HELP: Intrustion and NAT Bridging

[syyid]

Hi
I've got a local LAN setup behind a wireless router. Bad security setup, never bothered with it. Anyways

A neighbour used a wireless bridge to get into my network and was using up all my bandwidth. I restricted the wireless section to only allow my laptop(s) MAC addresses in, but he still got in (used MAC spoofing I presume).
Anyways I ran a port scanner and logged into his bridge, he had my SSID entered in it (obviously) which made me believe that it wasnt an accidental next -> next windows dude (not to mention the MAC spoofing). I mean a wireless bridge is usually used to give a wired router wireless capability. Anyways so I did a lot of port scans on NAT address ranges and on 10.1.1.X came up with around 40-50 machines visible. NOW the Q's
(My IP range was 192.168.254.x)

1) From my understanding of NAT, the only way possible for me to see 10.1.1.x was through the bridge, since NAT isn't routable over the internet, which meant either that guy has 40-50 machines in his basement or he's gotten into 40-50 machines and has aliases or something for them. Am I right?
I ran a traceroute and got a lot of timed out messages but the 2nd and 3rd hop were regular internet visible IP addresses


2) A lot of the machines I found had either 23/513 open or 80. I checked the port 80's and found 5 different cable modems with diff public IP's. I also did telnets on the other machines but didnt get any login (could type in text and didnt get a connection refused either). Anyways 5 diff cable modems to me SEEMED like he's in 5 other networks too (all of the cable modems are in the same IP range of my ISP.

3) What should I do? I can simply enable WEP disable wireless access unless a laptop is on etc, but I'd prefer notifying the other people being abused (IF my hypothesis are right? And no I wouldnt want to call the cops (Esp. with all the RIAA stuff )

4) I thought about doing packet sniffing but am not as knowledgable about that as I would've wanted to be. Also my 3 mbps pipe had only 77K left on my last cnet bandwidth test (I usually get 2-2.5Mbps). Also one possibility I presumed was Spamming, the guy visited www.atdmt.com which seem to be a digital marketing company but our ISP blocks port 25, so once again

Thanks for any ideas / help

EDIT: Am including the trace route

Tracing route to 10.1.1.252 over a maximum of 30 hops

1 * * * Request timed out.
2 16 ms * 69 ms xxxx [68.100.x.x]
3 28 ms 26 ms 18 ms xxxx [68.100.x.x]
4 45 ms 49 ms 40 ms 10.1.1.252

 

[Thoreau]

You don't live in Phoenix do you?

 

[syyid]

Nopes. East Coast. Why? Are you having similar issues down in Phoenix?

 

[Thoreau]

Not exactly, altho I was basically doing something similar to that to an open AP of my neighbors just last night. =)

 

[acemcmac]

Call Remington.

"When the big red dog is digging in your back yard... you have every right to shoot it." -13 Days

 

[syyid]

Originally posted by: Thoreau
Not exactly, altho I was basically doing something similar to that to an open AP of my neighbors just last night. =)

The issue isnt the wireless AP, I know I was just too damn lazy to configure it, the other stuff , seeing dozens of NAT addresses and cable modems etc, is freaking me out, feels like this guy is doing some nasty stuff, so wanted confirmation of my hypothesis on the evidence available

 

[wlee]

You could alway put a VPN router behind the Wireless Access Point. That way it wouldn't matter if you left it Open-WEP. Without the DES keys, anyone that connected would go nowhere. The latest firmware of the Zywall 10Wand 30W support this feature. I *THINK* the Cisco Aironet also supports it.

 

[gunrunnerjohn]

I'm missing the reason for not turning on WEP and dealing his crap the death blow?

 

[mboy]

If they guy who is stealing it is competent at all, WEP will only stop him for a few hours at most until he decrypts the keys.

 

[syyid]

Originally posted by: gunrunnerjohn
I'm missing the reason for not turning on WEP and dealing his crap the death blow?

I wanted to find out why I can see so many machines in the 10.1.1.x and 172.16.x.x range? Is there any other explanation besides the one I gave? (Read possibility I'm making a mountain out of a molehill)

 

[gunrunnerjohn]

Originally posted by: mboy
If they guy who is stealing it is competent at all, WEP will only stop him for a few hours at most until he decrypts the keys.

Well, I'm not so sure it's going to be quite that easy. To be sure, it is breakable with some effort, and I guess lots of people have unlimited time on their hands to screw around doing this sort of stuff. OTOH, it's a lot more work than simply configuring your client, and most people won't go to the trouble. WEP is there, free, and takes a couple of minutes to configure. Also, you can keep him entertained for hours by simply changing the key every night, he might just get tired of trying to use your connection if he has to crack it again every night, it does take a fair amount of efford! Here's a good link to the security, or lack of same.

http://www.isaac.cs.berkeley.edu/isaac/wep-faq.html

 

[gunrunnerjohn]

Originally posted by: syyid
Anyways I ran a port scanner and logged into his bridge, he had my SSID entered in it (obviously) which made me believe that it wasnt an accidental next ->

If you can log onto his bridge, find a firmware version and scramble it, and FLASH the bridge with something that renders it inert.

 

[BS911]

Originally posted by: gunrunnerjohn

Originally posted by: syyid
Anyways I ran a port scanner and logged into his bridge, he had my SSID entered in it (obviously) which made me believe that it wasnt an accidental next ->

If you can log onto his bridge, find a firmware version and scramble it, and FLASH the bridge with something that renders it inert.

