Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 3 down vote favorite

Internet was extremely spotty for about a week. I was on/off cycling the cable model and router almost daily, before I tried to sign into my router (198.162.1.1). When I did I was presented with a message "level_15" access code required or something similar. I hard reset the router and set everything back up with the same passwords I had used before and it was immediately changed again. After another reset, firmware upgrade, and a strong password chosen for the admin, everything is back to normal.

My questions are:

  1. Is this a common hack and why would someone want to do this?
  2. I thought someone would have to been physically close enough to wirelessly access my router. Is it possible to do these things remotely now?
  3. How was the password changed so quickly after the 1st reset?

Edit:

I was trying to access my router at http://198.162.1.1/, instead of http://192.168.1.1/.

My router password was likely never changed, I was just using the wrong address. Now, I'm very curious what this "level_15_access" is at http://198.162.1.1/.

share|improve this question
What kind of router? "Level 15" makes me think Cisco – Jeff Ferland♦ Dec 8 '12 at 23:06
1  
Level 15 does invoke cisco somewhat but IOS would never mention level_15 access. @whitespy9, I am having trouble understanding exactly what the sequence of events is. – GdD Dec 8 '12 at 23:17
It is a netgear wndr34000. I'll update my question and try to make it more clear. I'm not talking about the network password, I'm talking about the router admin password. – whitespy9 Dec 8 '12 at 23:23
From the forums 3400 V2 in on beta now has now block wireless access to router interface. So only the wired pc can access the router interface. Time for firmware upgrade or replacement with a router that supports V2? – Fiasco Labs Dec 9 '12 at 0:59
1  
Are you running WPA2? Accessing the admin interface over unencrypted wireless transmits the passwords in cleartext. – Fiasco Labs Dec 9 '12 at 1:05
show 2 more comments

closed as too localized by Jeff Ferland♦ Dec 9 '12 at 17:16

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, see the FAQ.

2 Answers

up vote 3 down vote accepted

Seeing that you've erroneously typed 198.162.1.1 instead of 192.168.1.1, the level_15_access login window is no surprise. 198.162.1.1 belongs to a Canadian college, and the 198 address is a login screen for something of theirs.

share|improve this answer
up vote 0 down vote

  1. If your router is publicly reachable, then probably yes. Otherwise someone may have been on your network (wired or wireless). In fact, half the routers you find with Shodan are unprotected.

  2. This depends on the settings of your router, assuming there are no exploits that work from the internet. If it's not publicly reachable then an attacker must find a way into the network. This can include plugging in a cable on a switch or cracking the wireless, but having control of device inside the network.

  3. The attacker was probably online. Having a script setup to do this automatically seems far-fetched, though certainly possible.

Bonus: Updating the firmware and changing the password to a strong one are very good steps, and absolutely necessary to prevent this from happening again. You might also want to make sure that no devices have been breached (which is easier to do when you are inside the network and past the firewall that the router probably employs), and Google for any known exploits for your router.

Hope this answered your questions!

share|improve this answer
Thank you for the response! If you have any more thoughts on the following, it would be appreciated. 1. No, it is not publicly reachable. 2. The router is inside my home. The only access was wirelessly. Bouns: How would I know if a device has been breached? All mac OSX/iOS devices here in the home that use that router. – whitespy9 Dec 9 '12 at 0:11
Sorry, unmarking as answered. It just happened again. Need to find a way to stop this. – whitespy9 Dec 9 '12 at 0:22
@whitespy9 Can you view a list of connected devices on the router? I'm not sure what the best way is to check for malware on connected devices without knowing what to look for. Just the usual: install anti-virus, update software, look in the process list and google what you don't recognize, perhaps look for unusual amounts of traffic, etc. There should be a question on this topic actually. – Luc Dec 9 '12 at 0:23
Those are great suggestions, here is my problem though. If the password is changed on the router, how can I vie who is connected to it and traffic log? When I reset the router, I lose all this information. I'm starting to dig around on individual devices, but it is going to take a little more time that way. – whitespy9 Dec 9 '12 at 0:50
1  
Can you lock out admin access from the wireless network? – Fiasco Labs Dec 9 '12 at 0:55
show 2 more comments

Not the answer you're looking for? Browse other questions tagged or ask your own question.