Question Possible home network intrusion ?

[woot]

So i came home and noticed that my modem's internet light is blinking at a fast rate and the WLAN light is blinking sporadically, none of my devices where connected at the time and i don't have any appliances that can connect to it and there was no one else in the house.

Could this mean someone is using my wifi ?
I cant log into my modem because i forgot the password.

 

[LinuxDevice]

Most modems have something like a pinhole that you can use to reset the device from locally (and then assign a new password). Wi-Fi is terribly insecure even in its most secure setup, so what you are saying is plausible. There are a lot of other reasons such traffic might show up which is unrelated to any break-in (e.g., DHCP lease expiration and reassignment).

 

[woot]

Wi-Fi is terribly insecure even in its most secure setup, so what you are saying is plausible

this is somewhat troubling, i guess i should start unplugging my modem when i'm not home

 

[USAFRet]

So i came home and noticed that my modem's internet light is blinking at a fast rate and the wlan light is blinking sporadically, none of my devices where connected at the time and i don't have any appliances that can connect to it and there was no one else in the house, could this mean someone is using my wifi, i cant log into my modem because i forgot the password.

That could easily be just a lack of connection to homebase, and the router is trying.

 

[woot]

That could easily be just a lack of connection to homebase, and the router is trying.

well, i connected a device soon after i saw that and the internet was working fine.

 

[USAFRet]

well, i connected a device soon after i saw that and the internet was working fine.

Find the RESET button on the router, do that.
After, change the SSD ID and WPA 2 password.
And write them down!

 

[evermorex76]

What model of modem and which specific light was it? They usually have many, like a "link" light, "uplink" and "downlink", plus "data transfer" indicators. It could just as easily have been someone hammering your IP address with traffic which the router was just dropping after it was received, with no actual intrusion having occurred. If the LAN or Wi-Fi indicator lights weren't flashing at the same time, then there was no traffic inside your network.

 

[woot]

What model of modem and which specific light was it? They usually have many, like a "link" light, "uplink" and "downlink", plus "data transfer" indicators. It could just as easily have been someone hammering your IP address with traffic which the router was just dropping after it was received, with no actual intrusion having occurred. If the LAN or Wi-Fi indicator lights weren't flashing at the same time, then there was no traffic inside your network.

SmartRg505, a DSL modem, is does not have any lights that are labelled link or uplink or downlink or data transfer, also what do you mean by "hammering my IP address?, is that an attempt at an intrusion?, also im only using WLAN, no wired connections.

 

[evermorex76]

SmartRg505, a DSL modem, is does not have any lights that are labelled link or uplink or downlink or data transfer, also what do you mean by "hammering my IP address?, is that an attempt at an intrusion?, also im only using WLAN, no wired connections.

Could be a random DDoS attempt, or trying to abuse some known or suspected vulnerability with connection attempts (like a buffer overflow that would cause the device to suddenly accept a login attempt from the outside to access the router's administrative interface so they could upload compromised firmware).

The manual is here and page 7 has the LED info, although they quite helpfully (/s) don't show a specific model and where the lights are physically so I can't say exactly what your model has. https://www.lmi.net/wp-content/uploads/Gateway_User_Manual_v3_5.pdf

The WLAN light blinking sporadically could just be normal activity of an access point that is receiving signals/packets that aren't actually making a data connection, or that is just sending out the normal beacons, or maybe is doing a channel scan. I don't know about your device specifically and whether it would blink while a mobile device was trying to connect but didn't have the password, for example.

The Internet light blinking can mean the DSL authentication is in process, but that could be a slow blink or a fast blink, and might be very brief or might take a while. I have no experience with your device so really only you would be able to say if it was different this time. That light can also indicate actual traffic passing, so it could have been malicious coming from the Internet, or maybe the router was trying to do a firmware update. You have NO devices at home that would be connected when you're outside the house? No computer, no smart TV, no security camera? Nobody else in the house could have left a laptop or mobile phone behind when they went out?

Since you had no way to log into it to check on what devices may have been associated on the Wi-Fi, you've got no way to troubleshoot this. As @USAFRet said, reset it, and create a long and strong password for the management interface and a long and strong password with a new wireless SSID. Hold the reset button for 6 to 20 seconds. Longer than that goes into a deeper reset mode. Note that you MAY need to contact your ISP to get the DSL connection configured again, unless you have the information sent to you when you signed up. The default credentials for the web interface are admin/admin.

If you want to be a little paranoid/security-conscious you can log in regularly and monitor for current associated devices, and the system and security logs (which likely don't go very far back) might catch association attempts or management login attenpts. Even knowing that someone did manage to crack your Wi-Fi password won't help you DO anything about it other than change the password and SSID every time, although you could configure it for a hidden SSID which makes it somewhat harder to break into.

 

[woot]

Could be a random DDoS attempt, or trying to abuse some known or suspected vulnerability with connection attempts (like a buffer overflow that would cause the device to suddenly accept a login attempt from the outside to access the router's administrative interface so they could upload compromised firmware).

The manual is here and page 7 has the LED info, although they quite helpfully (/s) don't show a specific model and where the lights are physically so I can't say exactly what your model has. https://www.lmi.net/wp-content/uploads/Gateway_User_Manual_v3_5.pdf

The WLAN light blinking sporadically could just be normal activity of an access point that is receiving signals/packets that aren't actually making a data connection, or that is just sending out the normal beacons, or maybe is doing a channel scan. I don't know about your device specifically and whether it would blink while a mobile device was trying to connect but didn't have the password, for example.

The Internet light blinking can mean the DSL authentication is in process, but that could be a slow blink or a fast blink, and might be very brief or might take a while. I have no experience with your device so really only you would be able to say if it was different this time. That light can also indicate actual traffic passing, so it could have been malicious coming from the Internet, or maybe the router was trying to do a firmware update. You have NO devices at home that would be connected when you're outside the house? No computer, no smart TV, no security camera? Nobody else in the house could have left a laptop or mobile phone behind when they went out?

Since you had no way to log into it to check on what devices may have been associated on the Wi-Fi, you've got no way to troubleshoot this. As @USAFRet said, reset it, and create a long and strong password for the management interface and a long and strong password with a new wireless SSID. Hold the reset button for 6 to 20 seconds. Longer than that goes into a deeper reset mode. Note that you MAY need to contact your ISP to get the DSL connection configured again, unless you have the information sent to you when you signed up. The default credentials for the web interface are admin/admin.

If you want to be a little paranoid/security-conscious you can log in regularly and monitor for current associated devices, and the system and security logs (which likely don't go very far back) might catch association attempts or management login attenpts. Even knowing that someone did manage to crack your Wi-Fi password won't help you DO anything about it other than change the password and SSID every time, although you could configure it for a hidden SSID which makes it somewhat harder to break into.

Thanks for the detailed reply, i used Nirsofts https://www.nirsoft.net/ very user friendly netwatcher program and didn't see any other devices, although it scanned only from 1-254, so i'm just going to do what was suggested earlier and reset the modem just in case, maybe someone is hiding their devices from network scanners or something.