2
2
Recently, security cameras with livestreaming got installed around the house. The cameras are connected to the router and uploading to the company's servers, and then I can watch the streams live on my phone.
The person who came to install the cameras changed a lot of the router settings (I think he did some kind of reset, cause my forwarded ports were gone, and the saved template as well), and also changed so that username and password was not needed anymore - anyone connected via WiFi could access the admin page by simply visiting 192.168.1.1
(sounds like a huge vulnerability, and thus incredibly suspicious).
Now in the middle of my gaming session I noticed the router settings suddenly changed, because I had enabled UPnP after they removed my forwarded ports, but now it is disabled again while I am trying to play. I went to the router page to see what they had done, and I see that username and password is required once again, but they have changed it so I can't even access the page myself now. They essentially hijacked the router.
I want to find out what they are up to. My computer is connected to the router and I have physical access to it. However, I do not just want to physically reset the router and cut their access unless that enables me to see what they have done. In other words: I want to catch them red-handed.
Also, when they have full access to the router, can they eavesdrop on HTTP? HTTPS? Are there perhaps any other security issues I haven't thought of?
The router is a Thomson Technicolor TG799vn v2.
I installed a program called Capsa and perhaps it is the perfect tool for this job. However, my lack of knowledge is too great to do a proper analysis.
This is going to depend entirely on what router you have and what its capabilities are. You won't be able to do much of anything without gaining admin control of the router; if you can do an admin password reset without completely resetting it, you can look at what changes were made to its settings to maybe tell more about what's going on. But you're probably going to end up doing a factory reset on it, and starting over. Also, check your computers for malware/changed settings/etc. – Gordon Davisson – 2016-09-23T20:31:47.977
1Oh, and a "security" company that leaves your router open? That's very very bad. I would not trust anyone who'd do that to secure anything for me. – Gordon Davisson – 2016-09-23T20:33:46.110