Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote -3 down vote favorite

My small office has Netgear Router (N300 DGN2200). I had it secured using "password" . So any computer which needed access had to give the security password. But today a outsider accessed my router for using internet without the password. He even showed me my password required to access network. He used proxifier , freeportscan etc. My question is how he did it and how can i protect my network from such access in future.

share|improve this question
3  
What wireless protocol are you using? If it's WEP, it's trivial to break into. You should make sure to use WPA2 with a strong password. – Polynomial Dec 3 '12 at 11:20
it shows WPA2-PSK [AES] in security options. the hacker showed me my passphrase !? – user286035 Dec 3 '12 at 11:34
3  
Welcome to Security.SE. As it stands, this question does not have enough information. Can you update the question with information as per @Poly's comment. Also, why don't you ask the 'outsider' to tell you how he did it? If he said he used proxifier etc., then that may well be his access technique. Of course, he could have just guessed 'password'... Anyway, please update the question, or it is likely to be closed as not a real question (see the faq ) – Rory Alsop♦ Dec 3 '12 at 11:37
1  
If you have a decently strong password and use WPA2-PSK, I find it difficult to believe that he is able to crack your password. – Terry Chia Dec 3 '12 at 11:55
2  
Why is a prospective employee trying to crack your network? – Terry Chia Dec 3 '12 at 12:40
show 13 more comments

closed as not a real question by Terry Chia, Polynomial, Scott Pack, Iszi, Jeff Ferland♦ Dec 3 '12 at 23:57

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, see the FAQ.

3 Answers

up vote 1 down vote

Did you use WPS to setup your router? If so, it could have been cracked using reaver.

There was also recently a more complicated attack which uses dns rebinding to hack millions of routers.

If not, it is possible that you used an easily crackable password (Dictionary word, short character length, non-complex, etc.)

From there, in order to get onto your router itself he would also need the login credentials. Did you change these to be different than the defaults?

The other vectors of attack are either social engineering, getting the password from someone who knows it, or attacking your PC/laptop itself and dumping the hashes/configuration information.

Was the password used to secure your wireless network/router the same password that you use on other accounts? If so, perhaps another account was hacked and they just correctly assumed you used the same password again.

share|improve this answer
WPS seems likely. I'd guess from there he pulled the router config out of UPnP - a lot of manufacturers are stupid enough to include the WiFi password in the XML response. – Polynomial Dec 3 '12 at 14:21
yes its WPA2-PSK [AES]. My passphrase is very long and unique with special characters. He challenged me to change passphrase and he will be able to connect again. My router credentials are default !!!? its **/*****...but isnot one required to connected with wire to access 192.168.1.1 ? – user286035 Dec 3 '12 at 15:08
You should change your router credentials. I bet you that he has compromised a device on your network and is tunneling through your router from the Internet. Watch the below youtube link starting at 29:30 because that may be in play as well. youtube.com/watch?feature=player_embedded&v=r13ESXEfQVE – Steel City Hacker Dec 4 '12 at 13:08
up vote 0 down vote

You can either use stronger security protocol , choose a "hard to guess " password and change it frequently , or if you have MAC filter in your router and your network is not very dynamic , you can build a table based on the user's MACs and the router will not accept any connection form outside the table.(of course you can new users to the table when you have new employees )

share|improve this answer
1  
MAC addresses can be spoofed in a few seconds, MAC filters don't really do anything. – Inverted Llama Dec 3 '12 at 13:18
@InvertedLlama They do help prevent drive-by attacks that go for low hanging fruit, though. – Polynomial Dec 3 '12 at 14:20
up vote 0 down vote

If he can't reproduce the steps required to "hack into" your wifi, maybe it's a simple as one of the other employees telling him the password. If he had access to one of the company pcs/laptops he could have also used software like WirelessKeyView to get the password from there.

Since your router apparently supports WPS, it the "hacker" might have also used the reaver tool to gain access to the network.

share|improve this answer
hmm..no one knows password except me. he did access a computer but for a very brief time ..all he might have looked is network name. still i will check for any installed software. – user286035 Dec 3 '12 at 13:41
You can extract the wireless key very quickly from the registry directly. It wouldn't require any special software. The software just makes it easier. (Though you do have to know how to decode it.) – AJ Henderson Dec 3 '12 at 14:42
how can i know if he checked registry or installed and then uninstalled any software on office pc – user286035 Dec 3 '12 at 15:47

Not the answer you're looking for? Browse other questions tagged or ask your own question.