Was my router hacked?

Hi,

I have a DLink DI-624 router. I definitely know the login password, but
for some reason the passwords been changed.

1. How likely is it that someone hacked this router?
2. Is there any way I can get in without pushing the reset button. I
have tons of custom settings that I don't want to lose.

Thanks,
Paul

pmlonl...@gmail.com wrote:
> I have a DLink DI-624 router. I definitely know the login password, but
> for some reason the passwords been changed.
>
> 1. How likely is it that someone hacked this router?
> 2. Is there any way I can get in without pushing the reset button. I
> have tons of custom settings that I don't want to lose.

I'd like to add that I took all the security advice of TechTV guy Leo
Laporte in setting up the router.

Thanks,
Paul

did you save off the config? that way when you reset, you can reload the
last saved config...

<(E-Mail Removed)> wrote in message
news:(E-Mail Removed) oups.com...
> Hi,
>
> I have a DLink DI-624 router. I definitely know the login password, but
> for some reason the passwords been changed.
>
> 1. How likely is it that someone hacked this router?
> 2. Is there any way I can get in without pushing the reset button. I
> have tons of custom settings that I don't want to lose.
>
> Thanks,
> Paul
>

riggor99999 wrote:
> <(E-Mail Removed)> wrote in message
> news:(E-Mail Removed) oups.com...
> > Hi,
> >
> > I have a DLink DI-624 router. I definitely know the login password, but
> > for some reason the passwords been changed.
> >
> > 1. How likely is it that someone hacked this router?
> > 2. Is there any way I can get in without pushing the reset button. I
> > have tons of custom settings that I don't want to lose.
>
> did you save off the config? that way when you reset, you can reload the
> last saved config...


Yes, but being the dummy I am it's been a year and things have changed.

I wish their was a special tcp connection on the router I could connect
my computer to that didn't require login or perhaps a switch that
disabled login password. That would be nice for emergencies.

Thanks,
Paul

(E-Mail Removed) hath wroth:

>pmlonl...@gmail.com wrote:
>> I have a DLink DI-624 router. I definitely know the login password, but
>> for some reason the passwords been changed.
>>
>> 1. How likely is it that someone hacked this router?
>> 2. Is there any way I can get in without pushing the reset button. I
>> have tons of custom settings that I don't want to lose.
>
>I'd like to add that I took all the security advice of TechTV guy Leo
>Laporte in setting up the router.

Leo Laporte apparently recycles security advice from Steve Gibson
(grc.com). Opinions tend to vary radically as to the value of this
advice (and of Steve Gibson).
http://grc.com/securitynow.htm

I assume the router still functions, that you get the login screen,
and that you're just having problems getting it to accept the
password.

1. It might be reading the password from the browser cache, or from
saved passwords. Flush the cache or try a different browser or
machine.

2. I've seen weirdness with Java based authentication windows (i.e.
Sonicwall). I'm not sure if the DI-624 uses Java in its login window.
Probably not. I had to update Java to make it work. Checking...
http://support.dlink.com/emulators/di624/
Nope. Simple HTML.

3. Do you have remote management enabled on port 8080? If so, try
connecting to your WAN IP address at port 8080. It will have the same
password, but it might just function.

4. There are TWO logins and passwords in the DI-624. See:
http://support.dlink.com/emulators/d...ols_admin.html
If "admin" doesn't play, try the "user" login.

5. Have you tried using just a blank password (i.e. Enter)? If that
works, your router has probably been reset to defaults.

6. If you're trying to login via wireless, you may have some packet
loss due to reflections or interference. The password can also be
sniffed this way. Try logging in via a wired ethernet connection.

Hint: Nobody makes backups until after they've lost some work.

Good luck.

--
Jeff Liebermann (E-Mail Removed)
150 Felker St #D http://www.LearnByDestroying.com
Santa Cruz CA 95060 http://802.11junk.com
Skype: JeffLiebermann AE6KS 831-336-2558

(E-Mail Removed) wrote:
> riggor99999 wrote:
> > <(E-Mail Removed)> wrote in message
> > news:(E-Mail Removed) oups.com...
> > > Hi,
> > >
> > > I have a DLink DI-624 router. I definitely know the login password, but
> > > for some reason the passwords been changed.
> > >
> > > 1. How likely is it that someone hacked this router?
> > > 2. Is there any way I can get in without pushing the reset button. I
> > > have tons of custom settings that I don't want to lose.
> >
> > did you save off the config? that way when you reset, you can reload the
> > last saved config...
>
>
> Yes, but being the dummy I am it's been a year and things have changed.
>
> I wish their was a special tcp connection on the router I could connect
> my computer to that didn't require login or perhaps a switch that
> disabled login password. That would be nice for emergencies.


Well, I reset the router, logged in, loaded my 2005 settings. Then
decided to upgrade the routers firmware. So now it has the latest
firmware, but it resets the entire router. So I went to load my custom
settings again and it says, "CFG checksum error." Looks like the latest
firmware is not fully backwards compatible.

Thanks for any advice,
Paul

(E-Mail Removed) wrote:
>
> (E-Mail Removed) wrote:
>> riggor99999 wrote:
>> > <(E-Mail Removed)> wrote in message
>> > news:(E-Mail Removed) oups.com...
>> > > Hi,
>> > >
>> > > I have a DLink DI-624 router. I definitely know the login password, but
>> > > for some reason the passwords been changed.
>> > >
>> > > 1. How likely is it that someone hacked this router?
>> > > 2. Is there any way I can get in without pushing the reset button. I
>> > > have tons of custom settings that I don't want to lose.
>> >
>> > did you save off the config? that way when you reset, you can reload the
>> > last saved config...
>>
>>
>> Yes, but being the dummy I am it's been a year and things have changed.
>>
>> I wish their was a special tcp connection on the router I could connect
>> my computer to that didn't require login or perhaps a switch that
>> disabled login password. That would be nice for emergencies.
>
>
> Well, I reset the router, logged in, loaded my 2005 settings. Then
> decided to upgrade the routers firmware. So now it has the latest
> firmware, but it resets the entire router. So I went to load my custom
> settings again and it says, "CFG checksum error." Looks like the latest
> firmware is not fully backwards compatible.
>
> Thanks for any advice,
> Paul
>
I have a DI-524. The last time I upgraded the firmware I remember a
warning not to try to restore a configuration saved under the old
firmware.

Jerry

[POSTED TO alt.internet.wireless - REPLY ON USENET PLEASE]

In <(E-Mail Removed). com> on 29 Apr 2006
08:20:16 -0700, (E-Mail Removed) wrote:

>pmlonl...@gmail.com wrote:
>> I have a DLink DI-624 router. I definitely know the login password, but
>> for some reason the passwords been changed.
>>
>> 1. How likely is it that someone hacked this router?
>> 2. Is there any way I can get in without pushing the reset button. I
>> have tons of custom settings that I don't want to lose.
>
>I'd like to add that I took all the security advice of TechTV guy Leo
>Laporte in setting up the router.

LOL! He gets that advice, unfortunately, from Steve Gibson, who claims to be
a security wizard, but is anything but -- for example, see "Windows back door
rumor is bunk" <http://www.theregister.co.uk/2006/01/21/wmf_fud_from_grc/>

--
Best regards, SEE THE FAQ FOR ALT.INTERNET.WIRELESS AT
John Navas <http://en.wikibooks.org/wiki/FAQ_for_alt.internet.wireless>