Networking Forums  

Go Back   Networking Forums > Networking Newsgroups > Broadband Hardware

MN500 Continuously getting hacked

Reply
 
Thread Tools Display Modes
  #1  
Old 02-17-2004, 11:38 PM
Default MN500 Continuously getting hacked



I've discovered continued successful hack attempts on my
MN500 through my broadband modem. I have a very difficult
password, have upgraded the firmware to Oct 2003, have
changed the password, have the firewall option set,
discard pings, set up mac filtering, turned Wireless off,
and somehow someone is still able to get into the router
configuration and set Port Forwarding options and add MAC
addresses to the filter settings. The public software
firewalls, by the way, did not stop or report the
hacking. Fortunately, I just installed McAfee and it
reported external attempts to access my PC even though I
had all of the preventative measures above set. I have
had to resort to shutting down PCs when not in use. Does
anyone know if Microsoft has any newer patches to plug
this obvious security hole in the MN500? Any ideas other
than buying a new router? That's my next step.


John
Reply With Quote
  #2  
Old 02-17-2004, 11:54 PM
Chris H.
Guest
 
Posts: n/a
Default Re: MN500 Continuously getting hacked

What firewall are you running, and do you have any ports intentionally open?
What is the evidence that you're computer is being compromised?

If it is a Base Station Log entry like "Unauthorized HTTP Access <TCP/IP>
with an IP address followed, that's the firewall doing its job of blocking
access. Check this information:
http://www.practicallynetworked.com/...itythreats.htm

I suggest you try some of the free security tests like:
http://www.sdesign.com/securitytest/ or https://grc.com/x/ne.dll?bh0bkyd2
--
Chris H.
Microsoft Windows MVP
Associate Expert
Expert Zone - www.microsoft.com/windowsxp/expertzone

"John" <(E-Mail Removed)> wrote in message
news:1189301c3f5af$154262e0$(E-Mail Removed)...
> I've discovered continued successful hack attempts on my
> MN500 through my broadband modem. I have a very difficult
> password, have upgraded the firmware to Oct 2003, have
> changed the password, have the firewall option set,
> discard pings, set up mac filtering, turned Wireless off,
> and somehow someone is still able to get into the router
> configuration and set Port Forwarding options and add MAC
> addresses to the filter settings. The public software
> firewalls, by the way, did not stop or report the
> hacking. Fortunately, I just installed McAfee and it
> reported external attempts to access my PC even though I
> had all of the preventative measures above set. I have
> had to resort to shutting down PCs when not in use. Does
> anyone know if Microsoft has any newer patches to plug
> this obvious security hole in the MN500? Any ideas other
> than buying a new router? That's my next step.



Reply With Quote
  #3  
Old 02-18-2004, 02:50 PM
John
Guest
 
Posts: n/a
Default Re: MN500 Continuously getting hacked

Chris,

Current firewall is McAfee. Former firewall was Kerio.
No ports were explicitly set to be open.
The hacker is apparently getting into the MN-500
configuration and setting Persistent Port Forwarding
settings to IP addresses that are in my DHCP range. I've
changed the Password, removed the Port Forwarding
settings, only to have them reappear. In addition, there
was a MAC address added to the MAC filter list that I had
not entered. McAfee detected the attempted hacking
through port 8224 after I installed it on my PC. Port
8224 was in the range that was set up in the Persistent
port forwarding settings in the router.

The system has been thoroughly virus scanned using both
Norton and McAfee.

Is MS aware of a security hold in the MN500 firmware?

John


>-----Original Message-----
>What firewall are you running, and do you have any ports

intentionally open?
>What is the evidence that you're computer is being

compromised?
>
>If it is a Base Station Log entry like "Unauthorized HTTP

Access <TCP/IP>
>with an IP address followed, that's the firewall doing

its job of blocking
>access. Check this information:
>http://www.practicallynetworked.com/...securitythreat

s.htm
>
>I suggest you try some of the free security tests like:
>http://www.sdesign.com/securitytest/ or

https://grc.com/x/ne.dll?bh0bkyd2
>--
>Chris H.
>Microsoft Windows MVP
>Associate Expert
>Expert Zone - www.microsoft.com/windowsxp/expertzone
>
>"John" <(E-Mail Removed)> wrote in

message
>news:1189301c3f5af$154262e0$(E-Mail Removed)...
>> I've discovered continued successful hack attempts on my
>> MN500 through my broadband modem. I have a very

difficult
>> password, have upgraded the firmware to Oct 2003, have
>> changed the password, have the firewall option set,
>> discard pings, set up mac filtering, turned Wireless

off,
>> and somehow someone is still able to get into the router
>> configuration and set Port Forwarding options and add

