WiFi Intruder or something to do with Win 10 Updates?

Page 1 of 2 12 LastLast
  1. ausgumbie's Avatar
    Posts : 44
    Windows 10 Home, Ver. 1803, OS Build 17134.112
       #1

    WiFi Intruder or something to do with Win 10 Updates?


    Hi all

    I’m in a quandary and need some expert help.

    We’re in Brisbane, Australia. This query is about whether an unknown device that connected to our WiFi hotspot is just an intruder who’s discovered our password or some virtual device to do with Win 10 updates.

    My family has a Netgear, BigPond Wi-Fi 4G Advanced II AirCard 790S hotspot. A day or so ago, an unknown device was shown on the online manager page. Being alone, and knowing no other devices were on, I panicked and, without noting the device details, I just got off the internet. Later, when I’d thought about it and got back on to see if it re-joined and snare its details, it didn't re-appear.

    Today (15/8/2016), it reappeared - my wife was also online this time. I checked with her what devices she knew were on and the suspect one seemed definitely an "extra". So, this time, I logged in to the WiFi manager, got the “stranger’s” details and blocked it.

    Devices connected to our hotspot are shown, I gather, by their “device name” which in my case is the name I gave my laptop when setting it up. My wife’s devices seem to have default names which I imagine devices take if you don’t give them a custom name. In the connected devices panel, the “stranger’s” showed as a 12-digit Mac identifier (i.e., paired numbers and/or letters separated by hyphens). The online WiFi manager page, if you log into it, will also show a device’s IP identifier. In this case, the “stranger’s” was “IP: 0.0.0.0.” I looked up the Mac number on a site called "Arul's Utilities" and it told me the manufacturer (Western Digital, 1599 North Broadway, Rochester Mn 55906, United States) which doesn't mean anything to me.

    I next googled "IP: 0.0.0.0" but I have to admit not really understanding a damn thing I read. “Hosts” and "all IPv4 addresses on the local machine" left my head swimming. (Yes, I’m an old person and I’m just not computer-literate to that extent). But, it put a suspicion in my mind that I'd blocked something that's part of our home network to do with Win 10 updating. If so, what?? I’m inclined to doubt this since the “stranger” is still blocked, and Security Update for Windows 10 Version 1511 for x64-based Systems (KB3172729) has just successfully downloaded.

    Anyhow, my gratitude for any patient and kind soul who can throw any light on the situation.

    Yours

    ausgumbie
      My Computer

  2. TairikuOkami's Avatar
    Posts : 4,693
    Windows Home Dev 21xxx x64
       #2

    Yes, 0.0.0.0 is used for listening on the local computer, but since you say, it has MAC identifier, it might a device, which tried to connect to your hotspot, probably automatically and failed, so it got assigned IP 0.0.0.0.

    https://technet.microsoft.com/en-us/library/cc958902.aspx

    To quickly view, what is connected to your router, you can use Wireless Network Watcher.

    You can check, what is listening on your computer using CurrPorts.

    Sort it by Remote Address, it will put 0.0.0.0 on top and see, if anything looks suspicious, like this:
    Attached Thumbnails Attached Thumbnails WiFi Intruder or something to do with Win 10 Updates?-capture_08152016_084321.jpg  
      My Computer

  3. ausgumbie's Avatar
    Posts : 44
    Windows 10 Home, Ver. 1803, OS Build 17134.112
    Thread Starter
       #3

    TairikuOkami said:
    Yes, 0.0.0.0 is used for listening on the local computer, but since you say, it has MAC identifier, it might a device, which tried to connect to your hotspot, probably automatically and failed, so it got assigned IP 0.0.0.0. ...
    Thanks TairikuOkami

    I had a quick look at the "Troubleshooting DHCP Clients" article, again thanks. I have a couple of questions. Please bear with me - I really am low in computer knowledge and terminology.

