The possible attacker does not need to lease IP address to monitor your traffic, so you have no way of knowing if the data was compromised or not.

Because he leased IP address, most likely he just wanted to get access to the Internet. You should always configure any machines on WiFi so that they only reveal the services you could open to public network, because in terms of security, WiFi is public network.

WPA2 can make it reasonably, but not totally secure - if you need total security, draw wires.

Improve this answer
1
  • Thanks. I have done all. But I still somehow see the other machine (IP: 192.168.1.6) active, at least through Wireshark. Asked another question on that(superuser.com/questions/328968/…). Still, thanks.
    – Nivas
    Aug 28, 2011 at 10:51
0

You're fine for now. I had the same thing, but I was nice and left my network open. The next step if you get more paranoid is to enable WPA2

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .