Am I getting hacked?

[PANTyRAiD]

Hello all,

I just recently installed Bit Defender. Its an awesome piece of software. I have it set to inform me when ever a new device connects to my wireless adapter (which is password protected). Ever since turning that feature on, I get random pop ups that a device IP ***.***.*.4 (stars to protect my IP address) keeps connecting to my network, when all my other computers and everything are off.

What or who could this unknown IP/Device be?

Is there a way I can find out who or what that is?

Can I block it from entering into my connection?

Thanks.

[cpiaaq]

Maybe a phone?

[PANTyRAiD]

Possibly. How can I find out?

[baz152]

Reset your routers IP address and your password then you should have no further problems.

[Merc1138]

Let me guess...

192.168.1.4?

The private LAN IPs issued by something like your router are pretty much useless for anyone to "hack" you over the internet. Just reset the password for your router(change the network name and key), then whatever it was won't be able to connect anymore. Problem solved.

Want to be more secure? Your router should have an option to disable broadcasting the SID. This means that unless you specifically know to look for your network name, it won't just appear in a list of available networks in range. Also make sure you aren't using WEP encryption. Do that and you'll stop 99.9% of any "hackers"(most of which are probably just looking to steal free internet, the rest would likely just move onto someone else's network that they can see without any extra utilities. If someone is seriously targeting you, you wouldn't be able to stop them).

PS. I know this might sound.. "techno-snobby" but I highly advise against installing even the popular security applications(beyond your basic antivirus software and stuff like that) until you have an idea of how TCP/IP and ethernet/wifi networking really works. The reason I say this is because so many applications will show false positives to people who don't know enough, that they end up freaking out thinking that someone is trying to hack their Gibson when it's mostly benign garbage from the internet.

[nrvnqsrxk]

I would set up a MAC address filter so that only devices that you specify can connect to your networks. When a buddy with a laptop comes over, just add his or turn it off while he/she's there. The former option is obviously more secure, but idk if you're gonna be throwing LAN parties.

Merc, I'm interested in learning the basics as well. Do you have any resources you would recommend? Or is Google my best friend in this case?

[DaveInOroValley]

If you use MAC Address filtering you wouldn't have to worry about it. Anyone who try's to hack that has way too much time on their hands and isn't worried about your network anyway.

[Merc1138]

I would set up a MAC address filter so that only devices that you specify can connect to your networks. When a buddy with a laptop comes over, just add his or turn it off while he/she's there. The former option is obviously more secure, but idk if you're gonna be throwing LAN parties.

Merc, I'm interested in learning the basics as well. Do you have any resources you would recommend? Or is Google my best friend in this case?

Yeah, google and wikipedia. Do some searching, read the articles, check out the referenced source material, and then check out links to other articles within the one you started on. As long as you're willing to keep looking up terms to figure out what they mean, you can get a good grasp on the basics within a couple of days easy. If you want some terms to start with, DHCP, TCP/IP, APIPA, subnet, subnet mask, broadcast address, WEP/WPA, 802.11, routing, IPv4, NAT, ports, DNS, network packet, MAC address. If you're the type who looks up an article and keeps going to find more and more articles it should be pretty easy for you. I'm not saying it'll make you into an expert but you'll definitely have a better understanding of why things are, and what a lot of the information regarding networking means, as well as what some of the applications out there are trying to tell you.(although since you're already aware of MAC address filtering I'm assuming you know a bit already, so the list of stuff to look up would just be fore people in general).

Some topics I'd recommend avoiding at first because they'll only confuse things for now would be: ipv6, RIP, BGP, IPX/SPX, netBIOS, netBEUI, WINS, CIFS, NFS and maybe some others but I can't think of 'em off the top of my head.

[JDay]

Want to be more secure? Your router should have an option to disable broadcasting the SID. This means that unless you specifically know to look for your network name, it won't just appear in a list of available networks in range.

