Quick Hello and a tip for DD-WRT routers

Hey everyone!

I was helped tremendously by the gracious people here at MajorGeeks and I have posted/helped others as well. Two years ago we had a hacker break into our systems and take them over. After MajorGeeks helped me get them off we have been hacker free ever since.

However, it hasn't kept the hackers from trying to break in but I finally found out what was the matter. It turns out that the DD-WRT software has one flaw in it that has as of yet to be corrected. If you look through the screens there is one screen in particular that has an option to display the router's status WITHOUT using a password to do so. If you do not set the checkbox then anyone can see your router's information. You go "ok - so what" - right? Well, it turns out that the information sent actually has more information than just the router's information. It also gives out MAC addresses. Yeah. So if a hacker spoofs one of the MAC addresses they can get onto the router.

So just a quick tip. I read that each DD-WRT version has this in a slightly different location so I can't tell you which of the web pages to go to but mine was in the admin section and it is just one question in a long list of questions and unlike most of these security related questions - this one does NOT default to a person needing a password in order to get any kind of information. So, as I said, you have to select it so your router always asks for a password in order to see anything about your router.

Since I have selected that checkbox - our router doesn't reboot as much anymore and no one except us ever gets onto the router anymore. The only two times the router ever reboots now is when our ISP clears the lines (usually around 4:00pm every day) and the time I set for the router to reboot (around 3:00am every day). I set the reboot for that time because most hackers are up and trying to break in to your system while you sleep. I've stayed up until 4:00am some times watching the log of our router and I can definitely see a spike in incoming requests starting around 2:00am and going until 4:00am. Now that I have turned off the capability to see our router's information - the hacker traffic has really died down. Now its only a few hundreds of tries rather than the few thousands of tries.

Anyway - just stopping by to give my yearly HI! and status update.

Later!

Mark