Duplicate login for home router?

[ron040401]

This is freakin' me out. Charter Communications just switched over to SuddenLink as my cable internet provider. I noticed since then that my router and cable activity lights are VERY busy. So, I decided to log into my router and check the settings. I have a Motorola Surfboard and a Belkin 802.11b wireless router which has 128-bit encryption, is not broadcasting and is password protected. There were 2 computers connected to the router at the time. One computer was on but doing nothing. Another computer was downloading an updated Linux ISO.
When I tried to login at the router, I received a white screen with large dark lettering that stated something similar to "Duplicate login not permitted. Device administered remotely by IP 140.6.20.0". If that wasn't enough to rattle my nerves, the info I got from Spade's WhoIs certainly did:
08/07/06 11:26:50 IP block 140.6.20.0
Trying 140.6.20.0 at ARIN
Trying 140.6.20 at ARIN

OrgName: DoD Network Information Center
OrgID: DNIC
Address: 3990 E. Broad Street
City: Columbus
StateProv: OH
PostalCode: 43218
Country: US

NetRange: 140.6.0.0 - 140.6.255.255
CIDR: 140.6.0.0/16
NetName: SUM-WPAB-3
NetHandle: NET-140-6-0-0-1
Parent: NET-140-0-0-0-0
NetType: Direct Assignment
Comment: Defense Information Systems Agency
Comment: Attn: Code DDEH/B611
Comment: Washington, DC 20305-2000 US
RegDate: 1990-04-08
Updated: 1991-07-18

RTechHandle: AJC5-ARIN
RTechName: Tso, Ann J.
RTechPhone: +1-703-735-3131
RTechEmail: tsoa@cc.ims.disa.mil

OrgTechHandle: MIL-HSTMST-ARIN
OrgTechName: Network DoD
OrgTechPhone: +1-800-365-3642
OrgTechEmail: HOSTMASTER@nic.mil

# ARIN WHOIS database, last updated 2006-08-06 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.
--------
Why is the military controlling my router? The 703 area code phone number validates to extension 3131 of that land based number in Washington, VA. Nobody ever answers the call but you may leave a recorded message. A Google search come up with whispered blogs of this same IP address but the city and state appears to change.
I have a clean system, firewalled, password-protected and the same goes for the router. To whom do I attribute the invasion of my privacy? SuddenLink or the Bush boys?

 

[bcastner]

This is a router hack that has been going around recently. All of the information you provided above is perfectly legitimate, but you should have been suspicious immediately when you saw an IP of 140.6.20.0 It is exceedingly rare for "zero" IPs to be seen on the Web, and most routers would reject the address as illegal.

In any case, DoD is one of fifty or so agencies that are listed as being used with this hack:

http://www.cuttingthroughthematrix.com/firewallhits.htm

There have been several discussions on the Web about this. This is a typical one:

http://forums.amd.com/lofiversion/index.php/t39099.html

As the hackers would say, your Belkin router is Own3d.

 

[eyec]

disconnect the cables to the router from your provider

scan both of your machines for any suspicious programs (in safe mode)

after removing any problem programs
login to your router (still disconnected from provider)

change your security settings - for a password do not use common word strings. use a combination of letters and numbers that do not even resemble common words.

enable MAC address filtering.

if your router has WPA use that.

power down the machine that the controls your connection, re-connect the cble to the router power back up and see if that clears the hack.

good luck

 

[ron040401]

My first response was to power cycle. I was then able to get into the router. I already have 128-bit encryption and an uncommon password. I do not use MAC Address filtering since my son often has Internet gaming parties; some connect by wire and some wireless. If a router hack was performed through wireless connection, the hacker would need to be within range. So, I don't think that is an issue. I perform frequent cleanups and virus and spyware checks. I use Ewido, AVG, Ad-Aware and Housecall at least once a week.
So, let's assume this is a router hack. That raises two questions. First, are there any utilties that check for and prevent router hacks? Second, why does a WhoIS program display changing information when asked who 140.6.20.0 is? I get an Ohio address. An associate in Atlanta got a Georgia address. Another associate in Toronto got a New York address.

 

[bcastner]

Your ARIN information was correct.
CIDR:140.6.0.0/16

I suggest pilot error on behalf of your Atlanta and Toronto associates.

 

[eyec]

to be precise
Dayton, OH
39.761N
84.194W

Name: Unknown
Network: Unknown