MAC
>> addresses to the filter settings. The public software
>> firewalls, by the way, did not stop or report the
>> hacking. Fortunately, I just installed McAfee and it
>> reported external attempts to access my PC even though I
>> had all of the preventative measures above set. I have
>> had to resort to shutting down PCs when not in use.

Does
>> anyone know if Microsoft has any newer patches to plug
>> this obvious security hole in the MN500? Any ideas

other
>> than buying a new router? That's my next step.

>
>
>.
>

Reply With Quote
  #4  
Old 02-18-2004, 02:59 PM
Chris H.
Guest
 
Posts: n/a
Default Re: MN500 Continuously getting hacked

You disabled the base station firewall? You should be running it. Keep in
mind some of those ports you're seeing open could be - remember I said could
be - from programs you're using such as Messenger. I would trust the
hardware firewall before McAfee or anything Norton.

Running a software firewall "handles" the outside invasions once it is to
the machine which has the software running, in other words AFTER the base
station and already within your LAN. Running the base station firewall
prohibits the intrusion from getting to even the base station itself.
--
Chris H.
Microsoft Windows MVP
Associate Expert
Expert Zone - www.microsoft.com/windowsxp/expertzone

"John" <(E-Mail Removed)> wrote in message
news:1265601c3f62e$9d9e6d80$(E-Mail Removed)...
> Chris,
>
> Current firewall is McAfee. Former firewall was Kerio.
> No ports were explicitly set to be open.
> The hacker is apparently getting into the MN-500
> configuration and setting Persistent Port Forwarding
> settings to IP addresses that are in my DHCP range. I've
> changed the Password, removed the Port Forwarding
> settings, only to have them reappear. In addition, there
> was a MAC address added to the MAC filter list that I had
> not entered. McAfee detected the attempted hacking
> through port 8224 after I installed it on my PC. Port
> 8224 was in the range that was set up in the Persistent
> port forwarding settings in the router.
>
> The system has been thoroughly virus scanned using both
> Norton and McAfee.
>
> Is MS aware of a security hold in the MN500 firmware?
>
> John
>
>
> >-----Original Message-----
> >What firewall are you running, and do you have any ports

> intentionally open?
> >What is the evidence that you're computer is being

> compromised?
> >
> >If it is a Base Station Log entry like "Unauthorized HTTP

> Access <TCP/IP>
> >with an IP address followed, that's the firewall doing

> its job of blocking
> >access. Check this information:
> >http://www.practicallynetworked.com/...securitythreat

> s.htm
> >
> >I suggest you try some of the free security tests like:
> >http://www.sdesign.com/securitytest/ or

> https://grc.com/x/ne.dll?bh0bkyd2
> >--
> >Chris H.
> >Microsoft Windows MVP
> >Associate Expert
> >Expert Zone - www.microsoft.com/windowsxp/expertzone
> >
> >"John" <(E-Mail Removed)> wrote in

> message
> >news:1189301c3f5af$154262e0$(E-Mail Removed)...
> >> I've discovered continued successful hack attempts on my
> >> MN500 through my broadband modem. I have a very

> difficult
> >> password, have upgraded the firmware to Oct 2003, have
> >> changed the password, have the firewall option set,
> >> discard pings, set up mac filtering, turned Wireless

> off,
> >> and somehow someone is still able to get into the router
> >> configuration and set Port Forwarding options and add

> MAC
> >> addresses to the filter settings. The public software
> >> firewalls, by the way, did not stop or report the
> >> hacking. Fortunately, I just installed McAfee and it
> >> reported external attempts to access my PC even though I
> >> had all of the preventative measures above set. I have
> >> had to resort to shutting down PCs when not in use.

