Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

Slingbox or hacker?

174 views
Skip to first unread message

Rocky

unread,
Oct 31, 2011, 4:07:24 AM10/31/11
to
I tried to log into my router today and it said it was being managed by
192.168.1.244 which happened to be the IP address I gave to my Slingbox.

To make a long story short after I tried a few different things like
disconnect and then reconnect the power to my router so I could access the
router then I went to reconfigure that Slingbox by hand and it said it was
at 192.168.1.254 which was weird too because I had left it at 192.168.1.244
and a port was forwarded to 192.168.1.244 so it couldn't have worked at
192.168.1.254 either and it had been working.

So I reconfigured it back to 192.168.1.244 only to run into the exact same
problem where I could not log onto my router because it was being used by
192.168.1.244. Something strange is going on and it looks like it is time
to hook up my network analyzer again.

So could it by my Slingbox or a hacker or a hacker using my Slingbox. Any
ideas?

Rocky


Message has been deleted

Mike Easter

unread,
Oct 31, 2011, 11:15:54 AM10/31/11
to
Rocky wrote:
> Something strange is going on and it looks like it is time to hook up my
> network analyzer again.

It sounds like you need to have (more) secure router tables and policies^1.

What brand/modelno router is this?


^1
http://www.cisco.com/en/US/tech/tk365/technologies_tech_note09186a008009481d.shtml
Policy-based routing provides a tool for forwarding and routing data
packets based on policies defined by network administrators.


--
Mike Easter

§nühw¤£f

unread,
Oct 31, 2011, 12:42:44 PM10/31/11
to
Rocky wrote:
> I tried to log into my router today and it said it was being managed by
> 192.168.1.244 which happened to be the IP address I gave to my Slingbox.
> To make a long story short after I tried a few different things like
> disconnect and then reconnect the power to my router so I could access the
> router then I went to reconfigure that Slingbox by hand and it said it was
> at 192.168.1.254 which was weird too because I had left it at 192.168.1.244
> and a port was forwarded to 192.168.1.244 so it couldn't have worked at
> 192.168.1.254 either and it had been working.
>
You must have DHCP configured for your lan...

> So I reconfigured it back to 192.168.1.244 only to run into the exact same
> problem where I could not log onto my router because it was being used by
> 192.168.1.244. Something strange is going on and it looks like it is time
> to hook up my network analyzer again.
>
So do it :)

> So could it by my Slingbox or a hacker or a hacker using my Slingbox. Any
> ideas?
>
If you think yer PWN3d then unplug the router from the Internets, unplug
yer slingbox, and connect directly to yer router and change the Admin &
Password to something new. THen head over to the Slingbox forum and ask
them wtf is up...
<http://answers.slingbox.com/index.jspa>

You'll get better results.

^_^
--
http://www.skepticalscience.com/
www.friendsofanimals.org |www.snuhwolf.9f.com|
_____ ____ ____ __ /\_/\ __ _ ______ _____
/ __/ |/ / / / / // // . . \\ \ |\ | / __ \ \ \ __\
_\ \/ / /_/ / _ / \ / \ \| \| \ \_\ \ \__\ _\
/___/_/|_/\____/_//_/ \_@_/ \__|\__|\____/\____\_\

Rocky

unread,
Oct 31, 2011, 1:02:40 PM10/31/11
to

"Parko" <now...@nowhere.invalid> wrote in message
news:j8lpus$39e$1...@dont-email.me...
> On Mon, 31 Oct 2011 02:07:24 -0600, Rocky wrote:
>
>> So could it by my Slingbox or a hacker or a hacker using my Slingbox.
>> Any ideas?
>
> Buggered if I know, but you could try:
> a). Resting the router to its default settings. Look around for a pinhole
> on the box and shove a paper clip in it, reboot it.
> b). A firmware update.
> c). A complete open source solution: DD-WRT, if you're game.
> Note: the last two bright ideas could stuff up your mystery router.

Last night and this morning that Slingbox kept me out of my router at least
5 times and 2 of those were after I posted about it so I have wired things
up to prevent that Slingbox from getting access to the router it keeps me
out of and I haven't had any problem since. But that also means I will not
be able to access that Slingbox from the Internet now so I still plan on
recording the network traffic coming from that Slingbox to find out how it
could be screwing up my router.

It makes me think there is a backdoor in that Slingbox and I know for a fact
there used to be a backdoor in the Telecat BBS software written for the old
Apples that would blank the sysop's screen as soon as somebody started using
the backdoor. I found that backdoor when I disassembled the assembly
language interface for the Telecat BBS and I still remember what the code
was you needed to enter to use the backdoor.

