someone changed my ssid

davej

My eircom netopia was hacked this morning.

I came back to my laptop after having a shower and noticed that I was disconnected from the router - when I checked the available networks, it turned out my ssid had been renamed to "Free Wi-fi". I had the default wep security turned on..

It didn't look like much else had been changed except security was turned off, needless to say I quickly disabled wireless connectivity and connected with an ethernet cable.

I was aware in the back of my mind that I should have tightened security (i.e at least set an admin password on the router) but to be honest I didn't think anyone would be bothered breaking the meagre security that had been set.

How should i change the settings to ensure this doesn't happen again?
I guess i should hide my ssid by default, and change to WPA - PSK ?

Is there anything else i should check to ensure nothing else has been compromised? The log files seem pretty crappy

Another thing I was wondering, the default passphrase - used to generate encryption keys is the router's serial number right ?

davej

irlrobins

1) Change SSID
2) Don't broadcast SSID
3) MAC filtering
4) use WPA and not WEP
5) Change default admin password

All of this will help protect you. The last two are probably the most significant as WEP is easily hacked and the default passwords are well known.

monkey tennis

davej wrote:

my ssid had been renamed to "Free Wi-fi"

Am I a bad person for laughing at this?

davej wrote:

Is there anything else i should check to ensure nothing else has been compromised?

Yes - check anything else on that network. Assuming the wireless and wired interfaces are directly bridged (and not firewalled from each other), anyone connected would effectively be directly on your internal network. If you're not running firewalls on your internal hosts (or even if you are - Windows firewalls are often set up to freely allow connections from hosts on the same network segment), this opens up a rake of attacks that could potentially have been performed.

Giblet

IF you had the Default SSID and Key, someone used your SSID to crack your key. Eircom screwed up big time.