Linksys WRT54GS v5.0 Wireless Router question

Does anyone have an idea as to how, or why, my Linksys WRT54GS v5.0 Wireless Router
would suddenly revert to factory default settings on it's own?

All was fine last night. Today, no connection, and it took almost an hour to figure out that
every setting reverted to out-of-the-box defaults. Logon password, encryption key, port
forwarding, SSID name, etc.
It's unlikely someone accessed it as the logon password was changed and the SSID wasn't
being broadcast. I know, I know, that doesn't mean that it wasn't hacked, but that, plus my
location, makes it unlikely.

There was no power failures, spikes, or brownouts. (I have other devices to monitor that) and
it has been working fine since, but I wonder if something is failing in the router...

Fortunately, I had saved the settings so it only took a few seconds to get all back to normal.

Has anyone else run across this?

Thanks

Unk <(E-Mail Removed)> hath wroth:

>Does anyone have an idea as to how, or why, my Linksys WRT54GS v5.0 Wireless Router
>would suddenly revert to factory default settings on it's own?

Well, the full moon is 2 days away, so that's not it. When that
happens to me, it's usually the result of accidentally punching the
reset button, zapping the router with a static blast, power surge
through the DC power lines, or exposure to RF from one of my VHF/UHF
radios.

>All was fine last night. Today, no connection, and it took almost an hour to figure out that
>every setting reverted to out-of-the-box defaults. Logon password, encryption key, port
>forwarding, SSID name, etc.

I haven't seen it with the WRT54GS v5.0. However, I've had several
customers WRT54G routers (various revisions) decide to reset
themselves. One did it twice. However, when I updated the firmware
to later versions or replaced it with DD-WRT, the reset to defaults
problem went away.

>It's unlikely someone accessed it as the logon password was changed and the SSID wasn't
>being broadcast. I know, I know, that doesn't mean that it wasn't hacked, but that, plus my
>location, makes it unlikely.

So, try some exploit tests:
<http://www.pcflank.com/exploits.htm>
Most version of the WRT54G firmware that I've tried pass all the
tests, but I've had earlier junk crash and hang.

>There was no power failures, spikes, or brownouts. (I have other devices to monitor that) and
>it has been working fine since, but I wonder if something is failing in the router...

Overheating? RF? Static blast? Creative DC power supply (do it
thyself PoE)?

>Fortunately, I had saved the settings so it only took a few seconds to get all back to normal.
>
>Has anyone else run across this?

Not with the v5 mutation. I've returned all the v5 and v6 routers
that I've run across (or run over) to the vendor and bought something
else. I don't like them and have had performance and connection limit
problems that didn't go away with later updates or switching to
DD-WRT:
<http://www.smallnetbuilder.com/content/view/26843/51/>

--
Jeff Liebermann (E-Mail Removed)
150 Felker St #D http://www.LearnByDestroying.com
Santa Cruz CA 95060 http://802.11junk.com
Skype: JeffLiebermann AE6KS 831-336-2558

On Sun, 29 Apr 2007 22:52:59 -0700, Jeff Liebermann <(E-Mail Removed)> wrote:

>Unk <(E-Mail Removed)> hath wroth:
>
>>Does anyone have an idea as to how, or why, my Linksys WRT54GS v5.0 Wireless Router
>>would suddenly revert to factory default settings on it's own?
>
>Well, the full moon is 2 days away, so that's not it. When that
>happens to me, it's usually the result of accidentally punching the
>reset button, zapping the router with a static blast, power surge
>through the DC power lines, or exposure to RF from one of my VHF/UHF
>radios.

Wasn't any of your above suggestions. Hmmmmm, maybe a spike on the Comcast cable feed...
They DID hit the cable box with some firmware changes yesterday.
>
>>All was fine last night. Today, no connection, and it took almost an hour to figure out that
>>every setting reverted to out-of-the-box defaults. Logon password, encryption key, port
>>forwarding, SSID name, etc.
>
>I haven't seen it with the WRT54GS v5.0. However, I've had several
>customers WRT54G routers (various revisions) decide to reset
>themselves. One did it twice. However, when I updated the firmware
>to later versions or replaced it with DD-WRT, the reset to defaults
>problem went away.

Firmware version is 1.50.5. I see that Version 1.52.0 is available. I'll update it next time
I connect to the router with a cable.

>
>>It's unlikely someone accessed it as the logon password was changed and the SSID wasn't
>>being broadcast. I know, I know, that doesn't mean that it wasn't hacked, but that, plus my
>>location, makes it unlikely.
>
>So, try some exploit tests:
><http://www.pcflank.com/exploits.htm>

Nice link. Thanks.
It passed all the exploits tests, as well as Steve Gibson's "Shields UP" test.

>Most version of the WRT54G firmware that I've tried pass all the
>tests, but I've had earlier junk crash and hang.
>
>>There was no power failures, spikes, or brownouts. (I have other devices to monitor that) and
>>it has been working fine since, but I wonder if something is failing in the router...
>
>Overheating? RF? Static blast? Creative DC power supply (do it
>thyself PoE)?

Nope, none of the above. "Do it thyself..." hehe

>
>>Fortunately, I had saved the settings so it only took a few seconds to get all back to normal.
>>
>>Has anyone else run across this?
>
>Not with the v5 mutation. I've returned all the v5 and v6 routers
>that I've run across (or run over) to the vendor and bought something
>else. I don't like them and have had performance and connection limit
>problems that didn't go away with later updates or switching to
>DD-WRT:
><http://www.smallnetbuilder.com/content/view/26843/51/>

Maybe someone doing a little Network Stumbler war driving got around the Linksys logon
password... If so, they're a little disappointed. The computers were off so all they got into
was the router. Nah, must have been the Comcast cable firmware hit,

Thanks for the input Jeff.

On Mon, 30 Apr 2007 01:27:49 -0400, Unk <(E-Mail Removed)> wrote in
<(E-Mail Removed)>:

>Does anyone have an idea as to how, or why, my Linksys WRT54GS v5.0 Wireless Router
>would suddenly revert to factory default settings on it's own?

A likely culprit is Flash memory failure. If it happens again, replace
the hardware.

--
Best regards, FAQ for Wireless Internet: <http://Wireless.wikia.com>
John Navas FAQ for Wi-Fi: <http://wireless.wikia.com/wiki/Wi-Fi>
Wi-Fi How To: <http://wireless.wikia.com/wiki/Wi-Fi_HowTo>
Fixes to Wi-Fi Problems: <http://wireless.wikia.com/wiki/Wi-Fi_Fixes>

On Mon, 30 Apr 2007 02:42:37 -0400, Unk <(E-Mail Removed)> wrote:

>Wasn't any of your above suggestions. Hmmmmm, maybe a spike on the Comcast cable feed...
>They DID hit the cable box with some firmware changes yesterday.

Methinks thou hath a bright imagination. There be not any way that a
Comcrash update could possibly reset thy router unto its defaults.
Were this possible, methinks it would make a dandy denial-o-service
attack and would surely be popular among the lower classes of
hackerdom.

>Firmware version is 1.50.5. I see that Version 1.52.0 is available. I'll update it next time
>I connect to the router with a cable.

What manner of rot be this? Thou hast inscribed the versions for the
BEFW11S4v4 unto which I am vastly familiar. The current version for
the WRT54G v5 be 1.02.0 as found at:
<http://www.linksys.com/servlet/Satellite?c=L_CASupport_C2&childpagename=US%2FLayo ut&cid=1166859837401&pagename=Linksys%2FCommon%2FV isitorWrapper&lid=3740137314B268&displaypage=downl oad#versiondetail>
Be it that thou hast 1.50.5, then either thy model or version be
misthought.

>>Overheating? RF? Static blast? Creative DC power supply (do it
>>thyself PoE)?
>
>Nope, none of the above. "Do it thyself..." hehe

It be part of Learn By Destroying. Trvst me.

Be thy router password the default, or hath thou changeth it?

--
# Jeff Liebermann 150 Felker St #D Santa Cruz CA 95060
# 831-336-2558 (E-Mail Removed)
# http://802.11junk.com (E-Mail Removed)
# http://www.LearnByDestroying.com AE6KS

On Mon, 30 Apr 2007 19:39:07 GMT, John Navas <(E-Mail Removed)> wrote:

>On Mon, 30 Apr 2007 01:27:49 -0400, Unk <(E-Mail Removed)> wrote in
><(E-Mail Removed)>:
>
>>Does anyone have an idea as to how, or why, my Linksys WRT54GS v5.0 Wireless Router
>>would suddenly revert to factory default settings on it's own?
>
>A likely culprit is Flash memory failure. If it happens again, replace
>the hardware.