Rocky


Rocky

unread,
Oct 31, 2011, 1:13:03 PM10/31/11
to

"Mike Easter" <Mi...@ster.invalid> wrote in message
news:op.v3710sqdtf8qa1@elite...
> Rocky wrote:
>> Something strange is going on and it looks like it is time to hook up my
>> network analyzer again.
>
> It sounds like you need to have (more) secure router tables and
> policies^1.
>
> What brand/modelno router is this?

It is a Netgear Wireless-N Gigabit Router model WNR3500 with the latest
software update whatever it is. I have it set to 192.168.1.8 but that
router/Slingbox never caused me any problems before.

> ^1
> http://www.cisco.com/en/US/tech/tk365/technologies_tech_note09186a008009481d.shtml
> Policy-based routing provides a tool for forwarding and routing data
> packets based on policies defined by network administrators.

It seems I would have to prevent it from using port 80 but I won't know for
sure until I record the network traffic from it. FYI I disconnected the
Slingbox and changed the password on the router then reconnected the
Slingbox only to have the IP address from the Slingbox lock me out of my
router again so maybe that Slingbox is screwing up my router another way.

Rocky


Rocky

unread,
Oct 31, 2011, 1:21:57 PM10/31/11
to

"Rocky" <woo...@att.net> wrote in message
news:AuKdnQ8xdZOGVDPT...@giganews.com...
BTW I found the version number of the software in the log. The log states:
[Initialized, firmware version: V1.0.36_8.0.36NA]

Because I had to power down my router to get access to my router my log does
not show if my Slingbox ever used the "[Admin login]" so I guess I'll have
to hook the two back up and see if that Slingbox is using the [Admin login].

Rocky


Rocky

unread,
Oct 31, 2011, 2:07:26 PM10/31/11
to

"�n�hw��f" <snuh...@Use-Author-Supplied-Address.invalid> wrote in message
news:201110311541.UTC.j8mfk5$1nj$1...@tioat.net...
> Rocky wrote:
>> I tried to log into my router today and it said it was being managed by
>> 192.168.1.244 which happened to be the IP address I gave to my Slingbox.
>> To make a long story short after I tried a few different things like
>> disconnect and then reconnect the power to my router so I could access
>> the router then I went to reconfigure that Slingbox by hand and it said
>> it was at 192.168.1.254 which was weird too because I had left it at
>> 192.168.1.244 and a port was forwarded to 192.168.1.244 so it couldn't
>> have worked at 192.168.1.254 either and it had been working.
>>
> You must have DHCP configured for your lan...

Of course I have DHCP enabled. But the Slingbox was disconnected when it
grabbed the 192.168.1.254. When the Slingbox was disconnected and then
hooked up to a router with DHCP it grabbed 192.168.1.201 when it should have
been using 192.168.1.244.

>> So I reconfigured it back to 192.168.1.244 only to run into the exact
>> same problem where I could not log onto my router because it was being
>> used by 192.168.1.244. Something strange is going on and it looks like
>> it is time to hook up my network analyzer again.
>>
> So do it :)

Before I dig out my software and hook up a hub instead of a switch so I can
record all the network traffic I decided I'd check one more thing. I hooked
the Slingbox up to the router and as soon as it kept me out of my router I
disconnected the Slingbox from the router waited for the router to time out
and I found this incriminating line in the log:
"[Admin login] from source 192.168.1.244, Monday, Oct 31,2011 08:28:36"

All the times in the log are about 3 hours off and 192.168.1.244 is the IP
address of my Slingbox so the line from my log means it or something using
the IP of my Slingbox was logged in as the Admin on my router.

Wow, it looks like I will have to setup a way to record network traffic next
because it could still be a hacker using the IP address of the Slingbox
since the only way I can access that Slingbox is with a wireless connection.

>> So could it be my Slingbox or a hacker or a hacker using my Slingbox.
>> Any ideas?
>>
> If you think yer PWN3d then unplug the router from the Internets, unplug
> yer slingbox, and connect directly to yer router and change the Admin &
> Password to something new. THen head over to the Slingbox forum and ask
> them wtf is up...
> <http://answers.slingbox.com/index.jspa>
>
> You'll get better results.

Thanks for the info and I plan to hook up a network analyzer with a Hub
before I let that possibly possessed Slingbox access that router again.

Rocky


Mike Easter

unread,
Oct 31, 2011, 1:13:01 PM10/31/11
to
Rocky wrote:
> "Mike Easter"

>> What brand/modelno router is this?
>
> It is a Netgear Wireless-N Gigabit Router model WNR3500 with the latest
> software update whatever it is. I have it set to 192.168.1.8 but that
> router/Slingbox never caused me any problems before.

