How to prevent illegal connection to my router WiFi

Question

In my question, which was marked as a duplicate, I got suggested posts to refer to. I`ve read all of them; and my router options are already matching the suggested options: as using WPA2 with AES, and WPS and UPnP are turned off. If I change the username and strong password I am using, and someone has managed to bypass them, he can do this again.

I am suspecting that someone is illegally using my router WiFi. Is there a software that can be installed on my computer (running Windows 10, and connected by a cable to the router) to identify the devices connected wirelessly to my router, which does not have the feature to list devices connected to it?

Or a way to prevent devices other than those in my home (laptops, cell phones, tablets) which are connected wirelessly to my router?

I did not find the answers to these questions in the suggested posts.

Answer 1

There is a full possibility that someone maybe using your wifi illegally. If you have changed your password to a safe one and if he is still able to bylass them in no time then that only means that he has hacked your WPS pin. It is a pin used to get your password after you have forgotten them so no matter how many times you change your password he will be able to get your password. It is not possible to change your WPS pin as it aldready comes with the firmware but you can try turning it off in your router settings. And please check your WPS service by a third party app even after turning it off coz some routers indicste that they are off but it is still on.If your router is a very old one i suggest getting a new one.

Now with regard to providing access to limited set of devices you can setup mac filtering it is a function which allows you to setup a specific list for authentication.

And also make sure both your router and computer os are updated regularly.

I strongly recommend switching to windows 10 as the nsa exploit for windows xp is easily available to the community.

Answer 2

I am suspecting that someone is illegally using my router WiFi.

While there might be someone doing this, nothing in your question provides any evidence. Note that it is not uncommon that users suspect hackers when strange behavior happens even if there are other and sometimes simpler explanations possible.

Is there a software that can be installed on my computer (running Windows XP, and connected by a cable to the router) to identify the devices connected wirelessly to my router, which does not have the feature to list devices connected to it?

If your router does not provide such functionality no software can ask the router to provide these information. You could analyze your network though for suspicious activity, i.e. if systems connect to your computer which you don't expect to etc. What to do exactly here depends on what you suspect the hacker to do, which essentially boils down again to what makes you think that there is someone using your router in the first place.

"...running Windows XP..." - if the rest of your network is as secure as your long outdated and no longer supported operating system than it is not unlikely that somebody is misusing your network though.

Or a way to prevent devices other than those in my home (laptops, cell phones, tablets) which are connected wirelessly to my router?

That's what you do exactly by following the recommendations in the questions+answers provided as duplicates to your previous questions, i.e. having a secure router (i.e. current firmware, no backdoors ...) and setting it up in a sane way (WPA2, strong passphrase, strong admin password, no access from outside ...).

And note that a strong WPA2 passphrase does not help if an insecure device is connected per cable to the router (or per WiFi but knows the password), like it seems to be the case with your Windows XP system. This is especially a problem if these insecure devices are used for administration of the router.

Answer 3

The quick way is to do a factory reset on the Wi-Fi router and start from scratch. Set a new Wi-Fi Password abd new admin password.

TL;DR the long way:

You need to make an inventory of all YOUR devices on the network. Every printer, NAS, smartphone, pad, IoT, Wi-Fi extender etc. - get all the MAC and the corresponding IP addresses. Tools like arp, nmap will help you. MAC is often next to the model and serial number.

Then go your Wi-Fi router. If you can, change the user name of your admin user and of course the password. Make it complex (at least 12 characters, numbers etc.). Then change the Wi-Fi password and write that down.

Turn off DHCP on the Wi-Fi router. This will prevent any wired connection, even the one you use to connect to the Wi-Fi router. Then set a fixed IP address on your computer with the gateway pointing to the Wi-Fi router. You can now use the wired connection as you have currently from the DHCP.

Now reboot the router. At least your Wi-Fi connected devices should not be able to connect.

The DHCP will no longer give IP addresses. You should still be able to connect since your IP address is fixed on your PC. On your router you should now only see your PC connected.

Now turn DHCP back on. Configure the address range to different values: i.e. If your range was from 192.168.0.11 - 49; set it to 192.168.0.51 to 61. Make the range as small as possible. There is no point to set it to 128 if you only have 4 devices. Set the lease time to something in the order of 4h.

Now setup on each Wi-Fi device you found the password. You should see those devices on the Wi-Fi as connected. Since you also see the MAC address setup a MAC address filter and only allow your devices on the Wi-Fi router. Block every other MAC address. That will eliminate rogue connections.

And yes, somewhere along the line you should update XP to Win 10.

Answer 4

I wanted to add a cool direct approach I use pretty frequently that uses their own tools against em!

You could start logging with airmon-ng (from the aircrack-ng suite). One thing airmon-ng does is show the Base station SSID and it shows the clients connected to that SSID.

Even if they have a static IP (and wont show in DHCP), you can compare the SSID's of all clients airmon shows, to the SSID's your DHCP handed out, as airmon operates on the physical level, et voila!

If anyone is associated to your AP, this way, you'll know.

A small note on this approach

You might want to try logging from as close as possible to your AP. You will need to be in range of the attacker for this approach to work. By putting your logging machine close to the hacked AP, you can be sure that the attacker's signal will be strong enough to reach you.