Spyware, viruses, & security forum: Was I "Hacked" (wireless network)

I had no idea it was that easy. My new router password is 16 alpha-numeric digits but does that even matter? My new WPA-2 key-phrase is 17 alpha-numeric digits so does that slow them down al all?

... going in the router and telling it to STOP broadcasting the SSID?

I never did that before and I figure once I got the lappies connected, I shouldn't need the broadcast. It might make hooking up a new device difficult unless I turned it back on temporarily?

I really appreciate your replies. I guess I have to keep on top of it a little better. Thanks for all your help

As Bob has indicated, consumer wireless networks are inherently insecure, when compared to a wired network. To hack a wired network, you need physical access to it and plug in a cable. Wireless knows no such boundaries. Don't believe the range diagrams on the router boxes, by the way, in the rural area where I live, I can "see" my neighbour's 802.11G network at 50 metres! And that through his exterior wall and mine.

There is commercial equipment which can improve the security of a wireless network but for most of us, these are unaffordable.

I think we may be waiting some time for improved encryption, such as Bob mentions, though that would be the best solution - for a while - until the ne'er do wells find a way round it!

In the meantime, I enable all the tools currently available on my router, Change the SSID, Stop broadcasting it, Enable MAC filtering and Use WPA2 with a long pass phrase.

The SSID and Passphrase can be purely random characters, the more the better. Keep a hardcopy record for when you forget them and maybe keep them on a USB key also - NOT on any of your computers! The USB key makes it very easy to set up any new device to tell it to look for the non broadcast SSID (the wireless signal is still broadcast, just the name isn't) and give it the Passphrase, always assuming the new device has a USB port!

Sure, all these can be bypassed but with the proliferation of wireless networks these days, if yours has a couple of stumbling blocks, most baddies will give up and choose an easier one.

But it won't get any easier to protect your network any time soon. But you do have one advantage with your setup, your router is separate from your modem, so you could just power off the router when you are not using it and you should be able to spot any attacks when you are logged on. The modem will continue to answer your provider's "heartbeat" messages, which isn't possible with a combined modem/router.

Good Luck!

...about whether having a 16-digit multi-case alpha-numeric pass-phrase was any more secure than just any good random 9 or 10 digit alpha-numeric code. I have been using at least 9-digit alpha-numerics for all my banking and sensitive stuff for over ten years. I still had some old 7 and 8 digit passwords for my more generic stuff like this forum and a bunch of things I never thought were very important. The 7-digit code I used on my router was probably not very secure but it was still a random alpha-numeric.

I recently saw a thread around here where the topic of password length was at issue. I think it said something about 8 digits not being very secure anymore and suggested 10 digits because that would take a computer years to "guess" the right combination. But am I correct to assume that the pass-phrase does not need to be "guessed" to break into these wireless systems?

I have my phone going through the router, albeit it is hardwired but it still seems like it would be a pain to turn the "wireless" portion of my router on and off all the time. And I'm hoping that time-stamping would be in my favor to prove it wasn't me if anything inappropriate got sent over my connection. My computers are off when we're not here and I don't think anyone is going to get away with anything while I'm sitting here using it. I'm pretty sure I would notice my connection being modified.

I have an idea who did it. There aren't that many people that smart that live close enough to me and there is in teenage kid who lives next-door who I believe is basically a really good kid. But I also know that if I was him and I had the software available, I might try it, maybe, just to see if it worked. And all he did was reset it to default with zero security so at most, he got to use my Internet connection for 8 hours.

It was WPA and is now WPA2 so at least he will need an additional program or download to do it again. And I'm guessing he won't because he's not a bad kid. But I was also going to ask about that, whether there was an additional benefit to using the MAC filtering option along with the longer pass-phrase would do much good or if it was just forcing me to type more digits. I re-used my old SSID, basically, just to show him that I "saw" what he did the moment I came home from work. Since it is broadcasted publically, I didn't think there was any point in making it anything cryptic or even different than before. But the 7 digit password to get in the router is gone. I don't know if it helps but it is a 16-digit code now, along with the pass-phrase which is another 16-digit code.


I love that this has stimulated some discussion and I would like to end this post with a question. What is the general consensus on what length of password or pass-phrase is too short and at what point does the length become redundant?

While I want to believe that password strength will always remain somewhat of a factor in many situations, it seems like no matter what anyone does to "secure" themselves, someone else will eventually find a way around it. Constant change seems like the more logical approach if only to make it a costly venture for any repeat offender.

But, for the traditional use, such as a password for connecting to your online banking, what would you consider a secure number of digits in a multi-case, alpha-numeric password?