    When you say "0.0.0.0 is used for listening on the local computer" do you mean my computer (being the local computer) is listening (through its ports) to others which are trying to join the network OR that computers outside the home network are listening to my computer? (Your CurrPorts screenshot seems to suggest 0.0.0.0 is assigned to others listening to my computer).

    The other bit I didn't quite follow was "it might be a device which tried to connect automatically but failed". I'm not sure that would then appear on the list of connected devices (i.e., if it hadn't managed to connect). I'd thought the AC790's online manager only registered devices that had managed to connect.

    If this was a device that had managed to establish a connection, could the 0.0.0.0 signify the device had had its IP address somehow masked?

    Many thanks

    ausgumbie
      My Computer

  4. TairikuOkami's Avatar
    Posts : 4,693
    Windows Home Dev 21xxx x64
       #4

    ausgumbie said:
    When you say "0.0.0.0 is used for listening on the local computer" do you mean my computer (being the local computer) is listening (through its ports) to others which are trying to join the network.
    Yes, that is your computer, you do not have to worry about that, unless you would have some malicious app running..

    ausgumbie said:
    The other bit I didn't quite follow was "it might be a device which tried to connect automatically but failed". I'm not sure that would then appear on the list of connected devices (i.e., if it hadn't managed to connect). I'd thought the AC790's online manager only registered devices that had managed to connect.
    I can only speculate like you, since the info is insufficient, but it depends on configuration of your hotspot. It is made to make connecting devices easy, so taking advantage of features like a guest WiFi Support might have helped it.
      My Computer

  5. ausgumbie's Avatar
    Posts : 44
    Windows 10 Home, Ver. 1803, OS Build 17134.112
    Thread Starter
       #5

    Thanks TairikuOkami

    Sorry tardy with reply - other things delayed me.

    Many thanks for the info which I will follow up.

    Cheers

    ausgumbie
      My Computer

  6. Mystere's Avatar
    Posts : 3,257
    Windows 10 Pro
       #6

    If the MAC address manufacturer is Western Digital, that probably means it's a wireless NAS or "Cloud" hard drive. Do you have one of those? Perhaps if you listed the MAC address we might be able to help narrow it down more.

    0.0.0.0 on a router probably means that no IP Address was assigned, which means it can't do anything on the network.
      My Computer

  7. ausgumbie's Avatar
    Posts : 44
    Windows 10 Home, Ver. 1803, OS Build 17134.112
    Thread Starter
       #7

    Hi both.

    I have a painful admission - my wife pointed out to me a little device sitting on the tv set. "Could your hacker be that?" she asked. Today, late in the peace, I checked it out. The device is a WD TV Live Streaming Media Player. On the back is a details sheet - with the MAC number listed on it. The same number as my "hacker".

    Oh, well, at least I've learned a lot about WiFi security, but - I very much feel like a goose! My apologies.

    I live and learn

    ausgumbie
      My Computer

  8. TairikuOkami's Avatar
    Posts : 4,693
    Windows Home Dev 21xxx x64
       #8

    Actually I think it is quite admirable, how you handled the issue. Most people would just ignore it.
    You can never be cautious enough, especially talking about WiFi's security. Keep that attitude.
      My Computer

  9. ausgumbie's Avatar
    Posts : 44
    Windows 10 Home, Ver. 1803, OS Build 17134.112
    Thread Starter
       #9

    Hi TairikuOkami

    Thanks for your kind words. I'll certainly keep that attitude and I'm certainly going to follow your suggestion about WNW and (especially) CurrPorts.

    Cheers

    ausgumbie
      My Computer

  10. Mystere's Avatar
    Posts : 3,257
    Windows 10 Pro
       #10

    ausgumbie said:
    Today, late in the peace, I checked it out. The device is a WD TV Live Streaming Media Player. On the back is a details sheet - with the MAC number listed on it. The same number as my "hacker".
    Ahh.. I'd forgotten that WD was in that market, yeah good catch by your wife :)
      My Computer


 
Page 1 of 2 12 LastLast

  Related Discussions
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 19:46.
Find Us




Windows 10 Forums