A wireless innocent

My family have been using a wireless BB home network for some months
now with three desktop PCs connected. They are using an Addon router
and Plusnet and all has worked well.

Last week 4.28 Gb was used on a single day which resulted in Plusnet
sending an E mail advising an extra charge would be made as limits had
been exceeded.I have been investigating and have found that one
computer has DUmeter installed and no exceptional traffic recorded,
one computer was switched off all day, the third computer was switched
on between 1600 and 2200 hrs.

The family say that they did no unusual uploads or downloads so I am
trying to establish for my own benefit how this could have happened. I
have a wired connection and don`t know much about wireless. I have to
check if they have WAP enabled and have already checked their anti
virus, Ad Aware and Sygate firewall.

Could this happen with the computer off and does something like
DUmeter show any external use from a hacker for instance.

Thanks in advance for any help which will at least increase my
knowledge of wireless BB.

(E-Mail Removed) wrote:
> My family have been using a wireless BB home network for some months
> now with three desktop PCs connected. They are using an Addon router
> and Plusnet and all has worked well.
>
> Last week 4.28 Gb was used on a single day which resulted in Plusnet
> sending an E mail advising an extra charge would be made as limits had
> been exceeded.I have been investigating and have found that one
> computer has DUmeter installed and no exceptional traffic recorded,
> one computer was switched off all day, the third computer was switched
> on between 1600 and 2200 hrs.
>
> The family say that they did no unusual uploads or downloads so I am
> trying to establish for my own benefit how this could have happened. I
> have a wired connection and don`t know much about wireless. I have to
> check if they have WAP enabled and have already checked their anti
> virus, Ad Aware and Sygate firewall.
>
> Could this happen with the computer off and does something like
> DUmeter show any external use from a hacker for instance.
>
> Thanks in advance for any help which will at least increase my
> knowledge of wireless BB.

WAP isn't really any security, anyone in range, with a little knowledge,
could be using your connection.
--
Adrian A

<(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> My family have been using a wireless BB home network for some months
> now with three desktop PCs connected. They are using an Addon router
> and Plusnet and all has worked well.
>
> Last week 4.28 Gb was used on a single day which resulted in Plusnet
> sending an E mail advising an extra charge would be made as limits had
> been exceeded.I have been investigating and have found that one
> computer has DUmeter installed and no exceptional traffic recorded,
> one computer was switched off all day, the third computer was switched
> on between 1600 and 2200 hrs.
>
> The family say that they did no unusual uploads or downloads so I am
> trying to establish for my own benefit how this could have happened. I
> have a wired connection and don`t know much about wireless. I have to
> check if they have WAP enabled and have already checked their anti
> virus, Ad Aware and Sygate firewall.
>
> Could this happen with the computer off and does something like
> DUmeter show any external use from a hacker for instance.


> Thanks in advance for any help which will at least increase my
> knowledge of wireless BB.

If the wireless router was taken out of the box and switched it will have no
security at all! then yes anyone can easily access your network
'WEP' and/or restricting to the different PC's MAC addresses is the
absaloute minimum you should aim for depending what the router will support

If the wireless router is on, it runs independantly of the PC's so if there
is no security. So the DUmeter would not show anything, unless someone had
hacked into the pc and was downloading software from it.

You should be able to check the logs on the router and it should list all
the MAC addresses that have tried or succeeded in accessing the wireless
network.

If you put at least the basic WEP security on the network, it can be
'cracked' but it will stop the casual 'passer by' if you also add
restricting the Wireless router to the MAC address of the PCs on the network
also easily cloned but it adds another layer of difficulty, A lot of the
security on wireless networks can be overcome
It is not a good idea to hide the SSID as it can cause problems with
interference if there are other APs nearby and is too easily overcome!

To be honest that's what it's all about, persuading the 'hacker' to go
somewhere else simply by making it more difficult.

Usinging Netstumbler http://www.netstumbler.com/downloads/ which will
show all local Access Points and 'rogue' networks.

http://blogs.zdnet.com/Ou/index.php?p=41
http://blogs.zdnet.com/Ou/index.php?p=43
http://compnetworking.about.com/od/wirelessfaqs/

Some bedtime reading!!

Des

On Wed, 15 Mar 2006 10:02:23 +0000, (E-Mail Removed) wrote:

>My family have been using a wireless BB home network for some months
>now with three desktop PCs connected. They are using an Addon router
>and Plusnet and all has worked well.
>
>Last week 4.28 Gb was used on a single day which resulted in Plusnet
>sending an E mail advising an extra charge would be made as limits had
>been exceeded.I have been investigating and have found that one
>computer has DUmeter installed and no exceptional traffic recorded,
>one computer was switched off all day, the third computer was switched
>on between 1600 and 2200 hrs.
>
>The family say that they did no unusual uploads or downloads so I am
>trying to establish for my own benefit how this could have happened. I
>have a wired connection and don`t know much about wireless. I have to
>check if they have WAP enabled and have already checked their anti
>virus, Ad Aware and Sygate firewall.
>
>Could this happen with the computer off and does something like
>DUmeter show any external use from a hacker for instance.

