Recently, security cameras with livestreaming got installed around the house. The cameras are connected to the router and uploading to the company's servers, and then I can watch the streams live on my phone.
The person who came to install the cameras changed a lot of the router settings (I think he did some kind of reset, cause my forwarded ports were gone, and the saved template as well), and also changed so that username and password was not needed anymore - anyone connected via WiFi could access the admin page by simply visiting
192.168.1.1 (sounds like a huge vulnerability, and thus incredibly suspicious).
Now in the middle of my gaming session I noticed the router settings suddenly changed, because I had enabled UPnP after they removed my forwarded ports, but now it is disabled again while I am trying to play. I went to the router page to see what they had done, and I see that username and password is required once again, but they have changed it so I can't even access the page myself now. They essentially hijacked the router.
I want to find out what they are up to. My computer is connected to the router and I have physical access to it. However, I do not just want to physically reset the router and cut their access unless that enables me to see what they have done. In other words: I want to catch them red-handed.
Also, when they have full access to the router, can they eavesdrop on HTTP? HTTPS? Are there perhaps any other security issues I haven't thought of?
The router is a Thomson Technicolor TG799vn v2.
I installed a program called Capsa and perhaps it is the perfect tool for this job. However, my lack of knowledge is too great to do a proper analysis.