So my router has these connections and they look a little... Suspicious. Should I be worried?
I'm on a NETGEAR router, set up as a subnet off of another network.
Super User is a question and answer site for computer enthusiasts and power users. It only takes a minute to sign up.Sign up to join this community
If you suspect your router is compromised There are a couple things to consider,
If someone cracks your Pre-Shared key (WPA2-PSK), most peoples response when they suspect someone has gained access to their network is to immediately log into the web gui or telnet in to see whats going on.
This isn't a good response, as telnet sends credentials in plain text across the network, as does HTTP. The Attacker may be able to sniff your administrative password, then create a remote backdoor through the internet. if you changed your password after you suspected foul play on your network, the attacker could easily log in through a cell phone data connection to your administrative gui and see what you changed your WPA2 password to.
The proper response. Unplug the power from the router. Remove the Antennas temporarily if you can. (if you cant, wrapping them in aluminum foil will dampen the signal significantly) Plug into the router VIA Ethernet. Factory Reset the router per your devices instructions. after device boot, immediately log into the router. Change the Administrative password. (16 digit Alpha-numerical with uppercase lowercase and special characters, or the highest character number your router supports for the admin) avoid using words that are found in dictionary's. Disable WPS! Change the WPA2-PSK & use AES only. (no less than 16 digit Alpha-numerical with uppercase lowercase and special characters) Avoid using words that are found in dictionary's. Example: "L1nksTr1-F0rc3$@v3sZe|da~!" Disable telnet, use ssh if possible. Disable HTTP login, use HTTPS. Update the firmware on your router. Install antennas again, or remove aluminum foil. That's pretty much it. The problem has become pretty serious. It used to be if you wanted to try and crack a password, you would have to setup your own distributed processing network using "pyrit" or similar hashing programs to test password hashes.
There are now websites available to crack simple to very complex passwords. you pay a couple fractions of a bitcoin, and they use massive networks of GPU Hashers to retrieve a password for you.
This has put hacking back in the realm of Kiddie Scripters, and people who would not have previously had this kind of processing power available to them. A simple google search should find plenty like this. https://gpuhash.me
You have been warned!
The rule I follow is that if it doesn't look familiar to my network, I kick it off. That's because unless i put it there, it has no business being there, and I can put it back.
That the names for the devices are actually code that includes for-loops would make me reset the router, change the SSID, and change the network key to something more secure. This does not look like happy things are happening on your network.