My router was reset by someone else

[#1]

I came home one day and I connected to the internet for a second on my phone and got some emails coming through then suddenly I was offline and couldn't connect to the router on any of my devices. The devices were saying the password was incorrect. I tried to go to the admin page but someone had changed the password. I reset the router and changed the passwords and had to update the password on every device. I'm worried the admin page is too easily accessible and someone outside my house can reset the router. How do I turn off WiFi admin so only the LAN admin is accessible? Also one of my devices only connects using the WPS button, it won't work by entering the password manually, is this a security risk? How could they have accessed both my WiFi router and admin page, are the same default passwords used for multiple routers?

[#2]

This sounds fishy!  To do what is thought to have happened here, someone would have...

1. Been close enough to jump on your Wi-Fi
2. Known (or being able to guess) the Wi-Fi passcode
3. Known (or being able to guess) the router admin credentials

Many off the shelf routers do ship with standard user names and passwords - typically 'admin' and 'password'.  All Plusnet routers ship with unique admin passwords and Wi-Fi passcodes.  You did not indicate the make and model of router being discussed.

Netgear?  See My WiFi password got changed automatically - NETGEAR Communities

[#3]

---

@JMak wrote:
..... I tried to go to the admin page but someone had changed the password. I reset the router and changed the passwords

---

Are you saying that you do not use the admin password printed on the label in the pull out tab?

---

@JMak wrote:
 I reset the router and changed the passwords and had to update the password on every device.

---

Again, do you not use the preset password?

---

How do I turn off WiFi admin so only the LAN admin is accessible?

---

You can't unless you switch off WiFi completely

---

@JMak wrote:
... one of my devices only connects using the WPS button, it won't work by entering the password manually, is this a security risk?

---

WPS is only active for a couple of minutes whilst the WPS light is flashing.

---

@JMak wrote:
How could they have accessed both my WiFi router and admin page, are the same default passwords used for multiple routers?

---

They could have had sight of the pull out label if you use the default passwords. All passwords are unique to that single Hub.

As an alternative theory, if you have changed these defaults, the Hub firmware might have had a crash, which can trigger an automatic hard reset back to factory settings. This would have reset the passwords to the defaults as written on the pull out label.

[#4]

Apparently with WPS enabled it is possible to brute force access in about a day by continually guessing the pin code.

https://www.howtogeek.com/176124/wi-fi-protected-setup-wps-is-insecure-heres-why-you-should-disable-...

It is a Plusnet Hub Two router.

[#5]

@Baldrick1 I was using the default password for the WiFi connection and admin.

I doubt anyone can see the router login information from outside but it's a slim possibility.

What I mean is WPS might be fundamentally less secure as it only requires two 4 digit numbers to be guessed once you've paired a device with it. It is more vulnerable to a brute force attack than a password.

Since the event I have now changed the default passwords and I am thinking of turning off WPS, as that might be the problem.

[#6]

---

@JMak wrote:

I doubt anyone can see the router login information from outside but it's a slim possibility.

What I mean is WPS might be fundamentally less secure as it only requires two 4 digit numbers to be guessed once you've paired a device with it. It is more vulnerable to a brute force attack than a password.

---

The cited security concern refers to WPS PIN connections.  AIUI the Hub Two only supports Push-Button WPS, which the article states is intrinsically more secure, as the WPS signal is only available for a very short period.

There have been stories of people placing their routers on windowsills ... leaving the router's credentials clear to read from the street.

[#7]

@Townman If I go to my devices in router admin, I can see a computer listed that I don't recognise, that was previously connected. The word "desktop" is in the name, and it was connected by WiFi. My desktop only has ethernet and I recognise all my devices in the list. I don't know how they accessed it but there's various videos and articles online about how to crack WiFi, e.g. Hackaday has one here: https://hackaday.com/2020/09/30/automated-tools-for-wifi-cracking/

There's also something called "war driving", with tutorials on YouTube, so maybe they used one of those methods?

The router is on the windowsill but there's a closed blind behind it, so it shouldn't be visible unless someone has their face up against the window for several minutes.

[#8]

---

@JMak wrote:
The router is on the windowsill but there's a closed blind behind it, so it shouldn't be visible unless someone has their face up against the window for several minutes.

---

Or a phone with a decent camera?

[#9]

There's also some shrubbery in the way, so they would have to stand in that while pointing the phone down the tiny slit in the blinds.

[#10]

@JMak  Ask yourself why would anyone want to hack your home system ?
I reckon you’re spending too much time looking outside your network when the answer’s probably inside it….

[#11]

@Champnet I imagine it's the same reason anyone would hack any network. To obtain personal information or to use the network themselves, or general harassment. I have the evidence; a device listed in the admin page that isn't mine. I have their IP and Mac address.

[#12]

One question, @JMak - have you tried a factory reset?

[#13]

@JMak 

" I have their IP and Mac address. "

I don't think that the IP address proves anything, that is allocated by your router, (isn't it?).

Also, device MAC addresses can be spoofed.

.

[#14]

@JMak  If someone was pulling info from your system you wouldn’t expect them to advertise it. Also, various devices can use multiple MAC addresses each given a difference IP address from DHCP. ‘Desktop’ in the router device list is probably a generic name used as a best guess… 

[#15]

@Mr_Paul what would prove to you that a device I don't own has connected to my WiFi? If you don't accept an unknown in the device list, what else is there? Are you suggesting it is one of my devices and I'm imagining the password being changed? All devices were unable to connect due to incorrect password and I had to reset the router and change the password on every device. These are facts. I know about routers resetting themselves and going back to the default password but that doesn't apply here, as I was already using the default passwords.