Hacked Router

[Catherine108]

A very clever hack indeed. I noticed all my admin info and settings were changing. Considering I'm the only one that accesses the router this concerned me. What I figured out is the hacker is spoofing my wifi. They are using a mac address very close to the Hughesnet address. Hughesnets addressed mac address is 00:80:ae:66:f4:e8. The hacker mac address is 0a:80:ae:66:f4:e8. So, it mirrors my address perfectly. I can't block it because it doesn't show up on HN admin page. When I try to block the address using mac filtering it only blocks it for a few seconds, then it reappears. I tried changing my wifi to undiscoverable. I got the 2.4 to change then I seemed to be blocked when changing the 5.0. Now the hacker has disabled my 2.4 and I can't change the settings. I'm basically locked out of my own router. Called HN, but not much help there. I have screenshots of the hackers intrusion. I'd like to share it with you. Lastly, when you search their mac address it show it doesn't exist in the cyber world. Again, a very clever way to take over my router. Please help.

[maratsade]

The Hughesnet reps (@Liz, @Amanda, @Jorge, @Hal) will be here tomorrow (approximately 9-5). In the meantime, I'm tagging other people who may be able to help you:  @GabeU, @MarkJFine, @BirdDog, @C0RR0SIVE.

[MarkJFine]

If the person is hacking the MAC address, and disabled the Wifi, you'll have to go in with an ethernet cable somehow. Just know that the MAC for ethernet is different than the Wifi on your computer.

If that's still not good, you'll have to reset the router to factory settings (I think it's using the red reset button above the top ehternet connector, but it's very sensitive and could reset more than it's supposed to depending upon how long it's held in. Do some research before doing this and use at your own risk).

Once you've reset it, you'll want to disable Wifi completely and use ethernet so you can re-configure it (including new, secure wifi and admin passwords) without the hacker getting involved. Once you're confident it's configured properly with new passwords, you can put the Wifi back on.

You may want to set a new set of MAC addresses to Allow access, but it seems like that's not going to do much.

[C0RR0SIVE]

Seeing as this has to be a local event, contact your local police department if the have a cybercrimes department.  The police stations that have such departments take events like this very seriously and will usually investigate and look into things.

On the more likely chance that your local police department doesn't have this, I recomend connecting directly to your HT2000w, disable all 4 Wifi Radios, disable WPS, and then reconfigure everything including the wireless administration password before enabling any of the wireless radios...

Can you share those screenshots with us?  You can upload and post them by clicking the button "Photos" above when doing a reply.

[Amanda]

Hi Catherine,

I'd like to investigate this with you and see what is going on, however I cannot reach the modem remotely. Do you have the HughesNet Wi-Fi modem powered on? If not, please do so and reply back so that I can take a look.

Thank you,

Amanda

[Amanda]

Catherine,

I was able to get to your HughesNet modem and see many configuration issues that would definitely have caused connectivity loss. I do not see any signs of intrusion, but we can monitor this together. I will need to reset your modem to it's factory settings to get all your original configurations back. Please let me know when is a good time to do this for you.

Thank you,

Amanda

[JT-Hughes]

 .. deleted

[JT-Hughes]

deleted   

__________

[Catherine108]

I have too many screenshots to upload on your site. I could send them to via a Dropbox link. Let me know. Thanks.

[Catherine108]

Yes. Router is on 24/7.