1

I have a (maybe dumb) question for you. I was wondering if there is a way to know if my router has been hacked.

I secured it the best that I can and also made it so only the mac addresses of the devices that I know can access my WiFi.

I turned off uspn, WPS, and remote access to the router settings even though I noticed that the page won't load anymore on the device I used to set it up but it loads on my phone.

While days ago it would not load on my phone but it would on other devices but I keep seeing accesses to my social medias by devices that seem to be mine but I nor everyone else in my family used lately.

I'm afraid someone hacked my router and is using my devices remotely. How can I be sure? Would calling my ISP help? My router is from my ISP.

1

There is a good chance that your router itself has not been hacked. By default, ISP routers usually heavily restrict inbound connections from the Internet.

but I keep seeing accesses to my social medias by devices who seem to be mine but I nor everyone else in my family used lately

All social medias? What kind of access are you seeing?

My advice would be to change your social media passwords immediately and wait to see if the mysterious accesses stop.

  • I saw and 2 strange access on my facebook account made by a galaxy tablet and an iphone 6 (which I both own) plus one by an "unknown device, messenger" but the only info they show are the ipv6 addresses which seem to be dynamic on my devices (I verified) so no way to see if it were mine. I'm pretty sure the tablet was off at the time because the battery was dead plus my iphone was reset to fabric settings and not activated. Plus an access to my Instagram account by an iPhone6 but the only info it shows is the map where the log in was made and it's the same as all the other logs I made. – claire Apr 18 '20 at 17:46
  • I also failed to mention that I found a trojan on my current device which I deleted but I'm afraid that it was a backdoor that I discovered too late – claire Apr 18 '20 at 17:47
  • That's bad. What device was the trojan found on, and how did you find it? – ghrs Apr 18 '20 at 18:00
  • samsung galaxy s8 aka my main device, i found it through kaspersky, it was in a folder of an app i downloaded in 2019 but uninstalled short after, the trojan was called "tojan-dropper.androidOS.agent.au", I deleted it as soon as i found it a couple weeks ago – claire Apr 18 '20 at 18:50
0

There may not be a way to be 100% sure your router has not been hacked but there are few symptoms you can look for in a compromised router:

  • Your router login is no longer effective
  • Foreign IP addresses are listed on your network
  • You're receiving ransomware and fake antivirus messages
  • Software installations are taking place without your permission

Give your router a reboot, update the firmware, and reset the passwords, and double check your settings.

Your case seems to be more of your devices accessing your social media accounts when you or your family have not logged in.

Your devices could be compromised without your router being. If your device has a virus, it could be as simple as running a virus scan or it could be near impossible (like with root kits) to discover.

There are some programs (Little Snitch on Mac, Net Limiter on Windows) that will show you the list of all apps that are making connections to the internet and allow you to block them. They are really good, cost money, but would give you peace of mind.

Here is my guess: You may be using your social media accounts as an SSO (I use my Facebook account to login to StackExchange for example). Each time you log into those other sites, you are authenticated (and logged in) to your Facebook, Google, Twitter accounts. This may explain odd login times.

Nuclear option: Wipe all your devices and start fresh with new passwords. I'd do this if there was still any doubt.

  • what baffles me is that, as I wrote in a comment to another user, is that those devices where not in use at the time, the tablet's battery was most likely dead, while the other (iphone) was resetted to fabric settings, so I never used those to access anything where my socials were used as sso from those devices. also I almost never use my facebook as an sso and I'm pretty sure I never accessed or used any service where my that might be the case. also there are no other signs of hacked router such as what you mentioned or DNS hijacking. – claire Apr 19 '20 at 15:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.