problem with home network

[GrouchyLadybug]

We're having a problem with our home network. Our setup/background is as follows:
--One desktop, one laptop, and one TiVo are networked via a D-Link DI-524 wireless router. Also have a printer connected to the desktop which the laptop is able to use.
--Desktop is wired directly into the router, laptop is wireless, TiVo is wired via two Netgear XE102 Ethernet Bridges (secured with passwords/encryption).
--Router is locked down: no SSID broadcast, MAC filters in place, WPA encryption with a 64-random-character passcode enabled. DCHP dynamic server is set to give out only three IP addresses (desktop, laptop, TiVo).
--Both computers are up to date on Windows patches and antivirus defs, and are firewalled with ZoneAlarm.
--We live in an apartment building with four direct neighbors (one above, one below, and two on the sides).

Long story short -

We think someone may have gotten onto our home network by spoofing our TiVo's MAC address. Our internet was running extremely slow, and when I checked our router's logs, I saw that there was a strange wireless PC connected to our network (with a MAC address not in our allow list). When I checked the DCHP server status, it showed that a device called "unknown" had an IP address assigned to it and it had the same MAC address as the TiVo. (The TiVo is always called, well, TiVo, so I knew something fishy was going on.)

I unplugged the TiVo's network bridge, but the wireless intruder still was showing up on our logs but couldn't seem to connect since I took away his/her port of entry (the TiVo's MAC). It also seems to be tied to my laptop, because when I disable my wireless connection on the laptop and leave only our desktop connected, the wireless intruder does not appear. But the second I enable my wireless connection, it reappears. I don't even have to be connected to the network; I just have to have the connection enabled.

What I'd like to know is, what really happened here, and how can I prevent it from happening again? I thought I'd taken all the necessary precautions in securing our network.

Also, should I be concerned for the files on my hard drive, or for my internet traffic? I do some online banking on my laptop, which I thought would be fairly safe behind the WPA, the site's SSL, and my firewall/antivirus. Sensitive files (like all of our financial stuff) are on an encrypted volume using TrueCrypt (behind a bajillion-character random password).

There are at least 2-3 unsecured wireless networks in my building (plus a few more WEP/WPA networks), so there are plenty of easy targets for free internet. This leads me to believe that if there is indeed some hacker in my building, that they are either doing this for the thrill of breaking all my barriers, or they are truly interested in my activity.

Any ideas, thoughts, or advice would be greatly appreciated! I can also give more info if you need it to better understand the situation.

 

[JackMDS]

The Netgear XE102 is Not related to the Wireless security. They are two totally independent systems.

In addition, in most Wireless Router, the MAC filtering is only part of the Wireless so using another HomePlug would not be affected by the MAC filter, and there is No need to spoof.

If some one spoofs your MAC the spoofed MAC would appear and not his actual MAC.

Any one on your side of the transformer can connect if he plugs an adaptor to an outlet in his place.

Netgear gives a utility that can change HomePlug the encryption on all the system form any computer.

Therefore, if some one was lucky to break the encryption (and since it is not wireless they have all the time in the world to run a decryption utility) they can change it system wise you would not even know.

To disconnect the HomePlug you have to disconnect it from the Router.

As for the Wireless, attempt to connect to your Wireless might be intentional or unintentional.

As long as you have strong WPA, you are probably safe.

It might be that someone had a good time with your Home Plug connection that he/she got ??upset?? with losing it, and he/she is trying to annoy you with the Wireless.

 

[SoulAssassin]

Originally posted by: GrouchyLadybug

I unplugged the TiVo's network bridge, but the wireless intruder still was showing up on our logs but couldn't seem to connect since I took away his/her port of entry (the TiVo's MAC). It also seems to be tied to my laptop, because when I disable my wireless connection on the laptop and leave only our desktop connected, the wireless intruder does not appear. But the second I enable my wireless connection, it reappears. I don't even have to be connected to the network; I just have to have the connection enabled.

Umm, dude, are you sure that you haven't mislabeled what MAC address is your Tivo and what is your laptop?

 

[GrouchyLadybug]

Thanks for the replies!

Jack, it looks like I'll be unplugging the bridges as a first step. I'll have to plug them in to update the TiVo every now and then, though. (No phone line, and we can't hard-wire the TiVo to the router as we are renters - no drilling! Don't really want to put it on wireless, either.) I'm going to check the NetGear software when I get home, as I thought I had set all the necessary passwords to keep other bridges out. But like you said, I guess they are able to crack them if they work at it long enough.

SoulAssassin, I'm pretty confident I've got my MACs right. Compared everything directly with what we had in our MAC filter list, which is an accurate listing. The intruding MAC is definitely not one that is on our network, and it was different from what appeared in the DCHP list, which was the TiVo's address but listed as "unknown" (which is why I immediately thought spoof). I do also know that the intruder's MAC is not my laptop's MAC, as it shows both of us connected with different MACs at the same time in the logs.

 

[nweaver]

disable mac spoofing, to see if they show up with a unique MAC/IP. Mac filtering is pretty much worthless anyway

 

[Wik]

Try running this on your network and see what is all connected.

http://www.angryziber.com/ipscan/


I never used the bridges you speak of, but are you sure the MAC address you are seeing does not belong to them?

 

[GrouchyLadybug]

Originally posted by: Wik
Try running this on your network and see what is all connected.

http://www.angryziber.com/ipscan/


I never used the bridges you speak of, but are you sure the MAC address you are seeing does not belong to them?

Thanks for the link! Looks like a useful tool. I'll run that when I get home.

And no, the strange MAC doesn't belong to either of the bridges. The bridges were entered in the MAC filter along with the computers and the TiVo, and the strange MAC didn't match any of my devices.

The good news is, the intruder didn't try to get back in last night. I redid all of the security/encryption settings on the bridges so I could plug them in for the TiVo to run its update, then I left them unplugged the rest of the night. Hopefully whomever it was has gotten annoyed and moved on to someone else's network.

Thanks again for all your replies. Much appreciated!