Someone trying to hack my router?

[red_slr]

Just sat at home and my CCTV feed was on in the kitchen and started flashing up with an alarm, after about 10 minutes I thought best check it and it said illegal log in. Weird.

Logged into the router and from 1750 to 1800 someone had tried to log in 147 times...

The user name was wrong - I use a unique user name so I think that's what triggered the alarm.

Hmm.

So I turned my router off and then waited and then turned it on again and the log in attempts stopped.

Should I be worried?!

Is there any way I can check whats happening?

[bitchstewie]

Depends on the router as some are good and some are bad.

I'd be asking why your router is accessible from the internet for any sort of management activity (other than perhaps by your ISP if it's the one they supplied).

[ging84]

Either someone on your network is trying to access it or your router's admin interface is exposed to the internet.

[red_slr]

The only person on my router is me. My wife has her own wi-fi network so she cant even access the main house wi-fi.

No one else in the house. Its a BT router and about 4 years old.

Also this is really weird but today the post man came to work with a sky router, I told him to take it back as I didn't order one. I have not been a sky customer for almost a year.

[red_slr]

ging84 said:

or your router's admin interface is exposed to the internet.

How do I check that?

[Beetnik]

red_slr said:

How do I check that?

ShieldsUP!

[red_slr]

THE EQUIPMENT AT THE TARGET IP ADDRESS
DID NOT RESPOND TO OUR UPnP PROBES!

So I think that means its ok ?

Been watching my logs and no attempts since I rebooted the router..

Weird!!

[MXRod]

This is VERY interesting ,
I am in protracted legal dealings with BT over a similar problem
Firstly do BT hubs have a generic log on which needs to be changed as soon as put into service?
My daughter had a poverty spec broadband contract with BT ,3 or 4 years ago and within hours of setting up they had slapped an excess usage charge on her account ,
The amount of data they said she used was way and above the download allowed so was mathematically impossible due to the connection speed she had , and the usage was even recorded when all WiFi devices in her house were turned off , and she was out
They refused to explain how they arrived at the figures .
I believe someone was able to log into her hub and piggy back on her account . Not unheard of on BT hubs
She is now with VM

[ging84]

Change your WiFi password

[ging84]

MXRod said:

This is VERY interesting ,
I am in protracted legal dealings with BT over a similar problem
Firstly do BT hubs have a generic log on which needs to be changed as soon as put into service?
My daughter had a poverty spec broadband contract with BT ,3 or 4 years ago and within hours of setting up they had slapped an excess usage charge on her account ,
The amount of data they said she used was way and above the download allowed so was mathematically impossible due to the connection speed she had , and the usage was even recorded when all WiFi devices in her house were turned off , and she was out
They refused to explain how they arrived at the figures .
I believe someone was able to log into her hub and piggy back on her account . Not unheard of on BT hubs
She is now with VM

That was a billing error.
Have you ever heard the phrase.
Never attribute to malice that which can be adequately explained by stupidity

[rxtx]

red_slr said:

THE EQUIPMENT AT THE TARGET IP ADDRESS
DID NOT RESPOND TO OUR UPnP PROBES!

So I think that means its ok ?

Not necessarily, you've only checked UPnP.

The UI for that site is dreadful. See the menu bar below that huge button you clicked on to check UPnP? Those will check other things. Check all ports, perhaps you've forwarded some to your CCTV camera.

In fact I'm a bit confused about the whole thing. You say you were watching the CCTV but got an alert about failed logins, then checked your router. How did your router alert you, while you were looking at CCTV (I presume over a web browser)? Do you mean the alerts came from the CCTV camera interface?

[ging84]

Sounds like maybe the CCTV has been hacked and is now being used to attack your router

[rxtx]

How does the router come into it? IP ranges assigned to ISPs are probed all the time, it sounds like two different things are being conflated.

red_slr, how were you alerted? Did it come from a web browser, or some app on another device perhaps?

[mikeiow]

red_slr said:

The only person on my router is me. My wife has her own wi-fi network so she cant even access the main house wi-fi.

No one else in the house. Its a BT router and about 4 years old.

Also this is really weird but today the post man came to work with a sky router, I told him to take it back as I didn't order one. I have not been a sky customer for almost a year.

But more importantly.....why does your wife have her own network?
Am I the only one here who thinks that is.....slightly odd?

[boxst]

mikeiow said:

But more importantly.....why does your wife have her own network?
Am I the only one here who thinks that is.....slightly odd?

Friend of mine works for BT and they have a separate line to the house for work and that is a requirement rather than using VPN, so there are two FTTP connections and WiFi points.

[anonymous-user]

Someone local to you is piggy backing through the BT Openzone that every BT router offers so there customers have wifi whereever they go etc.

[MXRod]

ging84 said:

That was an equipment failure
Have you ever heard the phrase.
Never trust BT

Corrected for you
Now go back and read my post again ,without skimming.
Usage was recorded when she was out and ALL devices were off.
That is equipment failure.

[frisbee]

rxtx said:

red_slr said:

THE EQUIPMENT AT THE TARGET IP ADDRESS
DID NOT RESPOND TO OUR UPnP PROBES!

So I think that means its ok ?

Not necessarily, you've only checked UPnP.

The UI for that site is dreadful. See the menu bar below that huge button you clicked on to check UPnP? Those will check other things. Check all ports, perhaps you've forwarded some to your CCTV camera.

In fact I'm a bit confused about the whole thing. You say you were watching the CCTV but got an alert about failed logins, then checked your router. How did your router alert you, while you were looking at CCTV (I presume over a web browser)? Do you mean the alerts came from the CCTV camera interface?

It is pretty awful. Even on the first page where they are blathering on about "machine name".

It might uniquely identify you on the internet! But its ok because it might just be your IP address. Its not! Oh wait but it is in hex, nice of them to mention that....

[red_slr]

rxtx said:

How does the router come into it? IP ranges assigned to ISPs are probed all the time, it sounds like two different things are being conflated.

red_slr, how were you alerted? Did it come from a web browser, or some app on another device perhaps?

Sorry my terminology is probably off.

So we were in the kitchen, the kitchen TV has the CCTV HDMI output fed into it. We generally have it on in the background whilst we make dinner. Then at total random a big yellow ! appears on the screen, which I have never seen before. I said to the mrs that's odd. Then it went off. A few minutes later it came back on. I clicked on it and it just said "alarm illegal log in attempt".

So I got my laptop out and logged into the DVR locally and looked at the logs and there were 147 attempts over about 10 mins. All using the "admin" user name. I don't use "admin" as a user name so 100% not me. The IP address trying to access was the IP of our BT router.

The DVR is connected by RJ45 to my router which is a BT home hub. I have BT hot spot sharing thingy turned off.

Its a Hikvision system if that makes any difference? I appreciate its not the most secure system in the world.

The main thing I want to prevent is access to anything else on the network. I kept my eye on it last night and there were no further attempts.

[thebraketester]

Can you log in to your cctv remotely?