LinuxQuestions.org
Latest LQ Deal: Latest LQ Deals
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 07-20-2006, 08:33 AM   #1
tebucky
Member
 
Registered: Mar 2004
Posts: 89

Rep: Reputation: 15
Linksys router hacked?


I have recently checked my DHCP clients table on my WRT54G Linksys router and I notice an unknown client attached to my network. Here are the details

Host Name: root-0
IP address: 192.168.1.113
MAC Address: 00:14:6C:39:85:CE
Expires: 15:07:27

I'm running a linux box, windows box and wireless laptop, a storage device and a VOIP phone.

I have absolutely no idea what this root-0 host is, it is not something I am running. I deleted this entry from the clients table yesterday but they have reappeared today. Can anyone tell me what is going on?

Thanks
 
Old 07-20-2006, 08:38 AM   #2
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,417

Rep: Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985
sounds like someone broke your wireless security... what are you using on it?
 
Old 07-20-2006, 08:58 AM   #3
gkiagia
Member
 
Registered: Oct 2003
Location: Greece
Distribution: Debian sid
Posts: 248

Rep: Reputation: 30
Quote:
Originally Posted by acid_kewpie
sounds like someone broke your wireless security... what are you using on it?
That's right. Disable wireless and see if it appears again.
 
Old 07-20-2006, 09:08 AM   #4
tebucky
Member
 
Registered: Mar 2004
Posts: 89

Original Poster
Rep: Reputation: 15
I'm using 128 bit WEP Encryption. I find it somehwat hard to beleive that I have been hacked based on the fact that there are multiple "open" networks in my area and the sheer fact that I'm in a very very remote neighborhood. But then again, you never freaking know.
 
Old 07-20-2006, 09:14 AM   #5
Matir
LQ Guru
 
Registered: Nov 2004
Location: San Jose, CA
Distribution: Debian, Arch
Posts: 8,507

Rep: Reputation: 128Reputation: 128
Are any of your neighbors within range of your network? They may have decided they'd rather not pay for broadband.
 
Old 07-20-2006, 09:16 AM   #6
tebucky
Member
 
Registered: Mar 2004
Posts: 89

Original Poster
Rep: Reputation: 15
I think I figured it out, it is some storage device attached that I didn't initially think was assigned this IP. Thank you to everyone that provided their 2 cents. It was greatly appreciated.
 
Old 07-20-2006, 09:18 AM   #7
BaltikaTroika
Member
 
Registered: Sep 2004
Distribution: Debian 4.0, Ubuntu 6.10, Ubuntu Server 6.06
Posts: 134

Rep: Reputation: 15
Quote:
Originally Posted by tebucky
I find it somehwat hard to beleive that I have been hacked based on the fact that there are multiple "open" networks in my area and the sheer fact that I'm in a very very remote neighborhood.
Don't forget that a lot of people like to do things just because they can!
 
Old 07-20-2006, 09:28 AM   #8
jschiwal
LQ Guru
 
Registered: Aug 2001
Location: Fargo, ND
Distribution: SuSE AMD64
Posts: 15,733

Rep: Reputation: 682Reputation: 682Reputation: 682Reputation: 682Reputation: 682Reputation: 682
An FBI agent attended a conference and gave a presentation on wireless security. As he was speaking, to other agents attempted to break into a web-128 wireless network. It took them 3 minutes.
 
Old 07-20-2006, 09:51 AM   #9
tebucky
Member
 
Registered: Mar 2004
Posts: 89

Original Poster
Rep: Reputation: 15
Updated commenced! Thanks everyone for igniting the flame from within.
 
Old 07-20-2006, 04:51 PM   #10
Capt_Caveman
Senior Member
 
Registered: Mar 2003
Distribution: Fedora
Posts: 3,658

Rep: Reputation: 69
Quote:
Originally Posted by tebucky
I think I figured it out, it is some storage device attached that I didn't initially think was assigned this IP. Thank you to everyone that provided their 2 cents. It was greatly appreciated.
A nice way for diagnosing these issue is to look up the rogue MAC address by its vendor. For the above mac, it belongs to a netgear device. While MACs are easily forged, it can often give you a starting point for where to look.

Link: http://www.coffer.com/mac_find/
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
linksys wireless router & linksys wmp54g wireless card rude_reality Linux - Wireless Networking 13 05-25-2006 06:01 AM
Linksys router kuplo Linux - Networking 3 01-13-2006 02:23 AM
Linux hacked onto $20 wireless 802.11b/g router Rayston Linux - Wireless Networking 3 11-12-2005 10:15 PM
router problem with linksys router scheiße_comp Linux - Networking 10 08-20-2002 10:18 AM
Linksys Router hubergeek Linux - Networking 4 08-14-2002 04:48 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 11:10 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration