If you suspect your router is compromised
There are a couple things to consider,
If someone cracks your Pre-Shared key (WPA2-PSK), most peoples response when they suspect someone has gained access to their network is to immediately log into the web gui or telnet in to see whats going on.
This isn't a good response, as telnet sends credentials in plain text across the network, as does HTTP. The Attacker may be able to sniff your administrative password, then create a remote backdoor through the internet. if you changed your password after you suspected foul play on your network, the attacker could easily log in through a cell phone data connection to your administrative gui and see what you changed your WPA2 password to.
The proper response.
- Unplug the power from the router.
- Remove the Antennas temporarily if you can.
(if you cant, wrapping them in aluminum foil will dampen the signal significantly)
- Plug into the router VIA Ethernet.
- Factory Reset the router per your devices instructions.
- after device boot, immediately log into the router.
- Change the Administrative password.
(16 digit Alpha-numerical with uppercase lowercase and special characters) avoid using words that are found in dictionary's.
- Disable WPS!
- Change the WPA2-PSK & use AES only.
(no less than 16 digit Alpha-numerical with uppercase lowercase and special characters) Avoid using words that are found in dictionary's. Example: "L1nksTr1-F0rc3$@v3sZe|da~!"
- Disable telnet, use ssh if possible.
- Disable HTTP login, use HTTPS.
- Update the firmware on your router.
- Install antennas again, or remove aluminum foil.
That's pretty much it. The problem has become pretty serious. It used to be if you wanted to try and crack a password, you would have to setup your own distributed processing network using "pyrit" or similar hashing programs to test password hashes.
There are now websites available to crack simple to very complex passwords. you pay a couple fractions of a bitcoin, and they use massive networks of GPU Hashers to retrieve a password for you.
This has put hacking back in the realm of Kiddie Scripters, and people who would not have previously had this kind of processing power available to them. A simple google search should find plenty like this.
You have been warned!