> Does
> >> anyone know if Microsoft has any newer patches to plug
> >> this obvious security hole in the MN500? Any ideas

> other
> >> than buying a new router? That's my next step.

> >
> >
> >.
> >



Reply With Quote
  #5  
Old 02-18-2004, 06:09 PM
John
Guest
 
Posts: n/a
Default Re: MN500 Continuously getting hacked

Chris,
Thanks for the quick reply. No, I did NOT disable the
hardware firewall, I've had it running since day 1, nor do
I run MS messaging software. Even if I did, how would it
know to update the persistent port forwarding settings in
the MN500? That just doesn't make sense. I simply added
a better software firewall to my system.

This is why I am concerned, even the hardware firewall is
not stopping the intrusions.

John

>-----Original Message-----
>You disabled the base station firewall? You should be

running it. Keep in
>mind some of those ports you're seeing open could be -

remember I said could
>be - from programs you're using such as Messenger. I

would trust the
>hardware firewall before McAfee or anything Norton.
>
>Running a software firewall "handles" the outside

invasions once it is to
>the machine which has the software running, in other

words AFTER the base
>station and already within your LAN. Running the base

station firewall
>prohibits the intrusion from getting to even the base

station itself.
>--
>Chris H.
>Microsoft Windows MVP
>Associate Expert
>Expert Zone - www.microsoft.com/windowsxp/expertzone
>
>"John" <(E-Mail Removed)> wrote in

message
>news:1265601c3f62e$9d9e6d80$(E-Mail Removed)...
>> Chris,
>>
>> Current firewall is McAfee. Former firewall was Kerio.
>> No ports were explicitly set to be open.
>> The hacker is apparently getting into the MN-500
>> configuration and setting Persistent Port Forwarding
>> settings to IP addresses that are in my DHCP range.

I've
>> changed the Password, removed the Port Forwarding
>> settings, only to have them reappear. In addition,

there
>> was a MAC address added to the MAC filter list that I

had
>> not entered. McAfee detected the attempted hacking
>> through port 8224 after I installed it on my PC. Port
>> 8224 was in the range that was set up in the Persistent
>> port forwarding settings in the router.
>>
>> The system has been thoroughly virus scanned using both
>> Norton and McAfee.
>>
>> Is MS aware of a security hold in the MN500 firmware?
>>
>> John
>>
>>
>> >-----Original Message-----
>> >What firewall are you running, and do you have any

ports
>> intentionally open?
>> >What is the evidence that you're computer is being

>> compromised?
>> >
>> >If it is a Base Station Log entry like "Unauthorized

HTTP
>> Access <TCP/IP>
>> >with an IP address followed, that's the firewall doing

>> its job of blocking
>> >access. Check this information:

>>

>http://www.practicallynetworked.com/...securitythreat
>> s.htm
>> >
>> >I suggest you try some of the free security tests like:
>> >http://www.sdesign.com/securitytest/ or

>> https://grc.com/x/ne.dll?bh0bkyd2
>> >--
>> >Chris H.
>> >Microsoft Windows MVP
>> >Associate Expert
>> >Expert Zone - www.microsoft.com/windowsxp/expertzone
>> >
>> >"John" <(E-Mail Removed)> wrote in

>> message
>> >news:1189301c3f5af$154262e0$(E-Mail Removed)...
>> >> I've discovered continued successful hack attempts

on my
>> >> MN500 through my broadband modem. I have a very

>> difficult
>> >> password, have upgraded the firmware to Oct 2003,

have
>> >> changed the password, have the firewall option set,
>> >> discard pings, set up mac filtering, turned Wireless

>> off,
>> >> and somehow someone is still able to get into the

router
>> >> configuration and set Port Forwarding options and add

>> MAC
>> >> addresses to the filter settings. The public

software
>> >> firewalls, by the way, did not stop or report the
>> >> hacking. Fortunately, I just installed McAfee and it
>> >> reported external attempts to access my PC even

though I
>> >> had all of the preventative measures above set. I

have
>> >> had to resort to shutting down PCs when not in use.

