1

Router overview

So my router has these connections and they look a little... Suspicious. Should I be worried?

I'm on a NETGEAR router, set up as a subnet off of another network.

4
  • 3
    There's definitely something funny going on, but it's hard to say if the Netgear firmware is just crappy (likely), or if someone is using funny names in the hope to expose HTML-bugs (unlikely). Do you have shell access to the router? If yes, it's easy to find out what is really going on. Make sure to access the router via wired LAN, just in case somebody is listening for passwords. – dirkt May 2 '18 at 12:48
  • I think that Netgears WNR2000v2 (this one) has telnet access. Does that work? I am wired rn. – user900906 May 2 '18 at 13:25
  • Yes, telnet works fine. I'm not familiar enough with Netgear to say how it is set up and where stuff is stored, you may have to look around a bit, but iw wlan0 station dump should show currently connected clients, where wlan0 is the network interface of the access point (whatever that is on the Netgear). – dirkt May 2 '18 at 13:32
  • Definitely something fishy. I would disable the WiFi to see if these devices go away, then enable wifi to see how quickly they come back. Consider changing your wifi password to something strong (less than 16 chars is not secure for WPA2 anymore nowadays). Also, the interface states: "draadloze indringers worden hier ook weergegeven" which translates to: "wireless intruders are also shown here" basically verifies that this should not happen. – LPChip May 2 '18 at 14:15
0

If you suspect your router is compromised There are a couple things to consider,

If someone cracks your Pre-Shared key (WPA2-PSK), most peoples response when they suspect someone has gained access to their network is to immediately log into the web gui or telnet in to see whats going on.

This isn't a good response, as telnet sends credentials in plain text across the network, as does HTTP. The Attacker may be able to sniff your administrative password, then create a remote backdoor through the internet. if you changed your password after you suspected foul play on your network, the attacker could easily log in through a cell phone data connection to your administrative gui and see what you changed your WPA2 password to.

The proper response. Unplug the power from the router. Remove the Antennas temporarily if you can. (if you cant, wrapping them in aluminum foil will dampen the signal significantly) Plug into the router VIA Ethernet. Factory Reset the router per your devices instructions. after device boot, immediately log into the router. Change the Administrative password. (16 digit Alpha-numerical with uppercase lowercase and special characters, or the highest character number your router supports for the admin) avoid using words that are found in dictionary's. Disable WPS! Change the WPA2-PSK & use AES only. (no less than 16 digit Alpha-numerical with uppercase lowercase and special characters) Avoid using words that are found in dictionary's. Example: "L1nksTr1-F0rc3$@v3sZe|da~!" Disable telnet, use ssh if possible. Disable HTTP login, use HTTPS. Update the firmware on your router. Install antennas again, or remove aluminum foil. That's pretty much it. The problem has become pretty serious. It used to be if you wanted to try and crack a password, you would have to setup your own distributed processing network using "pyrit" or similar hashing programs to test password hashes.

There are now websites available to crack simple to very complex passwords. you pay a couple fractions of a bitcoin, and they use massive networks of GPU Hashers to retrieve a password for you.

This has put hacking back in the realm of Kiddie Scripters, and people who would not have previously had this kind of processing power available to them. A simple google search should find plenty like this. https://gpuhash.me

You have been warned!

3

The rule I follow is that if it doesn't look familiar to my network, I kick it off. That's because unless i put it there, it has no business being there, and I can put it back.

That the names for the devices are actually code that includes for-loops would make me reset the router, change the SSID, and change the network key to something more secure. This does not look like happy things are happening on your network.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy