Question for Ubuntu users...

[catabryna]

I've suspected that someone has been hacking into my router for quite sometime, but there have been other odd things, so I decided to investigate a little further.

I am using Ubuntu 11.04 which was updated from 10.10. When I upgraded, the key-ring was lost and, furthermore, my desktop was no longer encrypted.

There is a person who shows up in my apartment complex at different times during the day, and I noticed that things seem to go awry when these particular people show up. First, I turned off both computers and noticed that someone was clearly using the router and it wasn't me, nor was it my son. I unplugged the router/modem.

I then turned my computer back on to look and see what other routers were in the area, just out of curiousity. All of a sudden, my computer logged on to what was supposed to be my router. Problem is, my router/modem wasn't turned on. Obviously, someone has placed some sort of coding on this computer that is allowing it to connect automatically to someone else's router. This of course, would explain much of the strange activity I've been noticing.

Obviously, I am going to once again change the password on the router. It also appears that I will need to once again reload the operating system because upgrading to 11.04 was not a good choice.

Any thoughts?

eta: It's no longer a figment of a paranoia... it is now a fact.

[struggle4progress]

1. I assume your router provides a wireless service for your computers

The first thing is to make sure you've secured the wireless connection

Pick a good secure administrative login password for the router
Then set a good secure administrative WEP or WPA password for machines to connect to the router wireless; WPA is preferred
Also, if possible, get the MAC addresses of your computers and limit access to the router to your two machines by MAC address

Figure out what outside network your computer is automatically connecting to and edit your computer network settings so the computer doesn't connect to that network
Also edit your computer network settings so your computers know the router WEP/WPA password

Then turn on the firewall; I don't think it's on by default

[catabryna]

2. This is all set as it should be...

I will see if I can limit MAC addresses on this particular router and of course, plan to change the password.

What say you, however, about the fact that the wireless modem in my computer is being directed to a router that is NOT mine? What I'm saying is that even though my router is working just fine, my computer will periodically be switched to an unidentified router that does not belong to me, i.e. a wireless router operated by someone within close proximity to my residence.

My son's computer is doing the same thing. His wireless modem was also changed so that, by default, he was directly connecting to a router that does not belong to us. I changed the default back to our wireless router, and now it appears I will probably have to reload his operating system. This should not be happening to a 10 year old boy. It is dangerous and I think it's really f'ed up! Fortunately, his computer is in the living room and he's never on it unless I'm nearby.

I got rid of Ubuntu 11.04. It disabled all my security settings.

[struggle4progress]

3. Look at the settings

System >> Preferences >> Network Connections

On edit: is the auto-connect box checked?

[catabryna]

4. My son's computer was initially set up to auto connect to our

router. These settings were changed and my son's computer was reconfigured to auto connect to someone else's router and our router's settings were set for manual. I did not make that change. My son doesn't know how to do that and he most certainly doesn't know the password. Either someone came in our apartment and made those changes, or someone did it remotely by gaining access to my son's computer through our router. He has been surfing the internet on someone else's router for probably weeks.

In addition, my computer kept disconnecting from our router and then reconnecting for no reason. This was strange because it never happened until I installed 11.04. So, this morning, I shut down our router. I turned off all the computers. I then turned my computer on (with OUR router OFF), and my computer automatically connected to someone else's router. I don't know anyone in this complex and most certainly wouldn't connect to someone else's wireless router. Again, the only way that could happen is if someone changed my computer's settings. How that was accomplished, I do not know.

Our firewalls were both turned on. They are getting through the firewall. The only other possibility is that someone is entering our home without my permission when we aren't home. Neither scenario is acceptable.

[struggle4progress]

5. Are you sure Ubuntu's not just auto-connecting to an available unsecured network?

[catabryna]

6. So far as I could tell...

there is only one unsecured network in the area and neither computer was set to search the area for unsecured routers in the event that ours doesn't work. In addition, ours usually works and if it does not, we just turn the computers off until the router starts working again.

In addition, my son is using Windows and I was using Ubuntu. The likelihood of two different OS experiencing the same problems at the exact same time is pretty slim; particularly since we've never had that problem occur in the past.

[Occulus]

7. You could give Wireshark a try

http://www.wireshark.org/

edit 1: This is a packet sniffer; it lets you see and analyze what data is getting sent where, which IP address it is being sent to, what IP addresses connections are coming/going to/from, and a lot more.

I've been using Capsa in Windows and your post made me look for one like Capsa for Ubuntu. Wireshark was in the Ubuntu Software Center.

I wouldn't get it from the website- use apt or the Software Center to grab it instead.

I'll install it now and let you know what I think in an edit.

EDIT 2: I had to sudo this app to get it to detect my network hardware, but this is a LOT like Capsa. I like it- it shows a whole lot of information; there's even a pane that shows the transferred information in hex as well as the hex info, decoded. All IP addresses are listed coming and going, you can view each packet and its contents individually.... this is a good tool to have on your system if you're concerned about unknown hosts and unauthorized connections.

Install this, NOW. It's free and it seems to be just what you're looking for.