Wireless Hackers
 

I have noticed my Internet connection has been rather slow of late and yesterday we had guests and all computers were off. I don't know what made me look but I noticed by wireless router was lit-up like a Christmas tree! It seemed apparent my Internet connection was being used by others but my area is populated with mainly family and retired types. I remembered that a group of 'lads' must be renting a house at the back and assumed those boys had hacked into my connection which was unsecured since getting the macbook (couldn't seem to get security working). Anyway I switched off the router and got on with our evening.

This morning I re-configured the router adding security shared key on all wireless computers, all was well. Until.....a few hours ago again I experienced a 56k like connection so switched off all computers but the router was flashing away indicating someone using the wireless service.

Sat in a darkened corner I thought I need to reduce the power of the wireless output but the router menu did not show anything of this sort. I googled WRT54G (my router type) and found lots of third party firmware. Reading and researching I found a popular free firmware supplier DD-WRT ( http://www.dd-wrt.com/dd-wrtv2/index.php ) I uploaded v23 on to my router and it all worked. 5 minutes was spent slowly reducing power output from 28mW (default) to 5mW. I have 3/4 signal strength at 54Mbit/s with no apparent difference in performance. Incidentally power can be increased to a colossal 251mW approx 10X the output power as standard from the Linksys firmware.

30 minutes into using 5mW I have no gatecrashers to my Internet connection but time will tell. I can drop it down output power further if need be.

What those lads were downloading I do not know but they were using all bandwidth I had! - Not any more.

Spoilsport!;)

It's no laughing matter. If the person/people who had been using your connection had been using it for dodgy stuff like credit card phishing, massive large scale spamming, or worse stuff such as kiddie prawn, it would have been you that was liable and would have to prove your innocence. If it's your connection that's being used it would have been taken as read that it was you engaging in these activities.

It's well known that the WEP security protocol can be hacked very (VERY) easily and is as good as useless. One of my work colleagues posted a link on our internal intranet showing to a, quite frankly, horrifying, page that was essentially "Noddy's Guide to Hacking into WEP". No technical knowledge is needed, all the tools to do it for you are readily available so if you're using WEP encryption thinking you're safe then think again. By using a dictionary attack, WEP can be broken without too much effort. By using a pre-shared key as long as your router will allow and using a random character string it will make hackers life very much more difficult.

If your router can use WPA, or better still WPA2 - the WRT54G can use WPA I see - then you are as good as safe. WPA has been cracked but if you use a long, ideally 63 characters, totally random character string for your pre-shared key then it's likely the hacker will have died of old age before he can break the code.

A useful tool for generating long random strings that can be used as keys, see:
https://www.grc.com/passwords.htm

If you can get WPA working then it's the best option.

Duncan

Since my laptop died I have disconnected the aerial and use the wireless router just as a router. Make sure you change the default admin password of the router itself (often ''password'') or they might be back in and alter your security settings to suit themselves.

It is possible to disable the wireless part of a wireless router.

We are now over 24 hours since I reduced the power of my router and still no use from others. I was amazed how quickly they hacked my security but if you cannot receive the signal, it cannot be hacked!

Thanks Foxy but as my daughter comes home now and then with her laptop I find it easier and quicker to just pull out or plug in the aerial.

Out of interest, had they hacked into it when you'd set encryption to WEP or WPA? How long/random was your Pre-Shared Key?

WEP Pre-shared with a 9 digit random code based on Hexidecimal. Hacked in a short period of time!

Have you now set it to WPA? I'd advise on using WPA encryption, even with your reduced power output. There was an episode of the BBC series "The Real Hustle" I saw showing how a couple of guys in the back of a van could drive down the road monitoring wireless network signals from the road outside houses and hack in. They hacked into a guys (WEP) network and monitored his internet activity. Unfortunately, he happened to be booking a fortnight's holiday using his credit card. So, they had all his credit card details, and a nice bonus of the dates the house would be unoccupied!

Your reduced power output will have stopped the guys in a house nearby, but on its own, it may not stop the guys in a van outside. This may not apply to your particular circumstances, I'm just pointing out some potential problems for the benefit of others who may be reading this.

Regards,

Duncan

Now set security to WPA2, new firmware from DD-WRT has lots of new features. Their slogan is 'turn your $60 router to a $600 router', I think it has. Running lower power must be better for your health even if there are 'inconclusive' studies for radio transmissions.

Wireless internet still nice and quiet except for when we are using it. Interesting how the house I strongly suspected of using my wireless service has an interesting addition.

I believe the device is a waveguide for picking up wireless Internet service and it points approx 30-40 degrees away from my house.

Hmmm, wouldn't call it a waveguide, they are rectangular in shape, but it certainly looks like a highly directional receiving antenna of some sort (probably a yagi array). I suspect they have moved onto other people's networks as it's not pointing at your house anymore. With a directional receiver like this, they can probably pick up your wireless, even on its reduced power, but as you've now set the encryption to WPA2, they won't be able to crack it. They will have put this antenna up and moved it around until they managed to find somebody with no/WEP encryption on their wireless.

There's plenty of people out there who either don't bother with security on their networks at all, naively assuming that there's nothing to be worried about on a quiet residential estate, or think that as they have WEP security enabled that they are safe.

