1

I'm using a ISP with router of Linksys E900 model. During the last three month someone anonymous has been using my internet. I can see the MAC address using different IP address. Right now it needs to stop. How can I trace the customer and launch an complaint against them?

  • 5
    You can't even know if the perpetrator hasn't spoofed their MAC address, which is likely the case. You would need a portable wifi directional antenna to find the approximate location of that person, but what do you do when you find it? The real solution is to better protect yourself and your equipment. If you see someone hacking you, you don't go ask around how to find who it is, you block them! – Julie Pelletier Sep 23 '16 at 5:58
  • Since you know the MAC address used, you could start by blocking it from connecting to your router, just before you change your wifi security key and make sure it uses WPA2. – Julie Pelletier Sep 23 '16 at 5:59
  • I edited your question to make it clearer, but I just realised that I asumed you were using the Wi-Fi on your router. Are you doing that? If not, I apologize for messing up your question. – Anders Sep 23 '16 at 8:00
  • I believe it is you who are the customer here. I do not think it is wise for you to send in a complaint against yourself. – Dog eat cat world Sep 26 '16 at 15:28
2

A simple solution if the MAC address is not being spoofed, add the MAC address to the Router's blacklist.

If it is being spoofed, then you should change the network name (SSID) on the router, change the password etc. and make the network hidden (e.g. turn off broadcast SSID).

Once it is hidden you would need to be able to connect to it by entering it manually in your wifi setup.

| improve this answer | |
  • Just a note to say that "hiding" the SSID really doesn't. All it does it make it harder to see. A determined attacker will use a sniffer, the SSID is still visible in certain packets. – Julian Knight Sep 25 '16 at 16:56
1

I don't think you will be able to find the person introuding on your network using the MAC-address. The address could be spoofed (i.e. set to something random by the freeloader). If it is not spoofed in theory the company manufacturing the network card with the MAC-address used by the freeloader could know who they sold it to, but you don't even what company to ask and even if they did there is no way they would answer your question. So the MAC-address doesn't help you very much.

What could you do instead? I see two options:

  1. Use a directional antenna to find out where the signal is coming from. (I assume here that the freeloader is using Wi-Fi.)
  2. Use a program like Wireshark to look at the freeloaders traffic and see if you can find any information in it that helps you identify her.

But what do you do once you know who it is? That person is not a "customer" of your ISP, and there is no one you could lodge a complaint to. You could call the police - hacking someones Wi-Fi is illegal in most parts of the world - but I doubt they would give it hight priority.

No, tracking the person down is a lot of effort for very little gain. If I were you, I would just focus on making sure the freeloader stays out of your network in the future. Here are some tips:

  1. If you yourself are not using the Wi-Fi, just disable it. (If you disable Wi-FI, you can ignore the below points.)
  2. Change your admin password for the routers config page. Or perhaps do a factory reset on the router if you suspect the freeloader has been messing with your settings.
  3. Make sure you are using WPA2.
  4. Change your Wi-Fi password to something more complex than password1.
  5. Disable WPS.

If you want to read more about how to secure your router, check out this page.

| improve this answer | |
1

You could try to collect as much information as you can about this person,

you should wait for him to connect and then use nmap:

sudo nmap -O 192.168.1.129   // 192.168.1.129 <- his current IP 

if you are successful you could detect:

  • MAC with type of pc (es:Apple), unless he has changed the MAC (with macchanger )
  • Device type (es: phone)
  • OS : (es: Apple Mac OS X 10.7.X)
  • open ports (es: 62078/tcp open iphone-sync), with this you could try emm.. other path.. more.. invasive.. but not advised

After that you should :

  • change you password!
  • add a MAC filter (whitelist) but still he could pretend to have your MAC
  • check if the router is vulnerable to Pixie Dust Attack
| improve this answer | |
1

You appear to have a way to identify the culprit - is that by the addresses they connect to?

If so, I recommend redirecting those addresses to another page that indicates that they have been discovered and that you are monitoring them and actively tracking them. This would be pretty simple to do if the things they are connecting to are not used by legitimate users on your network.

| improve this answer | |
0

In your case tracing the owner of that MAC address may not be a viable option since MAC address can be spoofed. (as pointed by @Julie Pelletier in comments)

There are few latest pretty easy to exploit attacks that can crack the password of the router even if its WPA2.One of them is Pixie Dust Attack. So, even if you change the password, the attacker can crack it again in few minutes.

Also, I suggest you to do a few things in your Router.

  1. Use WPA2 in your router.
  2. Use MAC Address binding in your Router.
  3. Disable WPS on your router.

Some,additional information on Pixie dust attack can be found here

| improve this answer | |
-1

You can get the MAC adress of the anonymous by sending a ping containing his IP adress or his SSID and when the ping will be successful ,you must send the arp command line "arp -a" containing the ip adress of the anonymous (for example : arp -a 192.168.11.2 ).This command line will give u the MAC adress which you will add it in the denied MAC adress list.

| improve this answer | |
  • What if the mac address is spoofed ? – storm Sep 23 '16 at 15:52
  • if u mean his own MAC adress,he can exchange it . – dhouha zribi Sep 23 '16 at 19:16
  • The question states that the OP already knows the MAC, so instructions on how to get it is not very useful. – Anders Sep 25 '16 at 16:38

Not the answer you're looking for? Browse other questions tagged or ask your own question.