Somebody broke into my AP

dave43 · 06-17-2005

I recently enabled my wireless AP and I think someone is on it. Can't I go somewhere in my router and it shows all mac addresses connected? Once I have there mac address how do I find out who they are? I want to press charges.

streaker69 · 06-17-2005

Quote:

Originally Posted by dave43

I recently enabled my wireless AP and I think someone is on it. Can't I go somewhere in my router and it shows all mac addresses connected? Once I have there mac address how do I find out who they are? I want to press charges.

So what you're saying is that someone guessed your unbroadcasted SSID, cracked your WEP/WPA and then Spoofed a MAC address on your network and that's how they go on?

If you don't know where to find the information you're asking aboot, then how do you know someone is on it?

nashr · 06-17-2005

Quote:

Originally Posted by dave43

I recently enabled my wireless AP and I think someone is on it. Can't I go somewhere in my router and it shows all mac addresses connected? Once I have there mac address how do I find out who they are? I want to press charges.

Fat Chance.

First, lock the damn thing down! If you want to keep your AP open for some reason, then get AirSnare up and running.

wrzwaldo · 06-17-2005

Quote:

Originally Posted by dave43

I recently enabled my wireless AP and I think someone is on it. Can't I go somewhere in my router and it shows all mac addresses connected? Once I have there mac address how do I find out who they are? I want to press charges.

Yes go to the owners manual/guide and if that don't work call tech support!

Thorn · 06-17-2005

Quote:

Originally Posted by dave43

I recently enabled my wireless AP and I think someone is on it.

<heavy sarcasm>
It's probably one of the guys from thebroken. They are "so l33t", after all.
</heavy sarcasm>

Quote:

Originally Posted by dave43

Can't I go somewhere in my router and it shows all mac addresses connected?

Usually, although it depends on particular brand and model of the AP. Time to RTFM.

Quote:

Originally Posted by dave43

Once I have there mac address how do I find out who they are? I want to press charges.

You will need to start collecting evidence (such as the logs), and do that in a manner consitant with the Rules of Evidence for your state. Start by calling your local PD or SO and find out who handles computer crimes in your area.

nashr · 06-17-2005

Quote:

Originally Posted by Thorn

<heavy sarcasm>
It's probably one of the guys from thebroken. They are "so l33t", after all.
</heavy sarcasm>

Usually, although it depends on particular brand and model of the AP. Time to RTFM.

You will need to start collecting evidence (such as the logs), and do that in a manner consitant with the Rules of Evidence for your state. Start by calling your local PD or SO and find out who handles computer crimes in your area.

And when they're done laughing (if they understand what you're talking about) or saying "Huh???" (if they don't understand) then you're back to locking the damn thing down.

dave43 · 06-17-2005

I had 128 wep encryption enabled...I don't think I disabled ssid broadcast.. There mac address shows up in my status log. Where do I do a search for what person is using this mac address? If it is a neighbor can I see a list of what other networks they have joined in the past like maybe if they connected to there own network?

streaker69 · 06-17-2005

Quote:

Originally Posted by dave43

I had 128 wep encryption enabled...I don't think I disabled ssid broadcast.. Their mac address shows up in my status log. Where do I do a search for their mac address?

Kangaroo?

If their MAC is in your logs, there isn't need to search anywhere else, it's in the logs.

nashr · 06-17-2005

Quote:

Originally Posted by dave43

I had 128 wep encryption enabled...I don't think I disabled ssid broadcast.. There mac address shows up in my status log. Where do I do a search for there mac address?

If you want to find out who it is by the MAC, then I'm afraid you're out of luck!

Before you go off the deep end here, double-check the MAC against all your systems, including the AP itself. There should be TWO MAC addresses associated with your AP. Make sure you've checked the obvious before assuming someone has hacked your AP.

Get AirSnare, it will track all the MACs for you. Use it to build a table of "approved" or "friendly" MACs.

Thorn · 06-17-2005

Quote:

Originally Posted by nashr

And when they're done laughing (if they understand what you're talking about) or saying "Huh???" (if they don't understand) then you're back to locking the damn thing down.

At the start my suggestion is to ask who handles it, and then talk to someone in that section. Explaining in detail is useless until you are talking to the people who handle such crimes. It may be handled at the patrol level (like it is apparently in St. Petersburg, FL http://www.tampabays10.com/news/news.aspx?storyid=13482) or it may be all the way up to a state unit. Whether they will investigate or not depends on a number of factors.

dave43 · 06-17-2005

Your username is thorn....did you write the wardriving book?

Thorn · 06-17-2005

Quote:

Originally Posted by dave43

Your username is thorn....did you write the wardriving book?

I'm one of the guys. Chris and Mother (both moderators here, too) are the others. The signature line in my messages is a clue.

Dutch · 06-17-2005

Quote:

Originally Posted by Thorn

I'm one of the guys. Chris and Mother (both moderators here, too) are the others. The signature line in my messages is a clue.

Hence the phrase "... Get a fucking clue, damn retard..." ???

Dutch

Thorn · 06-17-2005

Quote:

Originally Posted by Dutch

Hence the phrase "... Get a fucking clue, damn retard..." ???

Dutch

I never said that!

Well, at least I never said it in this thread.

Dutch · 06-17-2005

Quote:

Originally Posted by Thorn

I never said that!

Well, at least I never said it in this thread.

I never said that you said that.. In this thread...

And I also didn't say it directed towards anybody, in this thread. After all it IS the lounge...

But I might have thought it though.... Even in this thread...

Dutch

06-17-2005	#1 (permalink)
dave43 Registered Member Join Date: Jun 2005 Posts: 46	Somebody broke into my AP I recently enabled my wireless AP and I think someone is on it. Can't I go somewhere in my router and it shows all mac addresses connected? Once I have there mac address how do I find out who they are? I want to press charges.

06-17-2005	#7 (permalink)
dave43 Registered Member Join Date: Jun 2005 Posts: 46	I had 128 wep encryption enabled...I don't think I disabled ssid broadcast.. There mac address shows up in my status log. Where do I do a search for what person is using this mac address? If it is a neighbor can I see a list of what other networks they have joined in the past like maybe if they connected to there own network? Last edited by dave43 : 06-17-2005 at 08:39 AM.

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

06-17-2005	#11 (permalink)
dave43 Registered Member Join Date: Jun 2005 Posts: 46	Your username is thorn....did you write the wardriving book?