LOL...i like that idea!!

 

[syyid]

Originally posted by: BS911

Originally posted by: gunrunnerjohn

Originally posted by: syyid
Anyways I ran a port scanner and logged into his bridge, he had my SSID entered in it (obviously) which made me believe that it wasnt an accidental next ->

If you can log onto his bridge, find a firmware version and scramble it, and FLASH the bridge with something that renders it inert.

LOL...i like that idea!!

I second that, though I didnt do it but well. The guy had modified a lot of my routers config as well, modified the virtual servers (static nat route?) that I had defined and also enabled 'remote management' . I also was having issues with modifying the settings back to what I wanted them so I simply flashed my own Router and that got things working perfectly :|.

I called up my ISP and found out that the 10.1.1.x weren't actually compromised systems but IP addresses they assigned to cable modems. Also they said they couldnt do anything regarding the other addresses (172.16.x.x) and it wasn't a problem on their site :\. I just enabled WEP encryption (easy way out ).


Thanks to all of you that replied

 

[TypeM]

How did the guy get into your router??? Did you change the default password?

-Mack

 

[InlineFive]

As stated above WEP is not the easy way out. It is hackable.

-Por

 

[gunrunnerjohn]

Originally posted by: PorBleemo
As stated above WEP is not the easy way out. It is hackable. -Por

WEP will make things very difficult for the guy if you rotate the keys every couple of days until he gets tired of hacking you. It takes hours for even the best WEP cracking programs to develop the keys, and that assumes lots of wireless traffic. Each time you generate a new WEP key, he has to start all over.

Of course, you could also just run a wire to the other computer and turn off the wireless.

I think I'd put a sign on my front yard that says "This guy is a bandwidth thief" with an arrow.

 

[InlineFive]

Originally posted by: gunrunnerjohn

Originally posted by: PorBleemo
As stated above WEP is not the easy way out. It is hackable. -Por

WEP will make things very difficult for the guy if you rotate the keys every couple of days until he gets tired of hacking you. It takes hours for even the best WEP cracking programs to develop the keys, and that assumes lots of wireless traffic. Each time you generate a new WEP key, he has to start all over.

Of course, you could also just run a wire to the other computer and turn off the wireless.

I think I'd put a sign on my front yard that says "This guy is a bandwidth thief" with an arrow.

The wired solution makes sense especially since you said the computers are in the same room.

-Por

 

[syyid]

Originally posted by: gunrunnerjohn

Originally posted by: PorBleemo
As stated above WEP is not the easy way out. It is hackable. -Por

WEP will make things very difficult for the guy if you rotate the keys every couple of days until he gets tired of hacking you. It takes hours for even the best WEP cracking programs to develop the keys, and that assumes lots of wireless traffic. Each time you generate a new WEP key, he has to start all over.

Of course, you could also just run a wire to the other computer and turn off the wireless.

I think I'd put a sign on my front yard that says "This guy is a bandwidth thief" with an arrow.

Yeah I read up on WEP (informIT has a great article detailing how WEP is cracked ) and according to that article, the bandwidth required to crack a WEP key is similar to 7 GB, since my wireless stuff is used for late night bedroom browsing, chances of it reaching that in a month would be pretty slim . In any case I intend on doing weekly rotations of the WEP key as suggested by gunrunnerjohn (thanks bud and gr8 suggestions ) and detailed in the informIT article. About the router as I said bad security , hadnt put in a password at all, and I dont think my router (siemens speedstream) actually came with even a default password . Anyways PorBleemo, I've got 2 laptop users that aren't in the same room as the desktop computers (basement), so wireless is pretty necessary. What I didnt get was why my router was acting funky and flashing it fixed it, it would suggest that he did something similar to what john suggested I do but thats to me at least seems mind boggling complex. . As a lot of people said, it was pretty interesting . Thanks again

 

[gunrunnerjohn]

I have a wireless router, but I normally disable the wireless section unless I need it. I have run wire to all the locations so I don't need wireless for the fixed locations.

 

[TypeM]

My suggestion... I would try every angle you could to find a weakness in this guys setup. PC, router, I wouldnt care. I would show this guy once and for all that he shouldnt mess with your network. I would like to quote two great movies:

Scarface: "Okay, you wanna play rough...lets play rough!"
Hackers: "Mess with the best... die like the rest!!!"



-Mack

 

[ClearToLand]

I just added a pair of D-Link DI-614+ Wireless Routers to my wired LAN. How do I check to see that I don't have any "good neighbors" like syyid?

Wardriving software? Something else?? Suggestions???

 

[syyid]

Originally posted by: TypeM
My suggestion... I would try every angle you could to find a weakness in this guys setup. PC, router, I wouldnt care. I would show this guy once and for all that he shouldnt mess with your network. I would like to quote two great movies:

Scarface: "Okay, you wanna play rough...lets play rough!"
Hackers: "Mess with the best... die like the rest!!!"



-Mack

Yeah but that'd work if you can be more rough then he is . Frankly i'm not that confident about my skills, not to mention I looked up some info via his number / address and the guy was working on SNMP stuff in BSD (if he hasnt moved in b/w etc) in the mid 90's . I was in high school then and didnt know squat so

 

[gunrunnerjohn]

I think I'd just change the WEP key every day until he gets tired of chasing it, maybe he'll break down and buy his own broadband.