LinuxQuestions.org
Help answer threads with 0 replies.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 01-20-2016, 08:53 AM   #1
General
Member
 
Registered: Aug 2005
Distribution: Debian 7
Posts: 526

Rep: Reputation: 31
If the configuration tool for my router points to another device, does this mean security has been compromised?


I connect my computers to the Internet using a Mercury brand router. This plugs directly into the wall with an ethernet cable. A modem is not needed, as best as I know. Near my apartment is a closet with the network switch. I assume my Internet cable goes directly to that.

Recently, my Internet connection has strange problems with SSL sites always failing to establish secure connections. Other residents in my building had no such problem.

So, I went to the IP address which I usually use to configure the Mercury router. Instead, this asks me for the password to a FAST brand VPN router. From pictures on-line, I see that this is one of the small consumer routers designed to sit on a shelf, and has two WIFI antenaes. Most of the other newer residents received one of these for free when they moved in, but I don't have one in my apartment.

Why is the IP address for the Web-based Mercuriy configuration tool going to another device? Is that normal to place a router somewhere inside the walls before the Internet plugs directly into the network switch? Is this a sign that my router or some part of the Internet connection has been hacked?

Last edited by General; 01-20-2016 at 09:00 AM.
 
Old 01-20-2016, 09:29 AM   #2
business_kid
LQ Guru
 
Registered: Jan 2006
Location: Ireland
Distribution: Slackware, Slarm64 & Android
Posts: 16,292

Rep: Reputation: 2322Reputation: 2322Reputation: 2322Reputation: 2322Reputation: 2322Reputation: 2322Reputation: 2322Reputation: 2322Reputation: 2322Reputation: 2322Reputation: 2322
Most probable explanation is a software update in the building. I wouldn't start worrying about hacking - yet.
 
Old 01-20-2016, 06:11 PM   #3
General
Member
 
Registered: Aug 2005
Distribution: Debian 7
Posts: 526

Original Poster
Rep: Reputation: 31
Do you mean, they sent a software update to all of the FAST brand routers, and my Mercury router's software was mistakenly overwritten with the FAST updates?
 
Old 01-20-2016, 08:18 PM   #4
sundialsvcs
LQ Guru
 
Registered: Feb 2004
Location: SE Tennessee, USA
Distribution: Gentoo, LFS
Posts: 10,659
Blog Entries: 4

Rep: Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941
To be sure, you should disconnect the router from the Internet, switching-off any wireless etc., connect your computer to the device through a Cat-5 cable, and go directly to the IP address corresponding to the device's maintenance port. The password and so-forth should be exactly as you left it.

You don't make it clear what "the IP address that you use" ... is. I would expect it to be a local-only "127.x.x.x" address which, most likely, should be configured so that it can only be accessed by a Cat-5 cable connection from your computer.

Routinely check the manufacturer's web site to see if software updates have been published for the model that you own, and install them immediately.
 
Old 01-23-2016, 09:53 PM   #5
General
Member
 
Registered: Aug 2005
Distribution: Debian 7
Posts: 526

Original Poster
Rep: Reputation: 31
I didn't specify the IP address, because I'm concerned it might be dangerous to list that address on a public forum. It begins with "192.x.x.x".

I found that connecting directly to the wall doesn't connect me to this FAST device.

And I pressed the reset button on my router and the issue disappeared right away and now I can configure it using this IP address.
 
Old 01-23-2016, 10:07 PM   #6
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 21,126

Rep: Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120
192.168.x.x is a non-routable address - many (most ?) home routers use addresses in this range.
I'd say one of your neighbours got a new router with the same address as you use (or reset it), and you got connected to that (via wifi) accidentally. Best to connect by SSN (name) rather than ip address, and use a cat5 cable to do the config, rather than wifi.

Last edited by syg00; 01-23-2016 at 10:28 PM. Reason: clarification re IP of router
 
Old 02-04-2016, 07:19 PM   #7
General
Member
 
Registered: Aug 2005
Distribution: Debian 7
Posts: 526

Original Poster
Rep: Reputation: 31
No, I am not connected with Wifi, but connected with the cable. I don't even have the Wifi drivers and software installed, and when I unplug the wire, the Internet stops working.
 
Old 02-04-2016, 11:54 PM   #8
MrTux
Member
 
Registered: Dec 2015
Posts: 131

Rep: Reputation: Disabled
Just factory reset it altogether
 
Old 02-05-2016, 12:49 AM   #9
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600
Ensure facts, getting right you should.
Else no basis you have, to draw conclusions on.
Don't assume but ensure.


Quote:
Originally Posted by General View Post
I connect my computers to the Internet using a Mercury brand router. This plugs directly into the wall with an ethernet cable. A modem is not needed, as best as I know.
Cable and xDSL require a modem. Providers often ship a single device acting as modem / router.


Quote:
Originally Posted by General View Post
Near my apartment is a closet with the network switch. I assume my Internet cable goes directly to that.
Have the equipment inspected instead?


Quote:
Originally Posted by General View Post
Recently, my Internet connection has strange problems with SSL sites always failing to establish secure connections.
Explain with examples how it fails and use verbose 'cURL' output ('curl -vIL https://some/site;') to illustrate?
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
LXer: Docker Delivers Security Configuration Checking Tool LXer Syndicated Linux News 0 06-01-2015 01:05 AM
Security Compromised? Facebook account - Tab3 malsysware Linux - Security 3 04-03-2015 06:41 AM
[Security] Windigo malware and SSH client compromised Nh3xus Slackware 11 03-27-2014 08:50 PM
"Other ports" not available in Security Level configuration tool CUNextTime Red Hat 3 03-11-2004 11:47 AM
Slackware Security Configuration Tool odin123 Slackware 3 11-11-2003 10:40 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 02:26 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration