3

There has been some weird activity with my WiFi router after somebody threatened to DDoS me. I am looking at my WiFi router's activity logs and I don't know what I am looking for.
What happens is my WiFi turns off, for all the devices in my house, then I can't connect to the internet for 1 minute or so.
This has happened twice now after I got a call on my home phone from a Skype number that said "this is LizardSquad" and that they were going to hack me.
Could somebody tell me what I should be looking for in the logs, and how I can better secure my WiFi so that it doesn't happen again?

  • Since OP mentioned Skype, he might have been using it. Back than, Skype could expose your IP. This mostly happened in online games, especially to gamers and streamers. They got DDOSed while streaming and playing. Microsoft has changed this and now Skype does not expose the IP like before anymore. But this might have been how the attacker got OPs IP and DDOSed him. – hamena314 Apr 14 '16 at 14:09
4

A DDoS attacks basically means the connection to your computer is saturated. There are several ways to do this but the result is the same: nobody can access your router and you may possibly not be able to go on Internet (roughly speaking).

No hacking is involved, once the DDoS stops you recover (you many need to reboot your router). So this is not "hacking" as per the movies, just a way of blocking access.

You may see some logs on your router (if you have any) but they may not be obvious. If you see a lot of traffic coming in it may be a DDoS. You may also not see much in the logs, it really depends on the attack.

If you are a home user you can file a complaint with your ISP but basically you need to wait until it is over. If this is repeated then you definitely should talk to your ISP (you cannot do anything yourself to protect against a DDoS).

Since you see that there are strange activity within your LAN (short of lack of Internet access) then it may be that this is not a DoS. Your WiFi may have been breached but this means that the attacker is nearby (as opposed to a DoS which can be done from the other side of the globe). Your first measure is to make sure you use WPA2 (see the configuration of your router) and a looooong password.

If your internal network was compromised (ie. someone connected to your WiFi and possibly hacked other devices in your LAN) then the best thing to do is to reinstall the OS from scratch (particularly MS Windows and Linux).

1

If you have access to cmd/terminal/bash use the netstat command to see if there are any repeated requests. If there are, just block the ip(s), a process that's demonstrated here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.