Community discussions

MUM Europe 2020
 
popcorrin
Member Candidate
Member Candidate
Topic Author
Posts: 189
Joined: Wed Mar 11, 2009 12:55 am

Does this look like an attempt to hack into my router?

Sun Aug 16, 2009 5:54 am

I was checking the logs on my router and I seen this below. From what I can tell someone was trying to gain access to my router? I couldn't find out much about this ip, looks like it can be traced back to mumbai primenet?
Should I be overly concerned.

Image
Last edited by popcorrin on Sun Aug 16, 2009 6:09 pm, edited 1 time in total.
 
fewi
Forum Guru
Forum Guru
Posts: 7734
Joined: Tue Aug 11, 2009 3:19 am

Re: Does this look like an attempt to hack into my router?

Sun Aug 16, 2009 6:03 am

Looks like a brute force attempt after a port scan. I would not be overly concerned unless you have very weak passwords as they're very likely just randomly trying you because they can and not actively trying to specifically hack you, but do check out the firewalling section of the wiki and read up on securing your router to learn how to drop ssh (and winbox, telnet, etc.) from anything that couldn't possibly be a legitimate admin.
Specific answers require specific questions. When in doubt, post the output of "/ip address print detail", "/ip route print detail", "/interface print detail", "/ip firewall export", and an accurate network diagram.
 
User avatar
Chupaka
Forum Guru
Forum Guru
Posts: 8326
Joined: Mon Jun 19, 2006 11:15 pm
Location: Minsk, Belarus
Contact:

Re: Does this look like an attempt to hack into my router?

Sun Aug 16, 2009 3:35 pm

Russian-speaking forum: https://forum.mikrotik.by/. Welcome!

For every complex problem, there is a solution that is simple, neat, and wrong.

MikroTik. Your life. Your routing.
 
popcorrin
Member Candidate
Member Candidate
Topic Author
Posts: 189
Joined: Wed Mar 11, 2009 12:55 am

Re: Does this look like an attempt to hack into my router?

Sun Aug 16, 2009 6:11 pm

Thanks for the advice. I checked my logs this morning and it looks like someone else was at it. This time it looks like it came from Mexico City?

Image
 
User avatar
Chupaka
Forum Guru
Forum Guru
Posts: 8326
Joined: Mon Jun 19, 2006 11:15 pm
Location: Minsk, Belarus
Contact:

Re: Does this look like an attempt to hack into my router?

Sun Aug 16, 2009 7:33 pm

it's just bot (or botnet) - it sees your router and starts bruteforcing
Russian-speaking forum: https://forum.mikrotik.by/. Welcome!

For every complex problem, there is a solution that is simple, neat, and wrong.

MikroTik. Your life. Your routing.
 
iwantlemonjuice
Member Candidate
Member Candidate
Posts: 101
Joined: Tue Nov 04, 2008 4:53 am
Location: Boracay Island, Philippines

Re: Does this look like an attempt to hack into my router?

Mon Aug 17, 2009 4:50 am

follow chupaka link then change the parameter and banned 366 days :lol:
 
jonesy
newbie
Posts: 36
Joined: Tue Oct 07, 2008 1:31 am

Re: Does this look like an attempt to hack into my router?

Mon Aug 17, 2009 4:56 am

When you have a machine with SSH open to the world you should expect this to happen frequently. It's best to firewall SSH (port 22) off so that it is only accessible from your management network.
 
landysaccount
Frequent Visitor
Frequent Visitor
Posts: 53
Joined: Mon Jun 15, 2009 3:45 am

Re: Does this look like an attempt to hack into my router?

Tue Aug 18, 2009 3:20 am

I was experiencing the same: Someone was trying to access my Linux box. I changed the ssh port to something other then the default (22) to maybe 2222. Haven't had any hack attempt ever since.

Who is online

Users browsing this forum: hubipuli and 136 guests