Possible intrusion?

  • ATTENTION! As of November 1, 2020, you are not able to reply to threads 6 months after the thread is opened if there are more than 500 posts in the thread.
    Threads will not be locked, so posts may still be edited by their authors.
    Just start a new thread on the topic to post if you get an error message when trying to reply to a thread.

Skeptical.me

Very Senior Member
Hi,

I woke up this morning and logged on to my iMac and the browser was open with the RT-AX88U's (Merlin) page open. It stated that to login to the page I had to sign out of another logged-in session elsewhere. But I wasn't logged into any other session.

Does this mean someone connected to my router accessed it? And if so how can I find out?

I appreciate any help.
 

L&LD

Part of the Furniture
A hacker wouldn't need a computer on the network to try to get into the router.

How many teens do you have in the house?
 

cooloutac

Very Senior Member
Hi,

I woke up this morning and logged on to my iMac and the browser was open with the RT-AX88U's (Merlin) page open. It stated that to login to the page I had to sign out of another logged-in session elsewhere. But I wasn't logged into any other session.

Does this mean someone connected to my router accessed it? And if so how can I find out?

I appreciate any help.
that happens when someone logged into the router from another ip and never logged out. you have to reboot router or log in from that ip and log out. not sure why a page would be open on your pc does anyone have access to it? MIght want to change passwords. to check the login history you would have to enable firewall logging I believe. not quite sure if it specifies webui logins though never checked might be noisey. you can test it and then have it for future reference. you can also enable https only and specify a specific IP for webui access.
 

thecheapseats

Regular Contributor
<snip>Does this mean someone connected to my router accessed it? And if so how can I find out?
get the router's syslog - go over it (if it still exists intact) and look for continuity in time from your last known access until now... if the log is not contiguous or truncated in places or missing altogether that may be a sign of a compromise... of course as suggested - new passwd... above all - don't panic...
 

kernol

Very Senior Member
Hi,

I woke up this morning and logged on to my iMac and the browser was open with the RT-AX88U's (Merlin) page open. It stated that to login to the page I had to sign out of another logged-in session elsewhere. But I wasn't logged into any other session.

Does this mean someone connected to my router accessed it? And if so how can I find out?

I appreciate any help.
I have had a similar experience once before on a Mac - where the settings had defaulted to reopen all apps that were open when the Mac was shutdown [and they often reopen minimised]. On reflection I had not logged out of the webui - but shutdown when it was minimised. No idea why the webui did not simply auto-logout after the timeout period had elapsed.

This problem may be made worse now with the MAC randomising mac addresses - and frequently getting different ip's from DHCP?
 

Skeptical.me

Very Senior Member
Wow, thanks for all the replies.

I have reset the password just to be safe. There are three people in the house but only I use this network, the others have their own. And they haven't accessed mine, nor do they know my passwords.

Thanks for the reassurance and guidance, greatly appreciated.
 

cooloutac

Very Senior Member
Webui sessions expire after one minute of inactivity.
not necessarily. I've many times logged in with ethernet to change some settings. then long afterwards try to log in from wifi and got that same error. I would literally have to log back in to ethernet with same ip then manually log out. I notice with merlin firmware though if I let it sit idle, it does usually auto log me out, I thought that was something only your firmware did cause I never noticed that on stock but I could be wrong. This is also from the same pc so the above poster might be on to something with the dhcp server and randomize macs possibly causing issues as well.
 

RocketJSquirrel

Senior Member
I see a GUI setting for Auto Logout (minutes) on the Administration page System tab.
 

cooloutac

Very Senior Member
I see a GUI setting for Auto Logout (minutes) on the Administration page System tab.
on stock firmware? test for yourself. log in through ethernet. then pull out the ethernet plug before you go a minute idle. and then try to log in wirelessly from another ip after longer then 1 minute on the same pc and see what happens. I haven't tried to recreate this, but I'm not lying when I say its happened to me. I'm not surprised by the OP's post although you seem more skeptical then him. Definitely more then me. Get the pun? hehe.
 

Similar threads

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!
Top