Router Settings Changed

[He's Dead Jim]

This am around 02:00hrs, I booted up the machine to check the email, initially the lights and connection showed that i was connected, but upon launching mozilla Firefox, the router led for PPP went out and the connection icon in the systray showed the red/yellow exclamation mk.

So i did a reboot of both machine and router, but nothing changed

So I went off to bed, but when i got up today It was still down,

I phoned the ISP, and they said, we have run the checks, and your ISP username/password on your router is missing... open your router setings and put them back, then it wil work,

So on entering the correct settings, I also noticed that the WLAN was enabled, now everything i have here is wired, no WiFi,

How could this have happened? I always disable WiFi.

Could there have ben a "driveby" on my router?

Any suggestions appreciated

PC P4 desktop W7

Router Bilion 5200g

[ybrett23]

was it setup with the default username and password?

[He's Dead Jim]

yes...

[ybrett23]

and you had wifi turned of at the time?

[He's Dead Jim]

yes

[cork1958]

Sounds dumb, but any firmware or some kind of update lately, or have you hit the reset button on router?

[ybrett23]

Sounds dumb, but any firmware or some kind of update lately?

i was thinking the same, if wifi was off then for someone to access it they must have been on the internal LAN ie:wired

[cork1958]

i was thinking the same, if wifi was off then for someone to access it they must have been on the internal LAN ie:wired

Please note I added reset router to that quote. :)

[He's Dead Jim]

I didnt reset, and yes, the WiFi was deffo off,

The ISP tech said, your username and pass are missing

[ybrett23]

does anyone else have access to the router or pc's connected

?

[cork1958]

Somebody that has access to your info was on your computer/network then! :(

[He's Dead Jim]

I'm the only person in teh house,

There are unsavoury characters living very near here, looks like I'll need to reset the router password from admin to something slightly better....

[cork1958]

I'm the only person in teh house,

There are unsavoury characters living very near here, looks like I'll need to reset the router password from admin to something slightly better....

Easiest fix!! :)

[ybrett23]

without wifi on, it had to have been done INTERNALLY

[He's Dead Jim]

Thats it fixed :) thanks chaps :)

without wifi on, it had to have been done INTERNALLY

Yup I reckon some ones been snooping,

[ybrett23]

no problem

[He's Dead Jim]

Might be time to reformat this machine?

[+BudMan MVC]

What more likely here?? Your machine was compromised and someone accessed it remotely to change your router config to state where in it no longer has internet access, and would there for cut off their access to your machine. And also turned on wireless.

Or that someone accessed your router via the internet, or connected to your wired lan somehow -- and then again broke internet access.. What would they gain from such a thing. Now using your internet access for their own use, sure.. But removing your username and password so that device does not have internet access - why would anyone do this?

Or is it more likely that the router was reset be it a power glitch? Bug in the router on a crash and reboot, etc.

I have to vote for reset which would by default turn the wifi on, and also by default would not have username and password for PPP connection, etc.

[He's Dead Jim]

You may well be right BudMan, I appreciate the input.

The episode has obviously prompted me to password protect the router, so there's some positive....:)

[+BudMan MVC]

Yeah changing the default password good idea! And making sure router is not able to be remote admin from internet -- normally this is defaulted to be off, and you have to specifically allow it. Not really a good idea unless you have specific need for it, and router provides some way to limit this to say the specific IP/network you will be remote admin from.

If you have quite a few things configured like port forwards, changes in dhcp server, etc. You might want to look if your router has a backup config option - this way you can just reload your config in 2 shakes if happens to happen again.

I had a buddy recently where his router was reset to default, wireless open, etc. He swears he did not reset it - but when I got there it clearly had been reset since password on router was default which I had changed, and the wireless settings were default, etc.

He says he might of bumped it while he was moving his machine, etc. But that should not hard reset the router - you normally have to hold down the hidden little button for a 10 to 30 seconds while you power cycle, etc. But sure it could be a bug in the router, etc.

[Arachno 1D]

What protocol are you using on the router WEP or WAP/WAP2?

If its the former its easily hackable in a couple of hours if not it may be your router is over heating/failing and reset to defaults.

[offroadaaron]

^^ He isn't using Wireless.

I'm not saying this happen but sometime, sometime configuration files get corrupt and the configuration in turn doesn't work. I have been working with Billion routers for 5 or so years I have seen things like this happen, but only very rarely.

[Japlabot]

Routers reset their config for no reason sometimes. Sometimes there is a bug/glitch in the firmware, maybe a power event, it can happen while it is powered on, it can happen when it boots up after a power cycle. I have seen this many times as an IT consultant. Nothing to be alarmed about, it is highly unlikely that you were hacked especially if you keep the default Windows Firewall enabled on your PCs. I am more alarmed by the amount of misinformation that you can get on Neowin these days where the first page of the thread is nothing but other people saying that you have been hacked. There used to be a time when this didn't happen.