How to track hackers

[Riktar]

Short and sweet. My WiFi keeps getting "used" by one of the neighbors. Because of how rural my location is I know it can only be 3 specific neighbors that are hacking my wifi.

It's one thing to be too cheap to get your own internet. It's quite another when whoever is doing this is having a fun time changing my routers password and locking me out. Obviously I can just to a hardware reset and start over and wonder how long it will take this individual to crack back in.

I want to find out who is doing this and explore my legal options in bringing charges against them.

Is there any way I can use a device that will pinpoint the direction their signal is coming from? Out of the 3 possible candidates it is no problem figuring out who it is based on direction.

I know how far my signal can travel so I just need to know what direction to point.

I would appreciate any advice on this.

[Alan87i]

One thing that just popped into my head was to make a reflector (http://www.freeantennas.com/projects/template/) for the AP's antenna ('s).
If you have a sort of time line on how long it usually takes this whack job to hack your system. The reflector would make the signal stronger in one general area while hindering it quite a bit in the other direction. If he doesn't get in after the usual amount of time or longer it's the dude in the direction of the back side of the reflector ('s) . Test it out with your laptop. See where the rear lobe drops out. To be sure point them fully towards the suspects place and give em a few days.

Then get a newer device with better security , Plug the old one in for a few days hooked to nothing let him wast his time.

[CDX825]

What brand of wireless router are you using? There are alot of way you could lock them out of it. If you left it unsecured and in default mode when you hooked it up then you were asking for someone to get into it. Some routers will give you a list a MAC addresses asociated with your router. You can then setup a mac authentication list and aprove only the computer you use. Also turn off the SSID so it not broadcasting the name of the router. Change the SSID to somthing other than the default and dont use your name on it. Also make sure the password to access the router is not set to default. If you have a basement you could put the router down there to knock out the signal to them. If your realy set on finding them though Allans idea is the way to go. I dont think you be able to actually charge them with anything if you do though.

[Riktar]

I do have security enabled (albeit WEP 64) as well as the MAC filter which is set to allow only my equipment. I was broadcasting my SSID which I will now turn off.

I thought that using the MAC filter would stop ANY outside activity since mac addresses are a digital fingerprint. Or am I off base here?

The basement would be a good idea except I can just barely stretch the signal to my office as it is. It's location is 1300 ft from my house.

Along the lines of a reflector: If I used a cantenna to focus the beam towards my office would that effectively cut the signal down perpendicular to the target? And if I did that could I assume that I would still have the wireless available to my laptop which wanders all over the house?

My router is a Linksys WRT54G ver 6(?) I think.

Thanks for the replies and suggestions.

[Alan87i]

The reflector will bump up the signal in what ever direction you aim it in and hinder it pretty good in the opposite direction.
It should still let you have some signal behind it in the house. That's for you to determine with some tests after sticking it on the antenna.

[umdivx]

I do have security enabled (albeit WEP 64) as well as the MAC filter which is set to allow only my equipment. I was broadcasting my SSID which I will now turn off.

I thought that using the MAC filter would stop ANY outside activity since mac addresses are a digital fingerprint. Or am I off base here?


WAY WAY WAY off course here. You can crack WEP in the matter of minutes, use WPA/WPA2 TKIP or AES Pre shared key. It is light years better than WEP and takes much much longer to hack, but if you use an extremely strong pass phrase it is virtually un-hackable.

Also you can spoof a mac address easily. That is even easier to do than cracking WEP.

Also disabling SSID broadcast doesn't' do squat, you can still pick up the SSID even if it is not being broadcasted.



The basement would be a good idea except I can just barely stretch the signal to my office as it is. It's location is 1300 ft from my house.

I'm confused here, what is 1300FT away from your house? Is your internet connection and router away from your home? ie 1300 feet way from your home? why would that be the case?


Along the lines of a reflector: If I used a cantenna to focus the beam towards my office would that effectively cut the signal down perpendicular to the target? And if I did that could I assume that I would still have the wireless available to my laptop which wanders all over the house?

Yes you can "localize" the signal with directional antennas, what your looking for is a yagi or a directional patch panel that would minimize the radiant signal from going other places. you still have reflection behind and on the sides but its much more minimal than omni directional antenna's.


My router is a Linksys WRT54G ver 6(?) I think.

Thanks for the replies and suggestions.

Finally what I would recommend is disable the management abilities of the router via wifi, as well as WAN. that way the ONLY way to be able to get into the router to change ANY settings is being hardwired into the device. That way your neighbors can no longer log into it, and change any settings. Also make sure you change the default password on the device ;) thats a no brainer there.

- Josh

[jessenkurien]

i think WPA/WPA2 TKIP or AES Pre shared key 128 bit key should resolve the issue.i find it quite tricky but how do u know that someone else is using ur network,,,,,,did u use a sniffer or a tracker like kismet to find the ip's which are connecting to ur network.linksys has already released version 8 ,,so u can go for it by calling the tech support....tell the tech support guys to change the beacon interval,fragmentation threshold and RTS/CTS settings on the router which will give u a better signal strength
Cheers,
Jessen Kurien
CCNA,CWNA,CEH

[singha]

Just enable encryption and shut this guy down forever. But if you really want to find out who he is there are many methods to do this.

You could use Wireshark to capture his packets and parse them for some personal information like email address and a password.

You could use a Linux based WiFi listening software (I have brain freeze and can't rememver the name) to triangulate his location.

You could use a directional antenna on your router to determine the direction of his computer but like with reflector this would be hard to do if you're using stock firmware on your router because there is no signal strength readout.

[Wifi-Guru]

If you want to track the guy down you can get a free wireless sniffer and put it on a laptop and when they are actively using it walk around and see where the packets get stronger..knock on the door and nicely ask them to stop. Why piss off your few neighbors you might need them one day.

Yes can they be convicted of a crime since it is illegal to access a network without permission, secured or not.

Best bet is to turn on WPA2-PSK and they won't be able to access it anymore.

~K