First, it is not impossible that it could have been done with the
computer that was on for 6 hours, if they have a 2Mb connection - it
takes roughly 4000 seconds per GB at max throughput.

So there is a *possibility* that somebody was doing something they
don't want to admit to the rest of the family during that time.

But if they don't have WPA, or at least 128 bit WEP enabled, and the
router is on all the time, then it is also possible that somebody else
has been using their connection - possibly not even deliberately.

Depending on the make/model of router, you may be able to set it up to
monitor total traffic for the future, although you won't be able to
get that historically now. You will be able to set it up for the
future if the router supports SNMP.

DU Meter and similar only monitor traffic to/from the PC on which they
are running. This would show up any traffic resulting from a trojan on
the PC, but would not show any access from somebody else using the
router.
--
Alex Heney, Global Villager
SENILE.COM found: out of memory...
To reply by email, my address is alexATheneyDOTplusDOTcom

On Wed, 15 Mar 2006 11:27:13 +0000, Alex Heney <(E-Mail Removed)>
wrote:

>On Wed, 15 Mar 2006 10:02:23 +0000, (E-Mail Removed) wrote:
>
>>My family have been using a wireless BB home network for some months
>>now with three desktop PCs connected. They are using an Addon router
>>and Plusnet and all has worked well.
>>
>>Last week 4.28 Gb was used on a single day which resulted in Plusnet
>>sending an E mail advising an extra charge would be made as limits had
>>been exceeded.I have been investigating and have found that one
>>computer has DUmeter installed and no exceptional traffic recorded,
>>one computer was switched off all day, the third computer was switched
>>on between 1600 and 2200 hrs.
>>
>>The family say that they did no unusual uploads or downloads so I am
>>trying to establish for my own benefit how this could have happened. I
>>have a wired connection and don`t know much about wireless. I have to
>>check if they have WAP enabled and have already checked their anti
>>virus, Ad Aware and Sygate firewall.
>>
>>Could this happen with the computer off and does something like
>>DUmeter show any external use from a hacker for instance.
>
>First, it is not impossible that it could have been done with the
>computer that was on for 6 hours, if they have a 2Mb connection - it
>takes roughly 4000 seconds per GB at max throughput.
>
>So there is a *possibility* that somebody was doing something they
>don't want to admit to the rest of the family during that time.
>
>But if they don't have WPA, or at least 128 bit WEP enabled, and the
>router is on all the time, then it is also possible that somebody else
>has been using their connection - possibly not even deliberately.
>
>Depending on the make/model of router, you may be able to set it up to
>monitor total traffic for the future, although you won't be able to
>get that historically now. You will be able to set it up for the
>future if the router supports SNMP.
>
>DU Meter and similar only monitor traffic to/from the PC on which they
>are running. This would show up any traffic resulting from a trojan on
>the PC, but would not show any access from somebody else using the
>router.
Thank you gentlemen for your prompt and helpful replies.

A couple of follow up queries if I may.

The router is upstairs in a normal suburban house so what range would
the router have and are we talking about a chap in a parked car with a
laptop?

What do they do with the stolen bandwidth? 4 Gb is a fair bit

Thanks again

(E-Mail Removed) wrote:
> On Wed, 15 Mar 2006 11:27:13 +0000, Alex Heney <(E-Mail Removed)>
> wrote:
>
>> On Wed, 15 Mar 2006 10:02:23 +0000, (E-Mail Removed) wrote:
>>
>>> My family have been using a wireless BB home network for some months
>>> now with three desktop PCs connected. They are using an Addon router
>>> and Plusnet and all has worked well.
>>>
>>> Last week 4.28 Gb was used on a single day which resulted in Plusnet
>>> sending an E mail advising an extra charge would be made as limits
>>> had been exceeded.I have been investigating and have found that one
>>> computer has DUmeter installed and no exceptional traffic recorded,
>>> one computer was switched off all day, the third computer was
>>> switched on between 1600 and 2200 hrs.
>>>
>>> The family say that they did no unusual uploads or downloads so I am
>>> trying to establish for my own benefit how this could have
>>> happened. I have a wired connection and don`t know much about
>>> wireless. I have to check if they have WAP enabled and have already
>>> checked their anti virus, Ad Aware and Sygate firewall.
>>>
>>> Could this happen with the computer off and does something like
>>> DUmeter show any external use from a hacker for instance.
>>
>> First, it is not impossible that it could have been done with the
>> computer that was on for 6 hours, if they have a 2Mb connection - it
>> takes roughly 4000 seconds per GB at max throughput.
>>
>> So there is a *possibility* that somebody was doing something they
>> don't want to admit to the rest of the family during that time.
>>
>> But if they don't have WPA, or at least 128 bit WEP enabled, and the
>> router is on all the time, then it is also possible that somebody
>> else has been using their connection - possibly not even
>> deliberately.
>>
>> Depending on the make/model of router, you may be able to set it up
>> to monitor total traffic for the future, although you won't be able
>> to get that historically now. You will be able to set it up for the
>> future if the router supports SNMP.
>>
>> DU Meter and similar only monitor traffic to/from the PC on which
>> they are running. This would show up any traffic resulting from a
>> trojan on the PC, but would not show any access from somebody else
>> using the router.
> Thank you gentlemen for your prompt and helpful replies.
>
> A couple of follow up queries if I may.
>
> The router is upstairs in a normal suburban house so what range would
> the router have and are we talking about a chap in a parked car with a
> laptop?
>
> What do they do with the stolen bandwidth? 4 Gb is a fair bit
>
> Thanks again

