Wireless Security Compromise - Want to fight back

[FPM]

Greetings,

Well, a stupid error by me has evidently compromised my security for a wireless network I have set up in my home. 4 months ago, after receiving my new imac, I set up a wireless network for my wife since the computer was located upstairs and our internet connection for the cable modem was downstairs. I got a linksys WG54g and easily set up a new network. Of course, I forgot to change one thing with the security: The Administration password. Unfortunately, I was deployed with the Air Force a few days after I set up the connection.

Fast Forward 4 Months:

After I came home from my deployment, I completely forgot about the password and everything else that might have been associated with it. Until tonight. I went online earlier today and forgot to turn off the cable internet box downstairs. While I was watching TV tonight, I noticed that the PC activity light was going crazy and the light for the wireless network on the linksys was also blinking, as if I were online. Of Course, this was impossible because I shut off the airport on the imac and it was asleep. I then at that moment put two and two together and realized that at the apartment complex someone else might be using that connection. I went upstairs to correct the problem, and to my horror I realized that I never changed the administration password, allowing someone to get in and get the WEP password. So, after changing everything from the WEP password, the admin logon, the router IP address, and anything else I could think of, the internet is now running faster and the lights are no longer blinking when the computer is off (although its common practice to turn off the cable modem anyway).

This leaves me with 2 questions, for if I am right I am pretty steamed that my internet connection was hacked (albeit I am at fault as well). First, is there any free ware that can back track a signal coming into a router? (I imagine there must be something as the open airport would be picking up something as well, almost using hacker tools against them.) And 2, is there anyway to tell if someone else was actually using the internet, aside from the blinking lights on the cable modem and the router itself?

I am also interested to know (again, assuming I am correct) what legally can be done about this, assuming whoever was on the network is identified. That may be a stretch, but I am tempted to circulate a bulletin to the other tenets warning them to up the security on their networks, as I am sure I am not the only one with errors in the security.

As you can tell, I am not a happy camper. Any insight would be appreciated.

Thanks
Frank

 

[nixgeek]

The router itself should have a log setting where it logs all incoming and outgoing requests. If you enable this, you'll see all the activity from the router and devices connected to it wirelessly.

You can also use a program called KisMac or MacStumbler to determine who has a wifi signal near you.

I can understand how this can make you steamed, but to be honest a person who doesn't take the measures to secure their network is basically inviting trouble. It is imperative that you change the default password and ALWAYS check for firmware updates as they can patch security holes that might have been discovered on the router's firmware. Always use encryption and don't let the router broadcast its SSID. While NetStumbler/MacStumbler and Kismet/KisMac can usually still detect a wifi signal even if the SSID is not broadcasted, it's still a deterrant since the SSID isn't easily discovered unless using these tools.

You can also take further measures and use MAC filtering, but since this can be spoofed and can sometimes cause headaches if someone visits and wants to use your network, you might not want to do it.

At this point, fighting back isn't going to solve anything and might actually get you into trouble. Just securing your network will be enough to deter anyone wanting to leech off of your wireless connection. If anything, make sure that you check the logs (if they're enabled on the router) and if you suspect a break-in to your wifi network, you'll have the information you need.

 

[Natobasso]

And don't forget that whomever had unrestricted access to your network had the same access to your computer files; so make sure if you had any passwords to sensitive accounts (bank, etc.) that you change those passwords immediately.