Your netgear's setup doc and its manual seem to prioritize the wireless
security; but I always prioritize the router's security which is not
discussed in the setup docs, but fortunately is discussed in the user
manual in section 3.1 - after section 2 which is about wireless security
config.

The first thing I always do with my router is change the password from the
default.

Your router allows you to configure it to only allow it to communicate
with the IP addresses you want for the services you want.


--
Mike Easter

Rocky

unread,
Oct 31, 2011, 3:22:51 PM10/31/11
to

"Mike Easter" <Mi...@ster.invalid> wrote in message
news:op.v377fz08tf8qa1@elite...
> Rocky wrote:
>> "Mike Easter"
>
>>> What brand/modelno router is this?
>>
>> It is a Netgear Wireless-N Gigabit Router model WNR3500 with the latest
>> software update whatever it is. I have it set to 192.168.1.8 but that
>> router/Slingbox never caused me any problems before.
>
> Your netgear's setup doc and its manual seem to prioritize the wireless
> security; but I always prioritize the router's security which is not
> discussed in the setup docs, but fortunately is discussed in the user
> manual in section 3.1 - after section 2 which is about wireless security
> config.

Good idea but the way I access that Slingbox via wireless is to use a
Linksys WAP54G as a Wireless Repeater for a Linksys WRT54G. That way I
don't have to run a real long network cable to access that Slingbox.

> The first thing I always do with my router is change the password from the
> default.

I changed the password on the Netgear to "damnslingbox "and the Slingbox
still screwed me up but I do not have the log for that part of the test to
see if the log contains: "[Admin login] from source 192.168.1.244."

And, I'm wondering if that Slingbox has a way to circumvent the password.
If it does that gives me one more reason I want to hook up a Network
Analyzer.

> Your router allows you to configure it to only allow it to communicate
> with the IP addresses you want for the services you want.

I found that part and added:
-----
Services Blocking
Always

Service Table
# Service TypePortIP
1HTTP80192.168.1.244
-----
and shortly after I blocked the HTTP port I let the Slingbox talk to the
router it loves to lock me out of and it locked me out again. So I
disconnected the two of them, waited for the Netgear router to time out
again and found out that 192.168.1.244 was logged as Admin again.

FYI I pulled the network cable out of the Slingbox and then enabled the
wireless on my Linksys WRT54G (Router) because that talks to the WAP54G
(Access Point) that the Slingbox is normally plugged into. Always before
when I did that I'd end up with the IP address of my Slingbox logging into
my Netgear Router as Admin except this time, when the network cable was
pulled out of the Slingbox so now the question is why does that Slingbox
want to keep logging in as Admin?

I'll certainly be ready for more detective work before I let that damn
Slingbox access the Internet again.

Rocky


Rocky

unread,
Oct 31, 2011, 4:16:08 PM10/31/11
to

"Rocky" <woo...@att.net> wrote in message
news:w4CdncufF6hHSDPT...@giganews.com...
>
> All the times in the log are about 3 hours off

I found out how to fix that. It turns out the "Time" setting is under the
E-mail setup. Now it uses the local time in the Log.

I am going to try the change the password trick again but this time I'll
only have one thing hooked up to the Netgear Router. Wish me luck.

Rocky


Rocky

unread,
Oct 31, 2011, 4:55:25 PM10/31/11
to

"Rocky" <woo...@att.net> wrote in message
news:PsCdnTKXK68aejPT...@giganews.com...
>
> I changed the password on the Netgear to "damnslingbox "and the Slingbox
> still screwed me up but I do not have the log for that part of the test to
> see if the log contains: "[Admin login] from source 192.168.1.244."

I disconnected everything from my Netgear Router but one computer and then I
changed the password again.

After that I hooked up everything and gave the Slingbox access to the
Netgear Router. Shortly after that I noticed my Internet was running very
slow so I decided to check in on my router and I was locked out of my
Netgear Router again.

After disconnecting the Slingbox from the Netgear Router and waiting for a
time out so I could access the Netgear Router and I found this in the Log
[Admin login] from source 192.168.1.244, Monday, Oct 31,2011 14:24:01
[Admin login] from source 192.168.1.182, Monday, Oct 31,2011 14:22:30

Keep in mind that the newest is on top so that means in less than 2 minutes
after I logged into change the password the Slingbox had found away around a
different password and logged itself in as Admin again and when the Slingbox
logs in as Admin I can't log in.

BTW I disconnected power to the Slingbox for a bit and it still wants to
lock me out of my Netgear Router so next I'll have to setup a Network
Analyzer to find out how the Slingbox is working around the password changes
on my Netgear Router.

I have some ideas but I'll wait until I get more information.