It could be someone in a parked car, or it could be someone in one of the
neighbouring houses. They could be doing anything with the bandwidth, maybe
downloading films or TV programmes, or possibly something unsavory. It would
be sensible to update your security ASAP, especially if someone's using your
connection for illegal purposes.
--
Adrian A

On 15 Mar 2006 10:02, (E-Mail Removed) wrote:

>Last week 4.28 Gb was used on a single day which resulted in Plusnet
>sending an E mail advising an extra charge would be made as limits

Something you might consider (in addition to checking/increasing the
wireless security) is to visit the "member centre" section, and under
"Connection" you should be able to set a spending limit (I'd just add
50p to the regular monthly fee), so that if something similar happens
in future, access is shut down before the bill goes on increasing...

There may be some software within the household which is allowing the
outside world to request files (eg peer-to-peer software) and even if
no-one is downloading, the uploads also count against monthly quota.

<(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> On Wed, 15 Mar 2006 11:27:13 +0000, Alex Heney <(E-Mail Removed)>

snip

> Thank you gentlemen for your prompt and helpful replies.
>
> A couple of follow up queries if I may.
>
> The router is upstairs in a normal suburban house so what range would
> the router have and are we talking about a chap in a parked car with a
> laptop?

Very possible, parked car with occupants on laptop tend to stand out!, mind
you been any strange vans parked recently!!
Even a next door neighour..

> What do they do with the stolen bandwidth? 4 Gb is a fair bit

Not really, that's only downloading one DVD

>
> Thanks again

On Wed, 15 Mar 2006 13:53:16 +0000, (E-Mail Removed) wrote:

>On Wed, 15 Mar 2006 11:27:13 +0000, Alex Heney <(E-Mail Removed)>
>wrote:
<snip>

>Thank you gentlemen for your prompt and helpful replies.
>
>A couple of follow up queries if I may.
>
>The router is upstairs in a normal suburban house so what range would
>the router have and are we talking about a chap in a parked car with a
>laptop?

Maybe, but most probably not.

In the average suburban house, you will get reception fro next door
(both sides), maybe even the house beyond that, and very likely the
one across the road.

I know that when I stayed with my daughter a year or two ago, when she
was living in a terraced house in Rochester, there were some evenings
when I could "see" four separate networks from my laptop (including
their one that I was supposed to be accessing).

And if people just leave the router set up with the default settings,
it is fairly likely that there will be another one in range with the
same name (most routers IME default the SSID to the manufacturer name
- NETGEAR or 3Com or whatever)

>
>What do they do with the stolen bandwidth? 4 Gb is a fair bit
>

Less than one DVD.

It is not uncommon nowadays for people to download complete TV series
onto DVD, or complete films. It can even be done legally from some
sites.
--
Alex Heney, Global Villager
If it's stupid and works, then it ain't stupid
To reply by email, my address is alexATheneyDOTplusDOTcom

<(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> My family have been using a wireless BB home network for some months
> now with three desktop PCs connected. They are using an Addon router
> and Plusnet and all has worked well.
>
> Last week 4.28 Gb was used on a single day which resulted in Plusnet
> sending an E mail advising an extra charge would be made as limits had
> been exceeded.I have been investigating and have found that one
> computer has DUmeter installed and no exceptional traffic recorded,
> one computer was switched off all day, the third computer was switched
> on between 1600 and 2200 hrs.
>
> The family say that they did no unusual uploads or downloads so I am
> trying to establish for my own benefit how this could have happened. I
> have a wired connection and don`t know much about wireless. I have to
> check if they have WAP enabled and have already checked their anti
> virus, Ad Aware and Sygate firewall.
>
> Could this happen with the computer off and does something like
> DUmeter show any external use from a hacker for instance.
>
> Thanks in advance for any help which will at least increase my
> knowledge of wireless BB.

Did you not make yourself aware or read the instructions? The whole street
has been using your connection! You just have to prove it wasn't you which
might be difficult if people have been posting anything naughty, or
downloading anything naughty. The sort of things people wouldn't do on
their own computer as they could be traced.
You need to do a bit of reading. You found this group so you can't be that
thick.