Even if the people who are logging onto your wireless network aren't using it for any malicious activity, they are stealing your bandwidth, stealing a service you are paying for. One of my work colleagues said to me while ago he'd doubled his internet speed for free
"How did you manage that?"
"I've logged onto next door's network, he's got it wide open. I can browse through all the files on his computer."
He later popped round to his neighbour and told him what he could do, giving him some suggestions on how he could improve his security.

Edit:
Here's how to make your own wireless hacking antenna
http://www.oreillynet.com/etel/blog/...p_er_chip.html
using a pringles tube, it looks like your neighbours have used a bit of drain pipe to weatherproof it.

This is a new furniture to the house in the last week. This was not a fixture when I noticed my service was being used by others. Its simply lashed together, note the nice wiring. If they know how to pick up weak wireless signals they may know how to break WPA2 encryption. I reckon they are most IT savvy. ;)

See also
http://news.bbc.co.uk/1/hi/sci/tech/1860241.stm

and another more up to date article
http://news.bbc.co.uk/1/hi/technology/7052223.stm

Nice article from the BBC, very interesting.

WPA/WPA2 has been cracked in concept, but only by using a dictionary attack. If you use the longest PSK (Pre-Shared Key) possible within your router and that string is a random set of characters, see my first reply in this thread for a link to a page that generates these strings for you, then you will in theory still be vulnerable. In practice, the hackers will have died of old age before they crack a 64 character random character sequence using a dictionary attack. Using a PSK comprised of words you can read, even if they aren't in a normal dictionary will leave you relatively vulnerable, but in reality as long as there's others within range that are using no encryption or WEP then they will move onto those easier targets first.

Not wishing to get you paranoid Steven, but the directional offset on the antenna could be to use the large sidelobes present in a crude antenna such as the one you have shown. Sidelobes are areas of high gain offset from the main boresight of the antenna. You should be safe if you're using a 60+ character random string on your PSK, but keep an eye on your network activity light just to be sure.

What can be done about people like this? They are at the very least stealing and at worst using other peoples computers and address to do what?? Child porn or anything. Is it worth reporting them to the police?

Its a scary thought people may have been using your Internet service for such unmentionables. I think its best to protect our selves. Some good information in this thread.

My router is now running on 2mW with a long WPA2 passcode. Our windows machine is showing one bar all around the house except for next to the router. My MacBook is showing two bars.

I would be surprised if the super antenna could pick me up and if it does it has a long WPA2 passcode.

Best of luck!

At 2mW, reduced from the default 28mW, the high gain antenna needs an extra 11-12dB of gain over the antenna originally used to pick up your signal. This is quite achievable. It would come as no surprise to find that your neighbours are leaving a machine running 24/7 to try and crack back into your network, make your PSK as long and random as it can possibly be. If they've been using it for a while it will be inconvenient for them not to have access to their email etc. as their email accounts will be set up to use your I.P. address. Could you move the router to the far side of the house away from the side that faces your neighbour? Stick a sheet of tin-foil on the wall facing them? Foil lined curtains?

How essential is it for you to use the wireless facility?

D.

Stephen,

Having had a sleep on it, another few things that will hinder your hackers would be, on a regular basis (suggest weekly to begin with, then swap to monthly):

1) Change your network name (SSID)
2) Change the channel number
3) Change the PSK
4) Disable SSID broadcast

EVERYONE should do steps 1) and 4) as a matter of course, though perhaps not on such a regular basis as I suggest. The SSID should be a random ASCII (not just alpha-numeric) character string, as long as the router can handle.

As you appear to have people who are determined to crack into your network, doing steps 2) and 3) on a regular basis will frustrate their attempts. Doing all of the above, regularly, at the same time will really slow them down as they will have to rescan for your network and start the cracking process all over again.

Other practical measures would be to move the router to a room further away from the side facing your hackers as I suggested above, if this is not possible, ensure that there are no windows in the line of sight between your router and the receiving antenna.

Hope this helps frustrate them.

D.

I live in a small village (100 houses). A friend brought his laptop around a couple of months ago switched it on and was able to pickup a unsecured wireless internet connection. None of my immediate neighbours have a wireless connection.

Thank for that Yelvertoft.

I also thought of the following:-

MAC address filtering
Disabling DHCP
Changing router IP address regularly

Sadly I cannot move the router across the opposite side of the house, I would need wires for that and would negate the wireless principle. The routers current position is on the back wall nearest to my attackers. There is a radiator in the way so may offer some shielding.

2mW was too low for certain positions downstairs and I have had to increase power to 5mW to get service all over the house.

How essential is wireless internet?

I use it every evening for about four hours on and off so the other 20 hours the router could be off - Hack that one!

These guys were not simply using my Internet they were occupying 90% of my bandwidth slowing me down substantially. I guess they could have been using a peer to peer service to share files illegally.

Hi there, I seem to recall a news item about three or four weeks ago about someone being charged or possibly convicted of doing this to neighbours. He was using a laptop and logging into insecure WiFi points - so the police should take some action.

When someone taps into a poorly protected wireless router, using bandwidth that someone else has paid for, it's wrong.

When someone sculks in the hedgerows to sneak a free viewpoint to enjoy the entertainment that thousands of others have paid to support it's a creative use of available conditions to obtain good light?

Sounds a little like hypocrisy to me. In my view both are equally wrong for exactly the same reasons. Seeing a proponent of airshow freeloading getting steamed up about people freeloading off him appears to be karmic justice.

Maybe they could not be bothered going downstairs to turn their router/hub on so temp connected to another :P