Telkom Dlink 2750u Hacked

[bees]

Client complained about no internet. Went to site to find SSID changed to TELKOMHACKED, password still the same, and the Internet Connection (pppoe under WAN connection) completely gone.

Router's admin password wasn't on default. Support user's password however was still on TelkomDlink12345. Suppose that's how they got in. Telkom as ISP.

Just FYI to change support password as well when configuring these modems.

 

[Genisys]

Or just get a decent router to do the actual work.

 

[bees]

Or just get a decent router to do the actual work.

Or that

 

[SauRoNZA]

Client complained about no internet. Went to site to find SSID changed to TELKOMHACKED, password still the same, and the Internet Connection (pppoe under WAN connection) completely gone.

Router's admin password wasn't on default. Support user's password however was still on TelkomDlink12345. Suppose that's how they got in. Telkom as ISP.

Just FYI to change support password as well when configuring these modems.

Why was it open to remote access?

If not remote it means someone locally on the network did it.

 

[prod]

Client complained about no internet. Went to site to find SSID changed to TELKOMHACKED, password still the same, and the Internet Connection (pppoe under WAN connection) completely gone.

Router's admin password wasn't on default. Support user's password however was still on TelkomDlink12345. Suppose that's how they got in. Telkom as ISP.

Just FYI to change support password as well when configuring these modems.

Exactly the same thing happened to me last week.

 

[borro]

same here

 

[krustyrsa]

Exactly the same thing happened to me last week.

same here

damn , just assisted a client on Wednesday with same issue. Could Telkoms Radius server have been hacked?..the router had all its default settings intact, accept for the suspicious WIFI SSID...MickeyD could we please make telkom aware of this?. I'm sure there are a lot more people who experienced this issue.

 

[SauRoNZA]

Isn't this the router with the DNS based vulnerability?

A firmware upgrade should sort it out.

 

[krustyrsa]

Isn't this the router with the DNS based vulnerability?

A firmware upgrade should sort it out.

I think the latest firmware version is 1.65 on the telkom brand and 1.67 on the retail version, I might be mistaken.

 

[SauRoNZA]

I think the latest firmware version is 1.65 on the telkom brand and 1.67 on the retail version, I might be mistaken.

Don't have one so can't say.

But there was a very well known security vulnerability with these particular models.

****

Checked now and that problem was rather related to Internet slowing down to a crawl and users not being aware they got hacked.

In this case some bot hack tool was probably just fed the username and password.

All the more reason to put the retail firmware on if at all possible.

 

[MickeyD]

damn , just assisted a client on Wednesday with same issue. Could Telkoms Radius server have been hacked?..the router had all its default settings intact, accept for the suspicious WIFI SSID...MickeyD could we please make telkom aware of this?. I'm sure there are a lot more people who experienced this issue.

They are aware of it...

 

[Si H]

I had same issue over weekend. Reset all my passwords including router access codes. And hacked again 24 hours later. SSID changed to " Telkom Hacked" second time. So they can still access the D Link router. I think there are going to be a lot of people with the same problem....

 

[bees]

I had same issue over weekend. Reset all my passwords including router access codes. And hacked again 24 hours later. SSID changed to " Telkom Hacked" second time. So they can still access the D Link router. I think there are going to be a lot of people with the same problem....

Is this even after you changed support password as well?

Which ISP you with?

 

[schuits]

This happened to me this weekend to.
At first I was worried it was a wireless hack which means someone who knows what they doing.

Anyway. Reset my password and what not, but clearly it can happen again.
I didn't know there was a support password, so I'll check that out tonight.
Also adding MAC filtering and will see if I can disable external access to the router.
Anything else we can do?

Alternatively I have an old Zyxel router I might swap to.

 

[schuits]

Ok was "hacked" again. I say hacked in inverted commas cause clearly this isn't a hack.
Whomever is doing this doesn't know the admin passwords that we have set or he would have reset those too. So I suspect he's using the support password.

There's a default support login on these modems. With the password as guess what...."support"!
(alternatively there's a default telkom password aswell)

I upgraded my firmware and changed the guest and support logins, hope it doesn't happen again.

ftp://ftp.d-link.co.za/DSL/DSL-2750...n T/T1/DSL-2750U_Firmware_AF_1.76_R01 LATEST/

 

[ranger]

damn , just assisted a client on Wednesday with same issue. Could Telkoms Radius server have been hacked?

How would this be related?

(In case you misunderstand me, no, there is now way RADIUS relates to this).

[/QUOTE]
..the router had all its default settings intact, accept for the suspicious WIFI SSID...MickeyD could we please make telkom aware of this?. I'm sure there are a lot more people who experienced this issue.[/QUOTE]

MickeyD seems to think they are aware of it.

It may not necessarily be useful to discuss workarounds yet.

 

[ranger]

Which ISP you with?

Unless you are meaning that some ISPs intercept the traffic that could be used in the "hack", which ISP you use is irrelevant.

 

[backstreetboy]

Ok was "hacked" again. I say hacked in inverted commas cause clearly this isn't a hack.
Whomever is doing this doesn't know the admin passwords that we have set or he would have reset those too. So I suspect he's using the support password.

There's a default support login on these modems. With the password as guess what...."support"!
(alternatively there's a default telkom password aswell)

I upgraded my firmware and changed the guest and support logins, hope it doesn't happen again.

ftp://ftp.d-link.co.za/DSL/DSL-2750...n T/T1/DSL-2750U_Firmware_AF_1.76_R01 LATEST/

Did that when I first got the router already. Stock firmware ftw!

 

[SauRoNZA]

Ok was "hacked" again. I say hacked in inverted commas cause clearly this isn't a hack.
Whomever is doing this doesn't know the admin passwords that we have set or he would have reset those too. So I suspect he's using the support password.

There's a default support login on these modems. With the password as guess what...."support"!
(alternatively there's a default telkom password aswell)

I upgraded my firmware and changed the guest and support logins, hope it doesn't happen again.

ftp://ftp.d-link.co.za/DSL/DSL-2750...n T/T1/DSL-2750U_Firmware_AF_1.76_R01 LATEST/

Yup it's really as simple as that, the fact that the access details are out in the wild.

If those were changed there is no way they can get in (this easily) again.

It's not a hack at all, just a case of having prior knowledge.

 

[nemo415]

Same thing happened on my friend's DWR 730 this morning... Sigh