This was a really strange thing, so I use a Dlink Dir-816 router. Today it rebooted all of a sudden and when it came back online the name of the wifi etc where reverted to default. Ok this was not a big deal but when I logged on to router homepage to reconfigure the settings out of nowhere it’s showing a page called Tenda ( this was the first time I ever heard of a company named Tenda, turns out it’s a legit company ) The login password was not the one I use, it was the default company password so I was able to login. When I logged in the settings used a different username ( with some other guy’s name and initials ) so I logged out reset my router and everything is back to normal. I called dlink to see if they were purchased by this Tenda, they said no and they were equally clueless as me on this issue, they said they’ve never heard anything like this. I also called my network provider (it’s a fiber optics connection ) he confirmed that there indeed was a guy ( with the name and initials as on the Tenda login page ). My question is how does something like this happen, how can your router’s firmware be suddenly changed to another one and that too of a different company and how could I access a different person’s network settings ( well access is kind of a stretch I could see and edit his network settings if I wanted to, but what good does that do for me ) Also one more question is this a lapse from the network provider in terms of security, I mean in the case of individuals it’s more or less a minor issue, but for some financial institutions or businesses this could be a risk right?

On a side note I live in a very isolated location there are no houses or anything nearby at least for half a kilometre, so there are no other networks that my devices could have picked up. The possibility that it might’ve been someone’s wireless hot spot is also unlikely as my compound wall stretches far and my dogs would go haywire if anything came even close to the walls.

  • 1
    Are you sure it's the same router? Does the MAC address match the previous one? If you connect via direct Ethernet to your DIR-816, do you still see the same issue? (I kind of suspect that there's an actual Tenda router connected somewhere.) – user1686 May 31 '18 at 12:07

The ISP you are using is incompetent. It basically means that you do not have a private connection. You are supposed to be privately separated from other ISP users on the segment. This suspicion is confirmed when they said they do have a customer with that name in the account database.

I don't think it was a firmware or virus attack on your router. The engineer's that work for your ISP goofed up somewhere, it was a legitimate router. Just not your router.

| improve this answer | |
  • How can he connect to another router when all his connections have to absolutely pass through his own router? There is no other house around and this is happening inside his local network. – harrymc May 31 '18 at 19:00
  • @harrymc this answer is also speculation. But my train of thought was this, I have personally witnessed duplicate Mac addresses on a LAN deployment, obviously this is rare. So it wouldn't surprise me if it is possible for other device interfaces.(it wouldn't be an issue if he was properly segregated). I'm also assuming like here, he has a fiber ONT box that is essentially a fiber to Ethernet bridge. I think his company forced a OTW firmware update over the network. Resetting all the routers in his local segment back to defaults. (improper provisioning on the ISP side I think caused it) – Tim_Stewart May 31 '18 at 20:37
  • It wasn't set to defaults - it got false identifiers. Highly unlikely that an ISP would force the download of firmware that was specially tailored per each user, for all the users on the network. Normally a duplicate MAC is impossible because it's a factory property of the network adapter, requiring a factory glitch to happen. The hacking of an adapter is also possible, but this would go beyond incompetence. – harrymc May 31 '18 at 20:46
  • @harrymc, VZ pushes firmware updates here, but only to their supplied routers. (FiOS & DSL.) The DSL routers do keep some nv-ram settings after an upgrade ( ppp user/pass) The op stated it rebooted, and came back up with defaults. This is by no means an authoritive answer. I feel like a virus or firmware attack is a stretch, the attacker would need to know the exact revision of the router, which isn't easily identified unless you have physical access to it. Most likely what would happen if you attempted this, is you would brick the router. – Tim_Stewart May 31 '18 at 21:43
  • The biggest argument against a firmware push is the fact that a reset got rid of it, because otherwise this would have persisted. This was rather a passing episode, lasting only as long as the router wasn't rebooted, which exactly suits the advice by the FBI. A reboot wouldn't have changed the MAC address. – harrymc Jun 1 '18 at 5:15

In my country, Tenda is a known manufacturer, as far as I know, mostly the ISPs use their products. Is it impossible, that you see the ISP's device, which previously was in bridge mode, and now working as a router, instead of your own router? (but... how could you login to it with same credentials it is actually the ISP's router... - so it could be a stupid idea, except if you and your ISP use the default password and these are identical)

If you're connecting to your router via wireless connection, then it can be a bad guy's device... (a mobile phone is enough to create a fake AP)

| improve this answer | |
  • "there are no houses or anything nearby at least for half a kilometer". – harrymc May 31 '18 at 19:04
  • And... ?? 500 meters? It is not an impossible thing, even from such a distance. 2.4GHz has very long range with appropriate devices. AFAIK. – user907961 May 31 '18 at 19:57
  • 500m and through several walls of farm-houses is rather unlikely. Even so, why would his computer pick up a very faint source when a strong one is nearby? In any case, this requires that both routers use the same channel, so with interference this scenario is rather impossible. – harrymc May 31 '18 at 20:16
  • Who knows? For example he/she works in an important place, or a stupid script kiddie got the required devices, tools, and thought "it's a good joke" etc. (IMHO) Some years ago, I've seen a near plaza's access points on my router. They are about 2-3kms from me.<br>But... Did you read my answer's first part? – user907961 May 31 '18 at 20:19
  • A script kiddie that got some pretty expensive equipment just to play pranks? The plaza access points may be visible but wouldn't work too well. – harrymc May 31 '18 at 20:21

This might have been an random virus attack that took over your router and reset the firmware with data gleaned from another victim.

The latest firmware version I found for the Dir-816 dates from 2015, so might be vulnerable to modern attacks.

I suggest to ask your ISP for a newer router model with recent firmware (I suggest that even if my virus attack theory is wrong).

| improve this answer | |
  • 1
    err...why would a virus even replace the firmware with one that's apparently from another company? – Journeyman Geek May 31 '18 at 17:17
  • @JourneymanGeek: There are heaps of router bugs now being uncovered, and some manufacturers are begging users to upgrade firmware. As does the FBI for example. But there is no possibility of upgrading his router. I don't know if an attack exists that replaces the passwords file, but this looks extremely suspicious. The other answers don't look likely in view of what this guy is saying : very isolated house/line and no other networks that his devices could have picked up. – harrymc May 31 '18 at 18:47
  • 2
    But this is completely speculative. If you could find an example where a dlink router has its router that's been replaced by another brand... maybe but right now this has the air of "my brother's wife's aunt's cousin heard that" – Journeyman Geek May 31 '18 at 18:50
  • @JourneymanGeek: I'm trying to be analytical : An impossible event has happened that cannot be explained by any action of the user or his ISP. His router was evidently remotely trafficked by an external agency. So what does it look like? My advice is to better be safe than sorry. – harrymc May 31 '18 at 18:55
  • 1
    I think... That's kind of the point – Journeyman Geek Jun 1 '18 at 1:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.