My son plays Minecraft on the internet. Someone said they hacked into his WiFi. Our WiFi is locked and must have a passcode to access. Is it possible this happened and, if so what should we do?
It is possible in theory, but this does not make it having actually happened.
It is equally possible that whoever said that did it just to mess with your son's head, and yours.
We'd need to know what the exact make and model (if possible even firmware revision) your router is. The WiFi router is essentially a small PC and it is sometimes (depending on the make and model) accessible from the Internet. Since its Internet address is, in that case, the same Internet address of whoever uses it, i.e. your son's when he plays Minecraft (or an address that can be calculated from your son's, in the unlikely event that your ISP assigned you an address group instead of a single one), anyone capable of getting your son's IP address would automatically know the router's.
The first line of defense is that the router either does not offer, or it does but the option was disabled by the owner, a way of being remotely controlled. Some ISPs will supply a WiFi AP/router and leave it remotely accessible, with a password known only to them (in theory). In practice these passwords leak. Sometimes are even sold or spammed by disgruntled ISP employees.
There have been cases of router manufacturers that supplied their routers with two passwords, one settable by the owner, one known (in theory) only to them, enabling them to fix problems remotely. Again, if these "backdoor passwords" leak, the router ceases to be secure.
Then there have been cases of sloppy manufacturers doing improper password checks. Imagine I ask you a password to tell you where the goodies are, and the "security" is that in theory no one can know where they are unless they give the correct password. But it turns out that the goodies are always in the same place on all the routers. At that point you don't actually need the password at all.
There are also other sloppinesses (thanks to @Anders for pointing one out). The router might allow requests in such a way that it would obey to a request your browser has been tricked into making on someone else's behalf. To do this, one would need to send you a link, and you would need to click on it, pointing to some strange URL such as (this is a faked example)
http: // YOUR_INTERNAL_ROUTER_ADDRESS / commands/allow-access?to=EVERYONE. This kind of vulnerability is also fixable by the router vendor.
Knowing the manufacturer, the model and the firmware revision, it will be possible to verify whether yours is one of the known unsecure models, and/or whether it offers remote administration capabilities.
Do It Yourself
Meanwhile, you can check the user manual yourself. If, for example, you discover that:
- your router has remote administration capabilities ("remote login", "ssh login", "WAN access", "remote telnet", and references to ports 22, 23, 8000, 8080 and similar being "available" or "activable" or "needing to be closed for security" are all strong hints that it has),
- the default password for that interface (which is not the same as the WiFi) is still the default (e.g. "admin"), or it is not but you don't remember having changed it and don't even know what it is
...then yes, chances are that your WiFi has been hacked (or might be any time), and you should deactivate the remote admin interface and/or change its password. You may need to reset the router to the factory settings to be able to do so, and possibly even ask for your ISP's tech help.
In theory, your router might be unreliable even so, for it might have been been in control of parties unknown and it might have been modified in such ways that even a factory reset can't undo. It's not too likely, to be sure, but it can happen.
Also, even if you find no remote admin interface active, the router might still be vulnerable in the "non-official" ways mentioned above. You can run a first basic check yourself by entering your make and model into Google and add "vulnerability" or "backdoor" as search keywords. If you find something like "YOUR_ROUTER has SO_AND_SO vulnerability", again you might have reason to worry.
One thing I forgot to mention is that before doing anything else, you should check your AP's vendor site and verify whether there are vendor fixes for your model. Some routers/APs have a "Check for Updates" function that does this automatically, but you may prefer not to trust (or at least, double-check) a possibly compromised router as to whether it needs updating or not. A router reporting, say, firmware version 21 and "No need to update" while the vendor site reports "Update 22 to version 21. Fixes multiple vulnerabilities" is a very strong hint that your router is either misconfigured, or has been hacked (this doesn't only work for AP/routers. This actually happened to me on a Synology DS212 NAS).
If this "someone" claiming to have hacked the "wifi" lives beyond the range of the router's broadcasts, then it is impossible for him/her to have hacked the wifi. However, expanding on what @Iserni stated, if you router has remote access through WAN enabled, and, it is a vulnerable model, one can remotely access the built-in router shell and make changes to the configuration, change passwords, boot clients from the router, and even shutdown the router, etc.
It would be a good idea to disconnect the router from the modem, then login using your router's default gateway in your browser (most commonly the default gateway is 192.168.1.1) and make sure to disable ssh or remote management. Then be sure to change the router's login password to something more than 16 characters. The longer the password, the more difficult to hack.
It's psychological warfare, their true goal is to get you scared/angry enough to cut your son's funding, taking him out of the game.
That being said, if you're running an off-the-shelf router you're quite vulnerable. Check this list of free and open-source router firmware and then either flash your router or buy a router that you can flash and flash it. On top of being more secure by the simple virtue of being vettable(much harder to hide deliberate backdoors and vulnerabilities in plain view), there are lots of added features that you can play with to optimize your setup. Ask your son for help, it's a great opportunity for a practical father-son project.
PS. This is just the tip of the vulnerability iceberg; your son's computer is by far the easier target. The fix is more or less the same, and running free and open-source software is the place to start. Here's a quick intro intro to the subject by the founder of the movement.