Two days ago I installed a new router. It was a new TPlink AC1900. I established a password for the web admin, went through the quick setup questions, changed the IP ranges for the DHCP service from the default 192.168.0.1 to 192.168.1.1 to match my prior router. Those were the only changes I made as far as I could tell. I didn't change or turn on port forwarding or set up VPNs or gateways. I also upgraded the firmware and downloaded the tplink app onto my ipad (but didn't create a cloud account) and made sure the app could connect ok.
Among the devices on my LAN is my main desktop computer which runs linux mint version 18.3. The VNC/desktop sharing service is enabled but doesn't require a password (one of many problems this experience has taught me). On this computer I also have a libre calc file, not password protected (another problem), that contains all my website usernames and passwords. This password document does not have a filename that would suggest it was a file containing passwords, so it's possible it was already open when I got hacked because it'd be amazing if they guessed they should open that specific file.
This morning when I woke I turned on the monitor (I often forget to turn off the computer for the night) I noticed activity on the screen. On the task bar were a 15 or so open folders, all open to my home folder. Cinnamon melange debugger was open. A desktop sharing session was active to an external IP address I didn't recognize. My libre office password file was open, and in the last rows of the spreadsheet the following had been typed: cmd.exe /c PowerShell -ExecutionPolicy Bypass ...blah blah blah a bunch of other stuff...
and the following was being typed when I realized what was going on and pulled the network cable:
rcmd.exe /c PowerShe
I assumed this was the result of someone having exploited my new router somehow. I logged in using the password I had created at install and under "Advanced Routing" there was an entry for a gateway IP address I didn't recognize. My IP Address is currently A.B.C.D but the gateway listed had an IP with a similar but not same address A.B.C.Z. No ports were being forwarded to explain how my desktop was being accessed.
I'm wondering how this all happened. I suspect some sort of script/bot found a way to log into my desktop via VNC but didn't realize I was linux rather than windows and that's why it was typing those commands into my libre calc document instead of a command line. But how did the script get behind my router when I hadn't set up any port forwarding? I discovered there is a router account named admin with password admin that I didn't realize was there (the web interface using a separate password), but my router does have the "remote management" option enabled.
I already know I need to add a password to my VNC server and store my passwords in keypassx or some other password-protected, encrypted document. I have reverted to my old router for now.
- Based on what I've written, do you suspect the new router was the vulnerability or is it my linux mint computer?
- Is there a way to see on my mint computer what specifically was accessed or how it was accessed? I left the computer on after I unplugged the network.