>> Does
>> >> anyone know if Microsoft has any newer patches to

plug
>> >> this obvious security hole in the MN500? Any ideas

>> other
>> >> than buying a new router? That's my next step.
>> >
>> >
>> >.
>> >

>
>
>.
>

Reply With Quote
  #6  
Old 02-18-2004, 06:34 PM
Chris H.
Guest
 
Posts: n/a
Default Re: MN500 Continuously getting hacked

Have you tested the firewall independently at the URLs I posted? I
seriously suspect you've got a Trojan on the inside.
--
Chris H.
Microsoft Windows MVP
Associate Expert
Expert Zone - www.microsoft.com/windowsxp/expertzone

"John" <(E-Mail Removed)> wrote in message
news:11d4a01c3f64a$50cef8a0$(E-Mail Removed)...
> Chris,
> Thanks for the quick reply. No, I did NOT disable the
> hardware firewall, I've had it running since day 1, nor do
> I run MS messaging software. Even if I did, how would it
> know to update the persistent port forwarding settings in
> the MN500? That just doesn't make sense. I simply added
> a better software firewall to my system.
>
> This is why I am concerned, even the hardware firewall is
> not stopping the intrusions.
>
> John
>
> >-----Original Message-----
> >You disabled the base station firewall? You should be

> running it. Keep in
> >mind some of those ports you're seeing open could be -

> remember I said could
> >be - from programs you're using such as Messenger. I

> would trust the
> >hardware firewall before McAfee or anything Norton.
> >
> >Running a software firewall "handles" the outside

> invasions once it is to
> >the machine which has the software running, in other

> words AFTER the base
> >station and already within your LAN. Running the base

> station firewall
> >prohibits the intrusion from getting to even the base

> station itself.
> >--
> >Chris H.
> >Microsoft Windows MVP
> >Associate Expert
> >Expert Zone - www.microsoft.com/windowsxp/expertzone
> >
> >"John" <(E-Mail Removed)> wrote in

> message
> >news:1265601c3f62e$9d9e6d80$(E-Mail Removed)...
> >> Chris,
> >>
> >> Current firewall is McAfee. Former firewall was Kerio.
> >> No ports were explicitly set to be open.
> >> The hacker is apparently getting into the MN-500
> >> configuration and setting Persistent Port Forwarding
> >> settings to IP addresses that are in my DHCP range.

> I've
> >> changed the Password, removed the Port Forwarding
> >> settings, only to have them reappear. In addition,

> there
> >> was a MAC address added to the MAC filter list that I

> had
> >> not entered. McAfee detected the attempted hacking
> >> through port 8224 after I installed it on my PC. Port
> >> 8224 was in the range that was set up in the Persistent
> >> port forwarding settings in the router.
> >>
> >> The system has been thoroughly virus scanned using both
> >> Norton and McAfee.
> >>
> >> Is MS aware of a security hold in the MN500 firmware?
> >>
> >> John
> >>
> >>
> >> >-----Original Message-----
> >> >What firewall are you running, and do you have any

> ports
> >> intentionally open?
> >> >What is the evidence that you're computer is being
> >> compromised?
> >> >
> >> >If it is a Base Station Log entry like "Unauthorized

> HTTP
> >> Access <TCP/IP>
> >> >with an IP address followed, that's the firewall doing
> >> its job of blocking
> >> >access. Check this information:
> >>

> >http://www.practicallynetworked.com/...securitythreat
> >> s.htm
> >> >
> >> >I suggest you try some of the free security tests like:
> >> >http://www.sdesign.com/securitytest/ or
> >> https://grc.com/x/ne.dll?bh0bkyd2
> >> >--
> >> >Chris H.
> >> >Microsoft Windows MVP
> >> >Associate Expert
> >> >Expert Zone - www.microsoft.com/windowsxp/expertzone
> >> >
> >> >"John" <(E-Mail Removed)> wrote in
> >> message
> >> >news:1189301c3f5af$154262e0$(E-Mail Removed)...
> >> >> I've discovered continued successful hack attempts

> on my
> >> >> MN500 through my broadband modem. I have a very
> >> difficult
> >> >> password, have upgraded the firmware to Oct 2003,

> have
> >> >> changed the password, have the firewall option set,
> >> >> discard pings, set up mac filtering, turned Wireless
> >> off,
> >> >> and somehow someone is still able to get into the