It's the SSID, and disabling the SSID broadcast does absolutely nothing to improve your security. You see, so long as there is at least one client connected, anyone can still see that the network is there. WPA2 (AES) with a strong passphrase is more than enough security for most people. You can also setup a RADIUS server and/or VPN if you're really paranoid.

If you use MAC Address filtering you wouldn't have to worry about it. Anyone who try's to hack that has way too much time on their hands and isn't worried about your network anyway.

Easy to bypass by spoofing the MAC of a valid client.

[r3dn3ck]

yep... and that's pretty easy to do.

There is no practical way to have a really secure WiFi setup using equipment intended for the home user. You can have a harder target than your neighbor and that's about it. Keeping a home network highly secure takes a lot of skill, knowledge and maintenance.

Apart from that, IMHO I'd highly doubt you'd even notice if you are ever actually "hacked". The first rule of hacking is not to pee in your cheerios. Once you've owned a system, keep it owned and use it without the owner knowing. Duh. Now if you've been infected, well... that's a different story but shoddy wifi security wouldn't likely be the vector of infection all by its lonesome. Poor wifi security leads to a lot of leeches (and thus slow performance on the intarwebz) and a generally low risk of genuine attack on your data.

[JDay]

There is no practical way to have a really secure WiFi setup using equipment intended for the home user.

Sure there is, and it only take a couple minutes to setup.

[Merc1138]

It's the SSID, and disabling the SSID broadcast does absolutely nothing to improve your security. You see, so long as there is at least one client connected, anyone can still see that the network is there. WPA2 (AES) with a strong passphrase is more than enough security for most people. You can also setup a RADIUS server and/or VPN if you're really paranoid.



Easy to bypass by spoofing the MAC of a valid client.

Yes you're right it's the SSID rather than sid.

And you're correct in saying that if a client is connected to that network it's still possible to find it. I never said that it makes you completely invisible. It stops people from browsing for available apps using the basic software in their smartphone and seeing your network. Yes, that WILL stop a lot of the garbage that goes on. Unfortunately not everyone has up to date equipment and that may be the only option for them with whatever ancient access point they have(don't pretend that there aren't people still running windows 98 on their pentium II's.) It's simply one of many things to do, hence why I said to learn how this stuff actually all works.

[JDay]

Yes you're right it's the SSID rather than sid.

And you're correct in saying that if a client is connected to that network it's still possible to find it. I never said that it makes you completely invisible. It stops people from browsing for available apps using the basic software in their smartphone and seeing your network. Yes, that WILL stop a lot of the garbage that goes on. Unfortunately not everyone has up to date equipment and that may be the only option for them with whatever ancient access point they have(don't pretend that there aren't people still running windows 98 on their pentium II's.) It's simply one of many things to do, hence why I said to learn how this stuff actually all works.

Disabling the SSID is useless, it does not protect you from or stop anything. The only thing that will protect a wireless network is using strong encryption. This is why you use WPA2 (AES mode, no TKIP), with a strong pass phrase (over 14 characters, upper/lowercase, numbers & symbols), and change it every few months. Without a sufficiently long & strong pass phrase it is trivial to crack even WPA2.

[Merc1138]

Disabling the SSID is useless, it does not protect you from or stop anything. The only thing that will protect a wireless network is using strong encryption. This is why you use WPA2 (AES mode, no TKIP), with a strong pass phrase (over 14 characters, upper/lowercase, numbers & symbols), and change it every few months. Without a sufficiently long & strong pass phrase it is trivial to crack even WPA2.

Wow. You keep missing the point. I never said hiding the SSID alone would protect you. You're also assuming everyone has a modern wireless router, that is not the case(yes, the best option is to simply get something better). Yes, hiding the SSID even on an unsecured network WILL stop random people from stealing your bandwidth, since those are the people that just open their generic wireless network management utility from their phone, laptop, etc. and look for open networks. It really makes me wonder why you're so adamant against simply doing one minor step that can indeed make a difference depending on the environment.