I'm I being hacked?

D

dextermorgan

I got banned!
Messages
7,269
Location
Hyderabad
ISP
Beam Fiber
Mar 23 12:32:15 rlx-linux user.warn kernel: wlan0: A wireless client was rejected due to access control - EC:89:F5:AA:39:6B
Mar 23 12:37:15 rlx-linux user.warn kernel: wlan0: A wireless client (EC:89:F5:AA:39:6B) was rejected due to access control for 74 times in 5 minutes
Mar 23 12:44:50 rlx-linux user.warn kernel: wlan0: A wireless client was rejected due to access control - EC:89:F5:AA:39:6B
Mar 23 12:49:50 rlx-linux user.warn kernel: wlan0: A wireless client (EC:89:F5:AA:39:6B) was rejected due to access control for 78 times in 5 minutes
Mar 23 16:03:06 rlx-linux user.info syslog: igmpproxy: Drop membership 239.192.152.143
Mar 23 16:03:06 rlx-linux user.notice syslog: Note: removing MFC: 0.0.0.0 -> 239.192.152.143, InpVIf: 1
Mar 23 16:34:11 rlx-linux user.warn kernel: wlan0: A wireless client is associated - 80:1D:00:00:22:76
Mar 23 16:34:11 rlx-linux user.warn kernel: wlan0: WPA2-AES PSK authentication in progress...
Mar 23 16:34:11 rlx-linux user.warn kernel: wlan0: A wireless client is associated - 80:1D:00:00:22:76
Mar 23 16:34:11 rlx-linux user.warn kernel: wlan0: Authentication failled! (4-2: MIC error)
Mar 23 16:34:11 rlx-linux user.warn kernel: wlan0: A STA is rejected by 802.1x daemon - 80:1D:00:00:22:76
Mar 23 16:41:58 rlx-linux user.warn kernel: wlan0: A STA is expired - C0:EE:FB:3A:18😀B
Mar 23 17:58:24 rlx-linux user.warn kernel: wlan0: A wireless client is associated - C0:EE:FB:3A:18😀B
Mar 23 17:58:24 rlx-linux user.warn kernel: wlan0: WPA2-AES PSK authentication in progress...
Mar 23 17:58:24 rlx-linux user.warn kernel: wlan0: A wireless client is associated - C0:EE:FB:3A:18😀B
Mar 23 17:58:24 rlx-linux user.warn kernel: wlan0: Open and authenticated
Mar 23 17:59:27 rlx-linux user.warn kernel: wlan0: A wireless client is associated - C0:EE:FB:3A:18😀B
Mar 23 17:59:27 rlx-linux user.warn kernel: wlan0: WPA2-AES PSK authentication in progress...
Mar 23 17:59:27 rlx-linux user.warn kernel: wlan0: A wireless client is associated - C0:EE:FB:3A:18😀B
Mar 23 17:59:27 rlx-linux user.warn kernel: wlan0: Open and authenticated
Mar 23 18:34:30 rlx-linux user.warn kernel: wlan0: A wireless client was rejected due to access control - EC:89:F5:AA:39:6B
Mar 23 18:39:29 rlx-linux user.warn kernel: wlan0: A wireless client (EC:89:F5:AA:39:6B) was rejected due to access control for 137 times in 5 minutes
Mar 23 19:57:49 rlx-linux user.warn kernel: wlan0: A STA is expired - C0:EE:FB:3A:18😀B
Mar 23 21:47:28 rlx-linux user.warn kernel: wlan0: A wireless client is associated - C0:EE:FB:3A:18😀B
Mar 23 21:47:28 rlx-linux user.warn kernel: wlan0: WPA2-AES PSK authentication in progress...
Mar 23 21:47:28 rlx-linux user.warn kernel: wlan0: A wireless client is associated - C0:EE:FB:3A:18😀B
Mar 23 21:47:28 rlx-linux user.warn kernel: wlan0: Open and authenticated
Mar 23 21:53:05 rlx-linux user.info syslog: igmpproxy: Add membership 239.255.255.250
Mar 23 21:53:05 rlx-linux user.debug syslog: Debu: adding MFC: 0.0.0.0 -> 239.255.255.250, InpVIf: 1
Mar 23 21:54:18 rlx-linux user.info syslog: igmpproxy: Drop membership 239.255.255.250
Mar 23 21:54:18 rlx-linux user.notice syslog: Note: removing MFC: 0.0.0.0 -> 239.255.255.250, InpVIf: 1
Mar 23 23:20:18 rlx-linux user.warn kernel: wlan0: A wireless client was rejected due to access control - EC:89:F5:AA:39:6B
Mar 23 23:25:17 rlx-linux user.warn kernel: wlan0: A wireless client (EC:89:F5:AA:39:6B) was rejected due to access control for 74 times in 5 minutes
Mar 24 06:00:08 rlx-linux user.warn kernel: wlan0: A wireless client was rejected due to access control - EC:89:F5:AA:39:6B
Mar 24 06:05:08 rlx-linux user.warn kernel: wlan0: A wireless client (EC:89:F5:AA:39:6B) was rejected due to access control for 55 times in 5 minutes
Mar 24 08:38:32 rlx-linux user.warn kernel: wlan0: A wireless client was rejected due to access control - EC:89:F5:AA:39:6B
Mar 24 08:43:32 rlx-linux user.warn kernel: wlan0: A wireless client (EC:89:F5:AA:39:6B) was rejected due to access control for 74 times in 5 minutes
Mar 24 08:56:37 rlx-linux user.notice syslog: RT-N12LX:ntp client success
Mar 24 09:27:27 rlx-linux user.info syslog: igmpproxy: Add membership 239.255.255.250
Mar 24 09:27:27 rlx-linux user.debug syslog: Debu: adding MFC: 0.0.0.0 -> 239.255.255.250, InpVIf: 1
Mar 24 09:28:41 rlx-linux user.info syslog: igmpproxy: Drop membership 239.255.255.250
Mar 24 09:28:41 rlx-linux user.notice syslog: Note: removing MFC: 0.0.0.0 -> 239.255.255.250, InpVIf: 1
Mar 24 09:37:41 rlx-linux user.warn kernel: wlan0: A wireless client was rejected due to access control - EC:89:F5:AA:39:6B
Mar 24 09:42:41 rlx-linux user.warn kernel: wlan0: A wireless client (EC:89:F5:AA:39:6B) was rejected due to access control for 75 times in 5 minutes
Mar 24 10:19:37 rlx-linux user.warn kernel: wlan0: A wireless client is associated - C0:EE:FB:3A:18😀B
Mar 24 10:19:37 rlx-linux user.warn kernel: wlan0: WPA2-AES PSK authentication in progress...
Mar 24 10:19:37 rlx-linux user.warn kernel: wlan0: A wireless client is associated - C0:EE:FB:3A:18😀B
Mar 24 10:19:37 rlx-linux user.warn kernel: wlan0: Open and authenticated
Click to expand...

