Did someone impersonate my WiFi?

Question

TL;DR: An unknown WiFi extender showed up in my DHCP logs and my phone routinely connected through that access point. How badly was my network or traffic at risk?

---

This morning, while struggling with a slow connection I checked my router and was surprised to see a new, unknown device connected via DHCP. The Host Name was listed as "TL-WA850RE" which turns out to be a form of WiFi signal extender. Since I don't own such a device, I immediately added the MAC address to the exclusion filter.

I kept an eye on the network since then and didn't get any more issues. However, I noticed that my phone suddenly had random problems connecting to the WiFi. I didn't make the connection between the two until I finally got fed up and decided to change my wireless security to use WPA2 instead of the WEP I was using (for a legacy device, it's stupid, I know). Right after, I discovered that my phone suddenly found two different networks with the same SSID but different security settings. After changing and hiding my SSID, the old SSID is now still listed.

All this lead me to the following conclusion: someone broke my WiFi "security" and configured a repeater to extend its signal, thereby impersonating my network by serving as a second access point in a multi-AP network. Because my phone was closer to the repeater than my router, it was going through that access point. Since I had blocked the MAC from accessing my actual network, that connection then no longer worked.

So now my question: is this actually what happened? How worried should I be that someone was listening in on the traffic my phone presumably sent through this unknown access point? Should I take additional measures?

---

EDIT: I'll see if I can export any logs from the router to check past activity. I ran a port scan on the device which showed an open HTTP port, presumably its management console. I briefly considered trying to access it but while that's morally defensible it's probably also illegal and unlikely to provide any useful information.

EDIT 2: As I feared, it's a Belkin router with as much logging as the Sahara desert.

EDIT 3: As it turns out, a technician apparently installed this particular WiFi extender as part of an installation of a solar panel array. Not to boost the signal but because the extender has an ethernet port which connects to the power converter so it can report usage statistics. Of course they neglected to mention this to the person who's actually in charge of the network. Still, I've found the answers here quite helpful and perhaps this question can be useful to future readers who do have a malicious AP on their network.

Note: I have a fairly good idea of who it was that's been messing around on my network but I wanted to make sure that I understood what happened before confronting people or notifying authorities. Odds are I may do nothing if I can be sure that they only mooched off the wireless and didn't get anything else.

Answer 1

The attacker did not seem to really try to conceal his track :he could have faked an existing MAC address for instance, or used the classical yagi antenna + high power WiFi adapter to silently intercept your communication. Instead it seems he just used a classical home grade WiFi range extender with what seems to be default settings.

So it still seems very possible to me that he just wanted to get a free / pseudo-anonymous Internet access and was actually not interested in your own data.

You can (and should!) still inspect:

• If you can determine the usage the attacker made of his access (have you got logs showing he connected end-user devices to browse the web for instance? Or high activity caused by peer-to-peer sharing services?),
• If you can detect any abnormal activity on one of the account you were using during this period (mail, websites, etc.).

In all case, while changing the WiFi access security and password was the minimum, as a precaution measure I would also suggest to change the password of the above mentioned accounts.

Note that the direct attacker of your WiFi account may not be your only threat there. If, as I suppose, this attacker used your Internet access to go on dubious websites or freely download pirated material, then chances are that his own machine may be infected by some malware so, for some time, you hosted an infected machine in your network. This may worth a few sanity measures.

Answer 2

This is quite possible. Are there any logs on your router you can check for more information? Also, is WPS enabled on your router? If so, disable it ASAP, close all ports except for 80, change your router password (make it long and complex) and update your router firmware.

Answer 3

While that could certainly be the case I recommend that you dump all of your logs files from the DHCP service (If your router has retained them) from the point you believe that your router's security was compromised and see if any unknown devices requested an address. This would certainly show that at the very least someone compromised your security and put your data at risk, something that is most definitely a legal offense in the US. As mitigation for the future the best thing you could do is configure your own certification authority and have it issue your access point a certificate thus providing trust between your client and the router.