Is it possible to use Wifi to hack a router?

Hi,
I met something strange in my system.
The condition is like that:
I have a wireless router(DLink). I didn't set any security password
for the Wifi because I worried about the speed. But I disabled the
DHCP,so every machine has to set its IP and gateway same with the
router. In my family, I have about 4 computers, that's not a big deal to
me. Yesterday suddenly I found my router's Wifi was locked! It's so
strange. Even somebody guessed my network IP range(192.168.0.x), how did
he know the router's manage page's user name and password? Although that
page is not https page, but if he wanted to hijack the package between
my client and the router, he had to first begin a ARP attack and mask
himself to a router(maybe he just acted as a package dispatcher to
router). I even cannot imagine that would happen because this is a tough
job. First he had to guess the IP range, then he had to write an ARP
attack program and mask program. Even I am a senior software engineer,
it will take me a couple of days and sometime we may stop before the
first step-guessing IP range. Or there is someone use the Wifi security
back door? I only know something about that news, but I don't know
exactly about it. I'm using Linux OS, it seemed that the hole hides in
the network? In fact, now I care technology more than the hack event
itself. Can someone explain it to me? I graduated from a famous Chinese
university's EE major. So don't hesitate to explain it in technology way.
Now what I can understand is that:
1. The hacker guessed out the IP range because it's so normal and
connected to the router using WIFI.
2. The hacker detect my laptop's IP and block the communication with
the router.
3. When there's any communication between server and router will find
it cannot communicate with the mac(because it's blocked). It will send a
broadcast, the hacker's machine will acknowledge the request.
4. The the hacker's machine may act as a package dispatcher that can
listen all packages between my laptop and the router.

Am I right?


Thanks in advance.

PP wrote:
> Hi,
> I met something strange in my system.
> The condition is like that:
> I have a wireless router(DLink). I didn't set any security password
> for the Wifi because I worried about the speed. But I disabled the
> DHCP,so every machine has to set its IP and gateway same with the
> router. In my family, I have about 4 computers, that's not a big deal to
> me. Yesterday suddenly I found my router's Wifi was locked! It's so
> strange. Even somebody guessed my network IP range(192.168.0.x), how did
> he know the router's manage page's user name and password? Although that
> page is not https page, but if he wanted to hijack the package between
> my client and the router, he had to first begin a ARP attack and mask
> himself to a router(maybe he just acted as a package dispatcher to
> router). I even cannot imagine that would happen because this is a tough
> job. First he had to guess the IP range, then he had to write an ARP
> attack program and mask program. Even I am a senior software engineer,
> it will take me a couple of days and sometime we may stop before the
> first step-guessing IP range. Or there is someone use the Wifi security
> back door? I only know something about that news, but I don't know
> exactly about it. I'm using Linux OS, it seemed that the hole hides in
> the network? In fact, now I care technology more than the hack event
> itself. Can someone explain it to me? I graduated from a famous Chinese
> university's EE major. So don't hesitate to explain it in technology way.
> Now what I can understand is that:
> 1. The hacker guessed out the IP range because it's so normal and
> connected to the router using WIFI.
> 2. The hacker detect my laptop's IP and block the communication with
> the router.
> 3. When there's any communication between server and router will find
> it cannot communicate with the mac(because it's blocked). It will send a
> broadcast, the hacker's machine will acknowledge the request.
> 4. The the hacker's machine may act as a package dispatcher that can
> listen all packages between my laptop and the router.
>
> Am I right?
>
>
> Thanks in advance.
Hi,
What is package dispatcher?

"PP" <(E-Mail Removed)> wrote in message
news:etcoo7$8cf$(E-Mail Removed)...

<SNIP>
> Am I right?
>

It's not as complex as you make it.

1) If a person used a program like NetStumbler - they could see your router
(including make and model)

2) IP addresses for routers by brand are very well known ... so even though
you disabled DHCP - they could still set themselves as a static IP and get
on your network.

3) Assuming you changed the admin page password .. they could a program to
crack your admin page, use AirSnort to sniff it, sniff it once they are on
your network, or even simply guess it.

Remember - a router is a multi device appliance ... router / nat ...
ethernet switch ... wireless access point ... security admin .... so - each
component needs be thought of separately.

PP <(E-Mail Removed)> wrote:
> I have a wireless router(DLink). I didn't set any security password
> for the Wifi because I worried about the speed. But I disabled the

There is likely minimal impact on speed. What speed are you concerned
with? My 802.11b link is faster than most internet connections.

> DHCP,so every machine has to set its IP and gateway same with the
> router.

Disabling DHCP does almost nothing for security.

> me. Yesterday suddenly I found my router's Wifi was locked! It's so

Your wifi may have failed. What makes you think it was hacked?

> strange. Even somebody guessed my network IP range(192.168.0.x), how did

192.168.0.x is the default subnet for many routers.
It might even have been set already in someone's laptop from a previous
dhcp, so when the PC tried to renew it's address, it succeeded.

> he know the router's manage page's user name and password? Although that

What indicates that anyone logged in to the router?

> first step-guessing IP range. Or there is someone use the Wifi security
> back door? I only know something about that news, but I don't know

What security back door? You had no security.

--
---
Clarence A Dold - Hidden Valley Lake, CA, USA GPS: 38.8,-122.5

On Fri, 16 Mar 2007 08:30:57 +0800, in alt.internet.wireless , PP
<(E-Mail Removed)> wrote:

>Hi,
> I met something strange in my system.
> The condition is like that:
> I have a wireless router(DLink). I didn't set any security password
>for the Wifi because I worried about the speed.

Bad idea. Its highly unlikely you will see any degradation due to
this,. unless you happen to be on 25Mb cable internet or better.

>But I disabled the
>DHCP,so every machine has to set its IP and gateway same with the
>router.

No security advantage at all.

>In my family, I have about 4 computers, that's not a big deal to
>me. Yesterday suddenly I found my router's Wifi was locked! It's so
>strange. Even somebody guessed my network IP range(192.168.0.x),

The default IP ranges of routers are
a) well known and published on the web (eg in manufacturers manuals);
and
b) determinable by listening to router traffic.

>how did
>he know the router's manage page's user name and password?

did you change it from the default?

--
Mark McIntyre