Reply

Router was hacked

OldEngineer
Aspirant

Router was hacked

My network was hacked over Christmas.  I noticed because there were several devices shown in the "My Network" folder on the computer that didn't belong to me and the internet access was going crazy.  I ended up pushing the factory reset button on the router to start over and entered all new settings.  I think that solved the problem but I noticed upon on reboot that any computer using a wired connection has its corresponding LED start blinking immediately once the power has been reset and before the router is actually set up. Is this a normal occurance?  I had the router on a shelf up high before and never watched it.  I'm wondering if the hacker put some code on my computers to gather the router data before it starts up.  I have firmware version 1.3.2.126 on the R6900P router.  I'm using Windows 10 on a laptop and a desktop with current updates.  Everything seems to be operating normally but I am nervous for security reasons.  Any help would be appreciated.  Thanks

Message 1 of 3
antinode
Guru

Re: Router was hacked

> [...] I ended up pushing the factory reset button on the router to
> start over and entered all new settings. [...]

 

   What led you to blame the router, rather than the computers?

 

> [...] I'm wondering if the hacker put some code on my computers to
> gather the router data before it starts up. [...]

 

   Again, why drag the router into the discussion?

 

   If you replace this router with some other router, does the behavior
change?

 

   I can't say that the router is blameless, but a malware-laden
computer doesn't need a _bad_ router to cause problems, only a
functional router.

 

> [...] I'm using Windows 10 on a laptop and a desktop with current
> updates. [...]

 

   Anti-virus?  Anti-malware?

Message 2 of 3
OldEngineer
Aspirant

Re: Router was hacked

I use one computer to back up the other. When I was going to copy some files, I noticed a computer I don’t own listed in the “My Network” folder. I logged into the router to look at the log and found that my smart tv’s network address was constantly hitting the internet. I unplugged the tv ethernet cable and the hits stopped coming from the tv. Then they started showing up from the laptop. So I shut that off. And they quit again. Then they started coming from the network printer, so I shut that off. And they quit again. I looked in the router and found that there were two MAC addresses that weren’t on my network and put them in the blocked MAC list. The internet hits stopped momentarily. Then they started coming from the computer I was logged in as and a new MAC address showed up on the list. I put that MAC address in the block list and noticed that a software program was showing up in the “My Network” list, so I deleted the software. At that point, I shut everything off and put my old router in the network and things were ok. So I then put the 6900 back in and did a factory reset. This time I turned off the SSID broadcast, cut the power to 25% and re-located the router to the basement. This seems to be working except that I had the desktop computer powered up when I turned the router on and noticed the wired access port flashing that corresponded to the computer even before the router had booted up. I use Avast anti-virus, and I run occasional Malware Bytes and Super Anti Spyware scans. I did run scans after I found the unknown MAC address and they found nothing. I just ran an E-Set online scanner and it found nothing also. This is the first time I have had serious issues so I may have missed an important clue somewhere so any help is appreciated.

Model: R6900P|Nighthawk AC1900 Smart WiFi Dual Band Gigabit Router
Message 3 of 3
Top Contributors
Discussion stats
  • 2 replies
  • 787 views
  • 0 kudos
  • 2 in conversation
Announcements

Orbi WiFi 6E