[SOLVED] Hacked? Any suggestions for troubleshooting unknown device on network?

mschubb

Distinguished
Aug 11, 2009
19
0
18,510
Thanks in advance for any help! OS is Windows 10 Enterprise. Router is Asus RT-AC68U.

In File Explorer under NETWORK, I will intermittently find an unknown device called "goyawifiue" that properties show as a Samsung SMT-100 with a specific MAC address. However, that MAC address and device do not appear on my ASUS router. All the connected devices listed on the routers are my known devices and have different MAC addresses.

Typically, while I'm investigating the device it disappears from NETWORK. But days later I'll find it again.

Any ideas about how I can further investigate this issue?

Thanks for any comments or suggestions.

Mark
 
Solution
Rather than try to track it down it maybe easier to just make sure your network is secure.

First step is to disable a function called WPS. This feature can be cracked in seconds. This is a massive insecurity that router manufacture leave enabled to allow lazy people to not have to even type in their password 1 time. Unfortunately some silly lights and other things can not function without it so some people choose to have their toys rather than a secure network.

After this change the password on your wifi radios. Tell only those you trust. Since WPS is disabled it can not distribute the password to devices you do not know about.

If the device magically appears again then it must be some device you or someone you gave the...
Rather than try to track it down it maybe easier to just make sure your network is secure.

First step is to disable a function called WPS. This feature can be cracked in seconds. This is a massive insecurity that router manufacture leave enabled to allow lazy people to not have to even type in their password 1 time. Unfortunately some silly lights and other things can not function without it so some people choose to have their toys rather than a secure network.

After this change the password on your wifi radios. Tell only those you trust. Since WPS is disabled it can not distribute the password to devices you do not know about.

If the device magically appears again then it must be some device you or someone you gave the password to has allowed to get on the network.

If you had said you see it on the router but not on the network that can happen because some routers report devices that failed connections but they never can talk to anything on the network.
 
Solution

mschubb

Distinguished
Aug 11, 2009
19
0
18,510
Thanks for the help.

No Samsung tablet. that's why it's odd Will disable WPS and reset all the passwords and devices.

The real mystery is that it shows up on my network via windows, but NOT on my router's list of connected devices. Could it be via bluetooth?