Man in the middle attack query

PleaseHelp
PleaseHelp Member Posts: 5
First Comment Photogenic
edited April 16, 2021 in Devices & Security #1

 just spent 10 minutes typing this so I’m not sure if this is going to be a duplicate. Thank you all for helping out , your terrific community and thiis pretty important. I am , confirmed, suffering a man in the middle attack. Last night I reset my ASUS router and I named my SS ID a name that was sort of poke the bear and tell the people I know what’s going on.

The only thing on my router at that point was the router and an iPod touch. A couple minutes later 4 devices were on Fing and my iPod touch was gone. These photos are attached. 

Someone who knows more than me he said these are just IPs Related to the router being reset. But it looks like they’re connected devices? Why did the iPod touch go away? 

I know this sounds spy like but there’s a distinct possibility that these people got on and one person said holy smokes and everyone else jumped on as well to see the SSID.

I really appreciate anyone who can tell me anything and are these four devices connected? FYI I was on IP not Mac.

Ramz

Answers

  • Ciaran
    Ciaran Administrator Posts: 1,180
    1000 Comments 250 Likes 50 Answers 100 Awesomes
    admin
    Hi @PleaseHelp, thank you for your post. To note, I have renamed the title of your post to better reflect your query. Thanks
    Ciaran (Admin at Fing)

  • hopkins35
    hopkins35 Member Posts: 16
    10 Comments First Answer 5 Agrees 5 Likes
    @PleaseHelp find the MAC addresses of those devices by tapping on them and try a MAC address lookup site like https://www.macvendorlookup.com/ which may or may not show the vendor, I would suspect that these are all different interfaces for your ASUS router which have shown up briefly after the reset. Even if the MAC address lookup can't identify them, if the addresses start with the same first few digits of the MAC address of your router, which I'm assuming is the device with IP 192.168.50.1, then you can be pretty confident that it's nothing to worry about. You can double check the MAC address of your router from the system status page of its web interface or from a sticker on it somewhere

  • jwoods7947
    jwoods7947 Corning OHMember Posts: 12
    10 Comments First Answer First Anniversary Photogenic
    edited April 16, 2021 #4

    Anything apple uses random Mac (private in network settings) address system and I do believe it's random. So it's not the same usually and sometimes certain routers don't like this and have a hard time identifying what exactly it is. Mine happens to not identify, but tells me it's spoofed. Not all do this but regardless Fing should also tell you it's a random Mac. You can turn off this feature on all apple products by going into network settings and unchecking the private box. It will need to reconnect to network password and all btw after you do this. It's ment more for public wifi and not private. This isn't your issue per say but it don't help your issue either.

  • PleaseHelp
    PleaseHelp Member Posts: 5
    First Comment Photogenic

    Thank you for your timely replies, but I may have not been clear enough (or my lack of knowledge)


    1. These "devices" dissapeared after a few minutes. I dont have access to them

    2. I believe they are IP addresses not MAC addresses

    3. Yes, I am on all Android and PC x ipod touch. They are on Apple. Fing has confirmed. I know there mac address won't show

    4. My concern with my ipod touch not on is that I was on a spoofed network. Comcast high security confirmed that my network , when I had their router, was cloned. It's very odd my router and my device aren't listed after they were a few minutes earlier?

    So same critical question. Any way to tell from image if these IP addresses or way fing shows these are truly devices?


    THANK YOU!!