Thanks John, got a new model yesterday (Just in case...)

On Mon, 30 Apr 2007 23:26:34 GMT, Jeff Liebermann <(E-Mail Removed)> wrote:

>On Mon, 30 Apr 2007 02:42:37 -0400, Unk <(E-Mail Removed)> wrote:
>
>>Wasn't any of your above suggestions. Hmmmmm, maybe a spike on the Comcast cable feed...
>>They DID hit the cable box with some firmware changes yesterday.
>
>Methinks thou hath a bright imagination. There be not any way that a
>Comcrash update could possibly reset thy router unto its defaults.

No, but a voltage spike on the cable could spike through the cable modem into the router...

>Were this possible, methinks it would make a dandy denial-o-service
>attack and would surely be popular among the lower classes of
>hackerdom.

Always a possibility. John suggested a Flash memory failure. Got a spare yesterday, just in
case...
>
>>Firmware version is 1.50.5. I see that Version 1.52.0 is available. I'll update it next time
>>I connect to the router with a cable.
>
>What manner of rot be this? Thou hast inscribed the versions for the
>BEFW11S4v4 unto which I am vastly familiar. The current version for
>the WRT54G v5 be 1.02.0 as found at:
><http://www.linksys.com/servlet/Satellite?c=L_CASupport_C2&childpagename=US%2FLayo ut&cid=1166859837401&pagename=Linksys%2FCommon%2FV isitorWrapper&lid=3740137314B268&displaypage=downl oad#versiondetail>
>Be it that thou hast 1.50.5, then either thy model or version be
>misthought.

WRT54GS (as in SpeedBooster)
<http://www.linksys.com/servlet/Satellite?c=L_CASupport_C2&childpagename=US%2FLayo ut&cid=1166859761879&pagename=Linksys%2FCommon%2FV isitorWrapper&lid=6187937314B275&displaypage=downl oad#versiondetail>
Enter "Version 5.0" and voila, current version is 1.52.0 2/09/2007
Thou hast not read the subjest line. Shame on thee

>
>>>Overheating? RF? Static blast? Creative DC power supply (do it
>>>thyself PoE)?
>>
>>Nope, none of the above. "Do it thyself..." hehe
>
>It be part of Learn By Destroying. Trvst me.
>
>Be thy router password the default, or hath thou changeth it?

Changed it... Mother raised no fool.

Unk <(E-Mail Removed)> hath wroth:

>No, but a voltage spike on the cable could spike through the cable modem into the router...

A firmware update causing a voltage spike on the ethernet cable which
causes the router to reset to defaults? I doubt it. The ethernet
port is fairly well protected. It has to meet some IEEE voltage surge
and spike protection spec to about 1500 volts. All the data goes
through a small transformer, which acts as an excellent isolator.

>Always a possibility. John suggested a Flash memory failure. Got a spare yesterday, just in
>case...

Ummmm.... The flash chip is soldered onto the circuit board. It also
has a protected area with the TFTP server code, MAC address, and JTAG
routines. I don't think you're going to have any luck with a
replacement.

>WRT54GS (as in SpeedBooster)
><http://www.linksys.com/servlet/Satellite?c=L_CASupport_C2&childpagename=US%2FLayo ut&cid=1166859761879&pagename=Linksys%2FCommon%2FV isitorWrapper&lid=6187937314B275&displaypage=downl oad#versiondetail>
>Enter "Version 5.0" and voila, current version is 1.52.0 2/09/2007
>Thou hast not read the subjest line. Shame on thee

Oops, sorry. I was too busy trying to imitate Shakespeare that I
didn't notice the GS suffix. Try the update. If you look at the
history of 1.52.0 at:
http://www.linksys.com/servlet/Satel...=7063761879B69
you'll notice that it fixes BitTorrent issues. Normally, that
manifests itself as a hang, but might cause other problems. However,
you're computers were turned off when it cleared itself, so that's not
it.

>>Be thy router password the default, or hath thou changeth it?
>
>Changed it... Mother raised no fool.

Then the chances of someone connecting via the wireless, and resetting
the router from the web interface, is nil.


--
Jeff Liebermann (E-Mail Removed)
150 Felker St #D http://www.LearnByDestroying.com
Santa Cruz CA 95060 http://802.11junk.com
Skype: JeffLiebermann AE6KS 831-336-2558