A home network that kept getting broken into, and what to do if you think yours has

The job

We were called to a home in Monterey, on fibre to the curb, by a customer who believed her network was being broken into again and again.

It had started months earlier, when her phone account was hacked. She changed every password and had her laptop reset at the maker’s store. Even so, access to that account kept coming and going. When she brought the newly secured phone home and connected it to her network, new devices began to show the same trouble. By the time we visited she was on her fourth router and a second computer.

She had done what most people never do: kept careful records of everything she saw.

If you are worried about your own network and want someone to go through it with you, that is the kind of help a home tech support visit is for. If the worry is the connection itself, an internet technician checks the line, the NBN box and the router.

Watch: Hacking Nightmare: Unraveling Persistent Network Intrusions and Possible NBN Modem Compromise

What she showed us

• Settings changing on each router. Remote management and a provider management protocol were switched on, when she had left them off.
• A phone service set up in the router that she had never asked for. Her provider told her it would have had to be turned on deliberately.
• Log entries she could not explain: remote addresses she did not recognise, and timestamps dated 1970.
• Settings that would not stay changed. WiFi she had turned off came back on.
• The same pattern on every new router, which made her suspect something upstream of the routers, perhaps the NBN box itself.

What we did

• Went through each router’s settings with her and switched off everything that was not needed.
• Isolated her computer from the network so its logs could be read without other traffic in the way.
• Recorded what we saw.

And then we told her what we could not do. Working out whether a determined intruder is inside a network, and how, is specialist security work. It is not cabling or fault finding, and guessing at it would not have helped her. We said the case needed a security specialist, and we asked for expert input.

We did not establish the cause. We do not know whether the network was compromised in the way she feared.

Signs that have ordinary explanations

Some of what appears in a router’s settings and logs looks alarming and is normal. This is general information about how routers behave. It is not a verdict on this customer’s case, where several things were happening at once.

Tap a card, or tab to it, to turn it over.

• What you see

  The router's log is dated 1970

  Turn over

  The ordinary explanation

  A router's clock starts at 1970 every time it powers on, until it fetches the real time from the internet. Anything logged in those first moments carries that date

• What you see

  Remote management is switched on

  Turn over

  The ordinary explanation

  This is how providers set up and update routers remotely. A router supplied by, or set up for, a provider often has it on, and a factory reset can turn it back on

• What you see

  Phone settings appeared on the router

  Turn over

  The ordinary explanation

  Providers that include a phone service send those settings to the router automatically

• What you see

  Settings come back after you change them

  Turn over

  The ordinary explanation

  The provider's management system re-applying its own configuration, or a firmware update restoring defaults

• What you see

  Strangers keep trying to connect

  Turn over

  The ordinary explanation

  Every internet connection is scanned constantly by automated systems. A firewall log full of blocked attempts means the firewall is working

Things that look like hacking and usually are not

What you see	The ordinary explanation
Log entries dated 1 January 1970	A router's clock starts at 1970 every time it powers on, until it fetches the real time from the internet. Anything logged in those first moments carries that date
A management protocol (CWMP or TR-069) switched on	This is how providers set up and update routers remotely. A router supplied by, or set up for, a provider often has it on, and a factory reset can turn it back on
Phone (VoIP) settings you did not enter	Providers that include a phone service send those settings to the router automatically
Settings returning after you change them	The provider's management system re-applying its own configuration, or a firmware update restoring defaults
Unknown addresses trying to connect from outside	Every internet connection is scanned constantly by automated systems. A firewall log full of blocked attempts means the firewall is working

Signs that are worth acting on

• The router's admin password, which you set, no longer works.

  First step: factory reset the router with its button, update the firmware, and set a new admin password used nowhere else.

• The DNS server addresses in the router have changed to ones that are not your provider's.

  First step: reset the router properly, with the button, before you change anything else.

• Devices on the network that you cannot identify, after you have counted your own.

  First step: set a new WiFi name and password, then reconnect your devices one at a time.

• Being sent to login pages that look slightly wrong.

  First step: don't sign in there. Change that password from a device you trust.

• Port forwarding rules you did not create.

  First step: reset the router, and turn off UPnP if you do not need it.

• An online account, such as your email, showing sign-ins from places you have not been.

  First step: on a clean device, change that account's password, turn on two-step sign-in and sign out every other session.

The last one matters most. When a home network is in trouble, the way in is far more often an account than a cable: an email or cloud account that was broken into, and from which everything else can be reset. If it’s your email, Facebook or Apple Account you’re worried about, how to tell if an account has been hacked, and what to do goes through each one.

What to do if you think your network has been compromised

1. 1

   Start with the accounts, on a clean device

   From a device you trust, change the password on your main email account first, then your phone maker's account and your banking. Turn on two-step sign-in for each. Sign out every other session.

2. 2

   Check the devices

   Update every phone and computer. Remove apps and profiles you do not recognise. If a device is in doubt, back up your files and reset it.

3. 3

   Reset the router properly

   Factory reset it with the button, not from the menu. Update its firmware before anything else. Set a new admin password that is used nowhere else, and a new WiFi name and password.

4. 4

   Close the doors you do not use

   Turn off remote management from the internet, WPS, and UPnP if you do not need it. Leave the firewall on.

5. 5

   Reconnect devices one at a time

   Only those you have checked. If the trouble returns after a particular device joins, you have found something.

6. 6

   Report it and get help

   Report cybercrime at cyber.gov.au (ReportCyber). If your identity or accounts have been misused, IDCARE is Australia's support service for that, and it is free for individuals.

Both services are on their own sites: ReportCyber, at cyber.gov.au (opens in a new tab), and IDCARE (opens in a new tab).

If it started with a text or email asking you to log in, what to do if you clicked a scam link has the steps in order.

What an internet technician can and cannot do here

We can check that the network is built sensibly, as we would on any WiFi and home network visit: one router doing the routing, current firmware, sound passwords, nothing exposed to the internet that does not need to be, and the cabling and the NBN box behaving as they should. That rules out a lot, and it puts the network in a state where a problem is easier to see.

We cannot run a forensic investigation into an intrusion. If the signs above are present after the steps above, that is the point to bring in a security specialist, and we will say so. For putting the router, the phones and the computers back in order afterwards, book home tech support.

For the basics of the two boxes involved, see the difference between a modem and a router, and its section on keeping your router secure. If the WiFi shows connected and nothing loads, that is a different problem: WiFi connected with no internet. For who does what between the line and the devices, see what an internet technician is.