> router
> >> >> configuration and set Port Forwarding options and add
> >> MAC
> >> >> addresses to the filter settings. The public

> software
> >> >> firewalls, by the way, did not stop or report the
> >> >> hacking. Fortunately, I just installed McAfee and it
> >> >> reported external attempts to access my PC even

> though I
> >> >> had all of the preventative measures above set. I

> have
> >> >> had to resort to shutting down PCs when not in use.
> >> Does
> >> >> anyone know if Microsoft has any newer patches to

> plug
> >> >> this obvious security hole in the MN500? Any ideas
> >> other
> >> >> than buying a new router? That's my next step.
> >> >
> >> >
> >> >.
> >> >

> >
> >
> >.
> >



Reply With Quote
  #7  
Old 02-18-2004, 08:57 PM
John
Guest
 
Posts: n/a
Default Re: MN500 Continuously getting hacked

I'm fully up to date on the most recent McAfee antivirus
software as well as Windows Critical security patches.
I'll try the security tests this evening. If there is a
trojan in my system, its one that nobody knows about yet.

Thanks,

John

>-----Original Message-----
>Have you tested the firewall independently at the URLs I

posted? I
>seriously suspect you've got a Trojan on the inside.
>--
>Chris H.
>Microsoft Windows MVP
>Associate Expert
>Expert Zone - www.microsoft.com/windowsxp/expertzone
>
>"John" <(E-Mail Removed)> wrote in

message
>news:11d4a01c3f64a$50cef8a0$(E-Mail Removed)...
>> Chris,
>> Thanks for the quick reply. No, I did NOT disable the
>> hardware firewall, I've had it running since day 1, nor

do
>> I run MS messaging software. Even if I did, how would

it
>> know to update the persistent port forwarding settings

in
>> the MN500? That just doesn't make sense. I simply

added
>> a better software firewall to my system.
>>
>> This is why I am concerned, even the hardware firewall

is
>> not stopping the intrusions.
>>
>> John
>>
>> >-----Original Message-----
>> >You disabled the base station firewall? You should be

>> running it. Keep in
>> >mind some of those ports you're seeing open could be -

>> remember I said could
>> >be - from programs you're using such as Messenger. I

>> would trust the
>> >hardware firewall before McAfee or anything Norton.
>> >
>> >Running a software firewall "handles" the outside

>> invasions once it is to
>> >the machine which has the software running, in other

>> words AFTER the base
>> >station and already within your LAN. Running the base

>> station firewall
>> >prohibits the intrusion from getting to even the base

>> station itself.
>> >--
>> >Chris H.
>> >Microsoft Windows MVP
>> >Associate Expert
>> >Expert Zone - www.microsoft.com/windowsxp/expertzone
>> >
>> >"John" <(E-Mail Removed)> wrote in

>> message
>> >news:1265601c3f62e$9d9e6d80$(E-Mail Removed)...
>> >> Chris,
>> >>
>> >> Current firewall is McAfee. Former firewall was

Kerio.
>> >> No ports were explicitly set to be open.
>> >> The hacker is apparently getting into the MN-500
>> >> configuration and setting Persistent Port Forwarding
>> >> settings to IP addresses that are in my DHCP range.

>> I've
>> >> changed the Password, removed the Port Forwarding
>> >> settings, only to have them reappear. In addition,

>> there
>> >> was a MAC address added to the MAC filter list that I

>> had
>> >> not entered. McAfee detected the attempted hacking
>> >> through port 8224 after I installed it on my PC.

Port
>> >> 8224 was in the range that was set up in the

Persistent
>> >> port forwarding settings in the router.
>> >>
>> >> The system has been thoroughly virus scanned using

both
>> >> Norton and McAfee.
>> >>
>> >> Is MS aware of a security hold in the MN500 firmware?
>> >>
>> >> John
>> >>
>> >>
>> >> >-----Original Message-----
>> >> >What firewall are you running, and do you have any

>> ports
>> >> intentionally open?
>> >> >What is the evidence that you're computer is being
>> >> compromised?
>> >> >
>> >> >If it is a Base Station Log entry like "Unauthorized

>> HTTP
>> >> Access <TCP/IP>
>> >> >with an IP address followed, that's the firewall

doing
>> >> its job of blocking
>> >> >access. Check this information:
>> >>

>>

>http://www.practicallynetworked.com/...securitythreat
>> >> s.htm
>> >> >
>> >> >I suggest you try some of the free security tests

like:
>> >> >http://www.sdesign.com/securitytest/ or
>> >> https://grc.com/x/ne.dll?bh0bkyd2
>> >> >--
>> >> >Chris H.
>> >> >Microsoft Windows MVP
>> >> >Associate Expert
>> >> >Expert Zone - www.microsoft.com/windowsxp/expertzone
>> >> >
>> >> >"John" <(E-Mail Removed)> wrote

in
>> >> message
>> >> >news:1189301c3f5af$154262e0$(E-Mail Removed)...
>> >> >> I've discovered continued successful hack attempts

>> on my
>> >> >> MN500 through my broadband modem. I have a very
>> >> difficult
>> >> >> password, have upgraded the firmware to Oct 2003,

>> have
>> >> >> changed the password, have the firewall option

set,
>> >> >> discard pings, set up mac filtering, turned

Wireless
>> >> off,
>> >> >> and somehow someone is still able to get into the

>> router
>> >> >> configuration and set Port Forwarding options and

add
>> >> MAC
>> >> >> addresses to the filter settings. The public

>> software
>> >> >> firewalls, by the way, did not stop or report the
>> >> >> hacking. Fortunately, I just installed McAfee

and it
>> >> >> reported external attempts to access my PC even

>> though I
>> >> >> had all of the preventative measures above set. I

>> have
>> >> >> had to resort to shutting down PCs when not in

use.
>> >> Does
>> >> >> anyone know if Microsoft has any newer patches to

>> plug
>> >> >> this obvious security hole in the MN500? Any

ideas
>> >> other
>> >> >> than buying a new router? That's my next step.
>> >> >
>> >> >
>> >> >.
>> >> >
>> >
>> >
>> >.
>> >

>
>
>.
>

Reply With Quote
  #8  
Old 02-18-2004, 10:09 PM
Chris H.
Guest
 
Posts: n/a
Default Re: MN500 Continuously getting hacked

An anti-virus won't necessarily catch Trojans.
--
Chris H.
Microsoft Windows MVP
Associate Expert
Expert Zone - www.microsoft.com/windowsxp/expertzone

"John" <(E-Mail Removed)> wrote in message
news:12b9301c3f661$debd3bb0$(E-Mail Removed)...
> I'm fully up to date on the most recent McAfee antivirus
> software as well as Windows Critical security patches.
> I'll try the security tests this evening. If there is a
> trojan in my system, its one that nobody knows about yet.
>
> Thanks,
>
> John
>
> >-----Original Message-----
> >Have you tested the firewall independently at the URLs I

> posted? I
> >seriously suspect you've got a Trojan on the inside.
> >--
> >Chris H.
> >Microsoft Windows MVP
> >Associate Expert
> >Expert Zone - www.microsoft.com/windowsxp/expertzone
> >
> >"John" <(E-Mail Removed)> wrote in

> message
> >news:11d4a01c3f64a$50cef8a0$(E-Mail Removed)...
> >> Chris,
> >> Thanks for the quick reply. No, I did NOT disable the
> >> hardware firewall, I've had it running since day 1, nor

> do
> >> I run MS messaging software. Even if I did, how would

> it
> >> know to update the persistent port forwarding settings

> in
> >> the MN500? That just doesn't make sense. I simply

> added
> >> a better software firewall to my system.
> >>
> >> This is why I am concerned, even the hardware firewall

> is
> >> not stopping the intrusions.
> >>
> >> John
> >>
> >> >-----Original Message-----
> >> >You disabled the base station firewall? You should be
> >> running it. Keep in
> >> >mind some of those ports you're seeing open could be -
> >> remember I said could
> >> >be - from programs you're using such as Messenger. I
> >> would trust the
> >> >hardware firewall before McAfee or anything Norton.
> >> >
> >> >Running a software firewall "handles" the outside
> >> invasions once it is to
> >> >the machine which has the software running, in other
> >> words AFTER the base
> >> >station and already within your LAN. Running the base
> >> station firewall
> >> >prohibits the intrusion from getting to even the base
> >> station itself.
> >> >--
> >> >Chris H.
> >> >Microsoft Windows MVP
> >> >Associate Expert
> >> >Expert Zone - www.microsoft.com/windowsxp/expertzone
> >> >
> >> >"John" <(E-Mail Removed)> wrote in
> >> message
> >> >news:1265601c3f62e$9d9e6d80$(E-Mail Removed)...
> >> >> Chris,
> >> >>
> >> >> Current firewall is McAfee. Former firewall was

> Kerio.
> >> >> No ports were explicitly set to be open.
> >> >> The hacker is apparently getting into the MN-500
> >> >> configuration and setting Persistent Port Forwarding
> >> >> settings to IP addresses that are in my DHCP range.
> >> I've
> >> >> changed the Password, removed the Port Forwarding
> >> >> settings, only to have them reappear. In addition,
> >> there
> >> >> was a MAC address added to the MAC filter list that I
> >> had
> >> >> not entered. McAfee detected the attempted hacking
> >> >> through port 8224 after I installed it on my PC.

> Port
> >> >> 8224 was in the range that was set up in the

> Persistent
> >> >> port forwarding settings in the router.
> >> >>
> >> >> The system has been thoroughly virus scanned using

> both
> >> >> Norton and McAfee.
> >> >>
> >> >> Is MS aware of a security hold in the MN500 firmware?
> >> >>
> >> >> John
> >> >>
> >> >>
> >> >> >-----Original Message-----
> >> >> >What firewall are you running, and do you have any
> >> ports
> >> >> intentionally open?
> >> >> >What is the evidence that you're computer is being
> >> >> compromised?
> >> >> >
> >> >> >If it is a Base Station Log entry like "Unauthorized
> >> HTTP
> >> >> Access <TCP/IP>
> >> >> >with an IP address followed, that's the firewall

> doing
> >> >> its job of blocking
> >> >> >access. Check this information:
> >> >>
> >>

> >http://www.practicallynetworked.com/...securitythreat
> >> >> s.htm
> >> >> >
> >> >> >I suggest you try some of the free security tests

> like:
> >> >> >http://www.sdesign.com/securitytest/ or
> >> >> https://grc.com/x/ne.dll?bh0bkyd2
> >> >> >--
> >> >> >Chris H.
> >> >> >Microsoft Windows MVP
> >> >> >Associate Expert
> >> >> >Expert Zone - www.microsoft.com/windowsxp/expertzone
> >> >> >
> >> >> >"John" <(E-Mail Removed)> wrote

> in
> >> >> message
> >> >> >news:1189301c3f5af$154262e0$(E-Mail Removed)...
> >> >> >> I've discovered continued successful hack attempts
> >> on my
> >> >> >> MN500 through my broadband modem. I have a very
> >> >> difficult
> >> >> >> password, have upgraded the firmware to Oct 2003,
> >> have
> >> >> >> changed the password, have the firewall option

> set,
> >> >> >> discard pings, set up mac filtering, turned

> Wireless
> >> >> off,
> >> >> >> and somehow someone is still able to get into the
> >> router
> >> >> >> configuration and set Port Forwarding options and

> add
> >> >> MAC
> >> >> >> addresses to the filter settings. The public
> >> software
> >> >> >> firewalls, by the way, did not stop or report the
> >> >> >> hacking. Fortunately, I just installed McAfee

> and it
> >> >> >> reported external attempts to access my PC even
> >> though I
> >> >> >> had all of the preventative measures above set. I
> >> have
> >> >> >> had to resort to shutting down PCs when not in

> use.
> >> >> Does
> >> >> >> anyone know if Microsoft has any newer patches to
> >> plug
> >> >> >> this obvious security hole in the MN500? Any

> ideas
> >> >> other
> >> >> >> than buying a new router? That's my next step.
> >> >> >
> >> >> >
> >> >> >.
> >> >> >
> >> >
> >> >
> >> >.
> >> >

> >
> >
> >.
> >



Reply With Quote
Reply

Tags
continuously, hacked, mn500

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump


All times are GMT. The time now is 08:59 PM.


Powered by vBulletin® Version 3.7.3
Copyright ©2000 - 2008, Jelsoft Enterprises Ltd.