0

In my question, which was marked as a duplicate, I got suggested posts to refer to. I`ve read all of them; and my router options are already matching the suggested options: as using WPA2 with AES, and WPS and UPnP are turned off. If I change the username and strong password I am using, and someone has managed to bypass them, he can do this again.

I am suspecting that someone is illegally using my router WiFi. Is there a software that can be installed on my computer (running Windows XP, and connected by a cable to the router) to identify the devices connected wirelessly to my router, which does not have the feature to list devices connected to it?

Or a way to prevent devices other than those in my home (laptops, cell phones, tablets) which are connected wirelessly to my router?

I did not find the answers to these questions in the suggested posts.

  • 11
    I think that once you mention Windows XP as your primary computing Operating System, the community is no longer going to be thinking that the router is the vector of concern. – schroeder Aug 21 '18 at 6:17
  • 4
    Your options for detecting or preventing connections are completely dependant on the options that your router provides. If your router does not have the ability to list what is connected to it, which is a most basic function, then I have low hopes that there is anything you can do but to change the hardware. – schroeder Aug 21 '18 at 6:19
  • Many perceptions of Wifi being "hacked" that "slow down" the network, is caused by interference of 2.4Ghz WIFI signal, which the device keep scrambling to switch to the new channel when it clashed with the neighbourhood wifi signal. Using a 5Ghz Wifi will solve most interference issue as it is less likely to penetrate wall from a distance. However, most old smartphone does not support 5Ghz Wifi – mootmoot Aug 21 '18 at 7:34
  • There is no slow down of the network performance. I suspect the hacking because with absolutely no devices connected to the router, I observed that the network and wifi indicators are flashing very rapidly as if someone is heavily downloading something. – Hany Aug 21 '18 at 8:42
  • 1
    1) I think it would also help to know the exact type of router in question. I have never seen a router that has no feature to list connected devices. 2) Is the possibility of a hardware/software defect already ruled out? – SeeYouInDisneyland Aug 21 '18 at 12:04
1

There is a full possibility that someone maybe using your wifi illegally. If you have changed your password to a safe one and if he is still able to bylass them in no time then that only means that he has hacked your WPS pin. It is a pin used to get your password after you have forgotten them so no matter how many times you change your password he will be able to get your password. It is not possible to change your WPS pin as it aldready comes with the firmware but you can try turning it off in your router settings. And please check your WPS service by a third party app even after turning it off coz some routers indicste that they are off but it is still on.If your router is a very old one i suggest getting a new one.

Now with regard to providing access to limited set of devices you can setup mac filtering it is a function which allows you to setup a specific list for authentication.

And also make sure both your router and computer os are updated regularly.

I strongly recommend switching to windows 10 as the nsa exploit for windows xp is easily available to the community.

  • Thank you for your comment. Please tell me how can I setup mac filtering to setup a specific list for authentication? Or where to find how to do so? – Hany Aug 22 '18 at 4:53
  • 1
    You can find the option of mac filtering under the security tab in your routers settings. But in some routers the case may be different, once you get to know yourac address just add it to the whitelist or if you know the mac address of the person who is illegally stealing your router's access just add his mac to the blacklist then he should be kicked from the network. Moreover you can get the list of the mac address of the devices connected to your router through the DHCP option or connect clients option. The option name may vary for individual routers – THE YOGOVO Aug 22 '18 at 9:10
4

I am suspecting that someone is illegally using my router WiFi.

While there might be someone doing this, nothing in your question provides any evidence. Note that it is not uncommon that users suspect hackers when strange behavior happens even if there are other and sometimes simpler explanations possible.

Is there a software that can be installed on my computer (running Windows XP, and connected by a cable to the router) to identify the devices connected wirelessly to my router, which does not have the feature to list devices connected to it?

If your router does not provide such functionality no software can ask the router to provide these information. You could analyze your network though for suspicious activity, i.e. if systems connect to your computer which you don't expect to etc. What to do exactly here depends on what you suspect the hacker to do, which essentially boils down again to what makes you think that there is someone using your router in the first place.

