2
0
I am having trouble with the access control of my router. It is a DSL-2730R ADSL Router.
In the 'Status - DHCP Clients section' there is always an unknown peer called Nicolas-PC. Changing the password and encryption of the wireless connection won't work: Nicolas-PC shows up just a few seconds after the router is restarted.
I even tried white/black listing mine/his MAC address. In both cases nothing changed. Even though other devices couldn't connect, Nicolas-PC didn't have any trouble (using same MAC !).
So I guess I am being attacked by a hacker? Maybe this is a weird router malfunction? How can I find information about this device and find out if it is monitoring or stealing passwords or something like that?
Gus
Posted 2013-12-13T11:50:22.143
Reputation: 159
Looks like there is malware of some sort on your computer, teasing you. – Mixxiphoid – 2013-12-13T12:02:53.303
I would like to do this, @Chenmunka, there is a simple way or I have to install BackTrack or something ? – Gus – 2013-12-13T12:23:06.420
@Gus - Please don't try to "hack" this PC it won't resolve anything. What router do you have exactly? I am unable to find any product information on
DSL-2730Rthere are a couple easy explainations for what is happening. A product website in english would be very helpful. – Ramhound – 2013-12-13T12:27:38.143@Ramhound - thanyou for your help. You are right I can't find any documentation in english, this router was made by D'link specifically for a Brasilian internet provider called GVT. It seems to be very faulty too, so I'm thinking this may be a very weird bug. The only english document I found was this portfolio like specification http://suporte.dlink.com.br/suporte/arquivos/DSL-2730R/MANUAIS/DSL-2730R_A1_Datasheet_20120514.pdf (but it does not help) Sorry for this, should have noticed the lack of english documentation before posting this question
– Gus – 2013-12-13T13:32:57.667Now I think this really is a hacker attack ! I added a MAC filter for his address and some minutes later another mysterious peer appeared TL-WR740N. Maybe this router is so bad that is easy do bypass security – Gus – 2013-12-13T13:44:02.420
Yes, I had disabled WEP already, allowing only WPA2-PSK. – Gus – 2013-12-13T13:48:04.723
@Gus - Have you disabled WPS ( Wi-Fi Protected Setup )? – Ramhound – 2013-12-13T13:51:17.543
@Ramhound - It is listed "Use WPS: No" – Gus – 2013-12-13T13:55:42.800
In Access Point Setting says: "Wireless Mode: 802.11 b+g+n" maybe I should change it for 802.11n wich is the newest protocol ? – Gus – 2013-12-13T14:01:23.737
The only thing I can say is that. I would use a bootable linux media to change the passphrase to the router. I would then watch for this rogue computer. I still think you might be looking at one of your own devices. – Ramhound – 2013-12-13T14:03:48.017
@Gus - You can change it if you want but it won't improve the security only the speed. The current mode would slow all devices to the lowest detected mode, which meants, if you had a device that only supported 802.11b then you would be throttling your network to 802.11b speeds. – Ramhound – 2013-12-13T14:05:30.057
There is no way this is another one of my devices, because I changed the password and reconfigured only my notebook. This may be a malware installed on my notebook that create virtual devices (like Oracle Virtual Box does). – Gus – 2013-12-13T14:15:08.620
@Gus - What purpose would malware have to create a virtual network adapter. – Ramhound – 2013-12-13T14:26:39.587
@Ramhound I don't know what porupose it would have =p. I added another filter for the new mysterious MAC, and now appear a dhcp cliente with MAC 00:00:00:00:00:00 – Gus – 2013-12-13T14:40:59.110
@Gus - It wouldn't serve a purpose and thus malware wouldn't do it. Your router seems like its running out of memory. Have you tried to reset its configuration? – Ramhound – 2013-12-13T14:45:11.347
if I ping the IP 00:00:00:00:00:00 acquired (192.168.1.2) the answer returned is from my notebook address (192.168.1.4) ! – Gus – 2013-12-13T14:46:41.107
1Instead of posting more comments, please include all additional info found in the comments by [edit]ing your question. Else I'm going to have to lock this comment thread—it's not meant for chatting. Thanks for your understanding. – slhck – 2013-12-13T15:52:30.353