Rocky


Mike Easter

unread,
Oct 31, 2011, 5:28:06 PM10/31/11
to
Rocky wrote:
> "Mike Easter

>> Your netgear's setup doc and its manual seem to prioritize the wireless
>> security; but I always prioritize the router's security which is not
>> discussed in the setup docs, but fortunately is discussed in the user
>> manual in section 3.1 - after section 2 which is about wireless security
>> config.
>
> Good idea but the way I access that Slingbox via wireless is to use a
> Linksys WAP54G as a Wireless Repeater for a Linksys WRT54G. That way I
> don't have to run a real long network cable to access that Slingbox.

While you are working on this security mystery, I would take the repeater
out of the equation.

That is just another security defect.


--
Mike Easter

Rocky

unread,
Oct 31, 2011, 6:53:23 PM10/31/11
to

"Mike Easter" <Mi...@ster.invalid> wrote in message
news:op.v38i84katf8qa1@elite...
If you look at my other post I disconnected the network cable from my
Slingbox and did not have any problem even with the Wireless Repeater
running.

> That is just another security defect.

Either way, I shut down that Wireless Repeater until I can hook up a Network
Analyzer. And I might hook up a Network Analyzer up between the Slingbox
and the Linksys AP54G Access Point since that is where I suspect the problem
really is.

If you have ever setup a Slingbox then you know it has software in it to
make changes to different routers for you and why that Slingbox wants to
constantly access my Netgear Router is beyond me.

Rocky


Rocky

unread,
Nov 5, 2011, 2:05:23 PM11/5/11
to

"Rocky" <woo...@att.net> wrote in message
news:zP2dnUGLtMWl1DPT...@giganews.com...
I have run Wireshark and as soon as the Slingbox at 192.168.1.244 talks to
the Router at 192.168.1.8 then I am locked out of that router with the
message "(192.168.1.244) is managing this device "
until I disconnect the two of them and then wait a few minutes.

I could not track down what caused it so I moved things around and put my
primary router on 192.168.1.3 and use a secondary router at 192.168.1.8.

But once I changed the IP address on my primary router from 192.168.1.8 to
192.168.1.3 I lost all my Address Reservations so that sucked or it would
have been real easy just to change the IP address of the router. Man, I'll
never understand why my Netgear Router had to do that.

Rocky


Rocky

unread,
Nov 5, 2011, 3:11:49 PM11/5/11
to

"Rocky" <woo...@att.net> wrote in message
news:IqGdnVzVdKJI8SjT...@giganews.com...
I just tried one more thing. I changed the address on the Router at
192.168.1.8 to 192.168.1.2 and then reprogrammed the devices that used it to
use the router at 192.168.1.2.

That seems to have taken care of the problem I was having with a router at
192.168.1.8 for now but it was a weird problem and I hope I don't run into
it again.

Rocky


me again

unread,
Nov 5, 2011, 5:18:21 PM11/5/11
to
Rocky wrote:
> "Rocky"<woo...@att.net> wrote in message
> news:zP2dnUGLtMWl1DPT...@giganews.com...
>> I tried to log into my router today and it said it was being managed by
>> 192.168.1.244 which happened to be the IP address I gave to my Slingbox.
>>
>> To make a long story short after I tried a few different things like
>> disconnect and then reconnect the power to my router so I could access the
>> router then I went to reconfigure that Slingbox by hand and it said it was
>> at 192.168.1.254 which was weird too because I had left it at
>> 192.168.1.244 and a port was forwarded to 192.168.1.244 so it couldn't
>> have worked at 192.168.1.254 either and it had been working.
>>
>> So I reconfigured it back to 192.168.1.244 only to run into the exact same
>> problem where I could not log onto my router because it was being used by
>> 192.168.1.244. Something strange is going on and it looks like it is time
>> to hook up my network analyzer again.
>>
>> So could it by my Slingbox or a hacker or a hacker using my Slingbox. Any
>> ideas?
>
> I have run Wireshark and as soon as the Slingbox at 192.168.1.244 talks to
> the Router at 192.168.1.8 then I am locked out of that router with the
> message "(192.168.1.244) is managing this device "
> until I disconnect the two of them and then wait a few minutes.
>
> I could not track down what caused it so I moved things around and put my
> primary router on 192.168.1.3 and use a secondary router at 192.168.1.8.

Ah, THAT would put both on the same subnet would it not?


>

§ñühwö£f

unread,
Nov 6, 2011, 12:37:18 AM11/6/11
to
me again <rick0....@gmail.spamless> wrote in
news:j9496v$14t$2...@dont-email.me:
good catch...change it to 192.168.2.XXX and give the slingbox a static
IP.


--
http://www.skepticalscience.com/
http://stopbeck.com|www.snuhwolf.9f.com|www.eyeonpalin.org
0 new messages