i could not sleep so i had to just wipe my computers and reinstall the operating sytems (i know i should have saved the logs first but i could not wait) + i at least changed my password for the router. If anyone feels like trying to guess it with a password craker - good luck to them.

Thanks everyone for your help.

i will have to build my systems up again to be bullet proof. I was not aware of the importance of this issue. My isp never stressed it at all - and no one told me - so i guess i take a George W Bush approach to this issue:
"You fool me once, shame on you, You fool me twice, shame on me".

Well, you still haven't confirmed to us that the web interface on the router is indeed accessible from the outside. If it's not, then an attacker would need to exploit one of your internal machines before being able to try and crack your router's password.

it was accessable from a outside portscan - ports 23 telnet and port 80. i disabled remote login and set the router firewall to disallow all connection from outside. i set Very very difficult 'passwords' for telnet + web logon - if someone got that far.

my whole account has been compromised for several months. i never noticed someones (lame) attempt to route my traffic to some ip until yesterday though..this was a bigger issue than having no firewall if you ask me - and its not even made public by anyone so people can avoid this problem.

Are you really sure it allowed connections from the outside to the admin interface though? The default setting is to disable remote administration. Did you check the settings page to confirm that? If it is allowing remote administration, you should disable it.

I think you're quite possibly overreacting due to not completely understanding how to interpret the information you have.

What method were they using to redirect your traffic to an outside IP? If your router was compromised, did you reset the firmware to ensure no back doors were left in it? Did you find logs substantiating that it had been compromised for "several months"?

The logs on the router was clear. The sonofabitch that hacked me probably cleared the logs to cover his tracks.
Isnt it illegal for people to do that? Cant i complain to the police and my internet service provider to catch the people who did this?

Depends on the laws where you live. But generally speaking, the authorities would require some kind of evidence in order for an investigation to start (that is, assuming they consider your case merits one in the first place). So far, it doesn't look like you have any evidence at all. That's why some of us are not so sure about what happened here.

Actually I think the saying from G-dub was:
"Fool me once...shame on...shame on you. You fooled me. You can't fool me again."
http://www.youtube.com/watch?v=eKgPY1adc0A

Yes, highly illegal. But without logs, there's no evidence to show that anything illegal happened, let alone determine who is responsible for it.

How did you check it!? That's what win32sux and chort asked.

Right, if you've been compromised for months, then one or two days wouldn't have changed that much.. at least we would have something to discuss about.

Where, which IP, which port.

It's public, in the manual that comes with your device.

But still, your conclusions:

You might have heard about SSL. Technically they can not snoop on every kind of traffic without you getting a big fat warning on your screen.

not necessarily so... it's unlikely, but if his box was indeed owned, there are trusted store manipulations and MITM techniques that allow the transparent interception and decryption of SSL sessions.

What box are you talking about? The PC or the router? Also, please try to be specific and provide links/references whenever you make claims like this. What you've posted could be interpreted in many different ways. Yes, if his PC was owned then the bad guy could sniff his SSL traffic before it's encrypted and after it's decrypted. If the bad guy owns the router and wishes to sniff there instead, then he could also create a MITM attack by making the PC accept his digital certificate (either through social engineering or manually if he owns the PC too). But neither of these attacks would involve the decryption of the kosher SSL sessions, which is what it kinda sounds like your implying would.

I'm talking about both the router and the dude's workstation.

http://www.pburkholder.com/sysadmin/...m/SSL-mitm.php

Specifically...

For this attack to work it would require the PC to be owned. The attacker is simply pre-accepting the bogus certificate prior to the MITM attack. No decryption of kosher SSL sessions is happening, the victim is simply starting a bogus SSL session with the attacker. This kind of attack can be carried out without needing to own the router.