The new forums will be named Coin Return (based on the most recent vote)! You can check on the status and timeline of the transition to the new forums here.
The Guiding Principles and New Rules document is now in effect.
Is my friend's wifi being leeched on?
Ataxrxes
HellnationCursed EarthRegistered User regular
HellnationCursed EarthRegistered User regular
My friend told me yesterday that he had received a notification from their ISP that they had been going over their 250Gb cap for the last few months and if they continued to do so that they would be charged for the overages. They had no idea that they even had a cap and their usage pattern has not changed recently so the first thing I thought of was that perhaps someone was leeching off them. They have their network password protected but we all know that is easy to circumvent for anybody who knows what they are doing. I tried to log into their router to turn on logging and check for strange ip addresses but the default password had been changed so I couldn't see anything yet (they are going to call the ISP and try to get the password info for the router).
While I suppose that it is technically possible that they could be going over unwittingly, they showed me the email from their ISP and it said that they had already used 201Gb of their 250 and the month is not even half over so that really raised a red flag. Any opinions, and/or advice on dealing with something like this?
While I suppose that it is technically possible that they could be going over unwittingly, they showed me the email from their ISP and it said that they had already used 201Gb of their 250 and the month is not even half over so that really raised a red flag. Any opinions, and/or advice on dealing with something like this?
0
Posts
In any case, I'd change the WiFi password (and possibly the SSID too). Also, most wireless routers support MAC address filtering, add in all the devices that should be using it and turn that feature on.
Well if WPA2 is on, the only (realistic) way for a leach to be on there is if they were told the password. But yeah, WPA2 + MAC filtering is the strictest answer to this problem. Assuming the router is reasonably common, they can look up the default admin name/pass online by searching for the model number.
It'll probably be a pin-hole on the back or bottom.
Also, once you regain access to the admin interface, change the settings to only have the admin console accessible via wired connections. If wireless is allowed and the default password is on, its trivial for someone to get into it.
Have a look there for any devices that are connected that could be suspicious.
Other than that, as mentioned, change WPA2 key and lock it down by MAC addresses
Honestly, if this network was already secured and been compromised the only thing that might really work is the MAC address restrictions and that's if the guy hasn't already noted the "honest" MAC's on the network. I suppose if you have the option turning down the transmit power might also annoy him, or at least make it inconvenient enough for him to look elsewhere.
If this is somebody who really knows what they're doing it'll be difficult to them stop yourself. You could try and get the police involved but that sounds like it'd be a nightmare.
Getting the police involved could end in some overzealous goober seizing both your router and computer as "evidence."
Yea, that's option b for the nightmare. The other is trying to find somebody, anybody who has a damn clue what you're talking about in the police station and is willing to try and help. I'd be surprised if it ended up being a profitable path to go down but the option is there.
I can has cheezburger, yes?
I just want to point out that WPA2 is easily crackable via bruteforce thanks to Reaver, if the router has WPS available/enabled. If possible, I'd shut off WPS entirely - though apparently on some routers this isn't possible on the standard firmware.
Yeah I forgot about WPS. Turn off WPS!
I don't think that'll fix anything? They just need to secure their network.
If it's coming out of the company's machine, it will get them a new machine and not fix the problem of somebody trying to use their internets in ways they don't understand.
If it's a problem with something they can't find running on their PC, back to doing literally nothing.
True, but it doesn't sound like they've done any of those things.
Step one needs to be locking down the router and putting on a MAC filter if you haven't already.
8gs a day for 31 days is 2gs shy of 250gs and that's when we press it to extremes, because I assume that 4gb day was a weekend.
I'm not arguing this to be a jerk, but it just sounds pretty weird to me that a 250gb cap would make them want to change providers.
I can see a family having possible issues, but not 2 people - the fact that they think switching ISPs will fix this issue is silly, albeit moreso than being mad at the cap.
Especially if the leecher is pirating shit and they land in hot water because of it.
Then again, that's not really the topic of this thread, so I guess I'll drop it hereafter.
Just use a password or passphrase with sufficient entropy as to be hard to crack. Be careful about words that make sense next to each other or commonly substituted characters. The massive password dumps over the past couple years made dictionary attacks smarter. It is all about completely randomly generated passwords of at least 12 characters, or a nonsensical passphrase longer than that.
I think your partially wrong here. It's all about obscurity rather than pure defense. Sure, if I know where you live and I want to hack your network, then hiding your SSID isn't really going to stop me. On the other hand if I am just some dude looking for free internet I am not going to try and scope out all of the unbroadcast networks just for kicks. I'm just going to hack the first one I see, probably with an SSID of linksys.
I don't disagree, but if I'm already going to the trouble of intercepting wireless packets to get the hash for the password, spending hours cracking it or paying some money for a cluster, grabbing the packets to reveal the SSID or spoof the MAC is no big deal. If I'm just some dude looking for free internet I'm probably not going to know how to do all this.
I think people are confusing WEP with WPA/WPA2, and vastly underestimating the skill needed to hack the latter. If a strong password is in place and WPS is disabled I'm not even aware of a viable attack to break WPA2 currently. I've got a publicly broadcasted SSID with a more than overkill password on my WPA2 network and I would be astounded if somebody with a sizable EC2 cluster was able to get on my network without my permission.
Even as a security researcher and hacker by trade if I'm looking for free internet I'm just going to find somebody with an unprotected network, or somebody with the default SSID because they're probably using the default password too. Attempting to crack WPA2 hashes is a waste of time unless there is something on that network I want that's more important than free internet.