"...running Windows XP..." - if the rest of your network is as secure as your long outdated and no longer supported operating system than it is not unlikely that somebody is misusing your network though.

Or a way to prevent devices other than those in my home (laptops, cell phones, tablets) which are connected wirelessly to my router?

That's what you do exactly by following the recommendations in the questions+answers provided as duplicates to your previous questions, i.e. having a secure router (i.e. current firmware, no backdoors ...) and setting it up in a sane way (WPA2, strong passphrase, strong admin password, no access from outside ...).

And note that a strong WPA2 passphrase does not help if an insecure device is connected per cable to the router (or per WiFi but knows the password), like it seems to be the case with your Windows XP system. This is especially a problem if these insecure devices are used for administration of the router.

  • Thank you for your comments. I suspect the hacking because with absolutely no devices connected to the router, I observed that the network and wifi indicators are flashing very rapidly as if someone is heavily downloading something. As for your suggestion of setting up the router for (no access from outside), how can I do this. This is what I want. – Hany Aug 21 '18 at 8:47
  • 1
    @Hany: there is no generic way for this. Most routers don't have access from outside in the first place. As for the rest - please consult the documentation of your router or contact the vendor or in case of routers given by the provider your ISP. – Steffen Ullrich Aug 21 '18 at 9:00
1

The quick way is to do a factory reset on the Wi-Fi router and start from scratch. Set a new Wi-Fi Password abd new admin password.

TL;DR the long way:

You need to make an inventory of all YOUR devices on the network. Every printer, NAS, smartphone, pad, IoT, Wi-Fi extender etc. - get all the MAC and the corresponding IP addresses. Tools like arp, nmap will help you. MAC is often next to the model and serial number.

Then go your Wi-Fi router. If you can, change the user name of your admin user and of course the password. Make it complex (at least 12 characters, numbers etc.). Then change the Wi-Fi password and write that down.

Turn off DHCP on the Wi-Fi router. This will prevent any wired connection, even the one you use to connect to the Wi-Fi router. Then set a fixed IP address on your computer with the gateway pointing to the Wi-Fi router. You can now use the wired connection as you have currently from the DHCP.

Now reboot the router. At least your Wi-Fi connected devices should not be able to connect.

The DHCP will no longer give IP addresses. You should still be able to connect since your IP address is fixed on your PC. On your router you should now only see your PC connected.

Now turn DHCP back on. Configure the address range to different values: i.e. If your range was from 192.168.0.11 - 49; set it to 192.168.0.51 to 61. Make the range as small as possible. There is no point to set it to 128 if you only have 4 devices. Set the lease time to something in the order of 4h.

Now setup on each Wi-Fi device you found the password. You should see those devices on the Wi-Fi as connected. Since you also see the MAC address setup a MAC address filter and only allow your devices on the Wi-Fi router. Block every other MAC address. That will eliminate rogue connections.

And yes, somewhere along the line you should update XP to Win 10.

  • Thank you for your comment. As for your suggestions to (Configure the address range to different values) and to (only allow your devices on the Wifi router), how can I do that. I suspect the hacking because with absolutely no devices connected to the router, I observed that the network and wifi indicators are flashing very rapidly as if someone is heavily downloading something. – Hany Aug 21 '18 at 8:56
  • 1
    nmap would also be a good start to see devices in the network. – SeeYouInDisneyland Aug 21 '18 at 12:06
1

I wanted to add a cool direct approach I use pretty frequently that uses their own tools against em!

You could start logging with airmon-ng (from the aircrack-ng suite). One thing airmon-ng does is show the Base station SSID and it shows the clients connected to that SSID.

Even if they have a static IP (and wont show in DHCP), you can compare the SSID's of all clients airmon shows, to the SSID's your DHCP handed out, as airmon operates on the physical level, et voila!

If anyone is associated to your AP, this way, you'll know.

A small note on this approach

You might want to try logging from as close as possible to your AP. You will need to be in range of the attacker for this approach to work. By putting your logging machine close to the hacked AP, you can be sure that the attacker's signal will be strong enough to reach you.

  • 1
    Thank you very much for your answer. I will check this airmon-ng package. – Hany Aug 22 '18 at 5:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.