I just opened my router's log and saw that this mac id trying like hell to connect to my wifi. I've blocked the mac id through mac filter in router settings. What can I do more?
 
Sort by date Sort by votes
Mac add. belongs to a lenovo mobile/tab.

Nothing much really you can do here. Hiding SSID/ Mac filtering is the usual way to go if it's just a random attack which seems to be the case here. If it's targeted and the attacker is determined, mac filtering is pretty much useless since they can monitor the devices and easily spoof them and attempt to connect. Stronger password encryption is the best bet.
 
Upvote 0 Downvote
Jay said:
Mac add. belongs to a lenovo mobile/tab.

Nothing much really you can do here. Hiding SSID/ Mac filtering is the usual way to go if it's just a random attack which seems to be the case here. If it's targeted and the attacker is determined, mac filtering is pretty much useless since they can monitor the devices and easily spoof them and attempt to connect. Stronger password encryption is the best bet.
Click to expand...
hey man My router logs are showing the same thing, And i belive that my router has been hacked, assuiming that this was a determined attacker what would i have to do to fix the issue?
 
Upvote 0 Downvote
Reset and start from scratch. Upgrade to the latest firmware. Change default credentials for logging into the router and secure the wireless network with a strong password with WPA2 authentication. That's a good start.
 
Upvote 0 Downvote
@Kick933 Hidden SSIDs will increase battery drain on all clients. You're just moving the burden of beacon from the modem to all the clients connected to it.

There isn't a real security benefit as it'll still show up on wifi scanning tools which anyone determined to hack into it already have.
 
Upvote 0 Downvote
Change password periodically.He is most probably using WPS.Disable it.
Mac spoofing and key extraction is not easy task.
Either you are "rich murgi",or the attacker is just using rooted phone for WPS exploits.
I would rather let the user connect and limit their ability using network isolation feature.
Some router even allow disabling internet access using parental control
 
Last edited:
Upvote 0 Downvote
Use Fing app for Mobile .. you will get a very good insight of devices connected to your network.. D-Link routers can be very easily compromised ... Upgrade to the latest firmware and keep WPS off at all times
If a guy is using a rooted strong Android phone like OnePlus 8(assuming) also , it would be very difficult to crack a password like this

Duck$r.gud.sw1mmers@pond
 
Last edited:
Upvote 0 Downvote

Top