My router is Cisco 871, IOS 12.4. I have been subject to hacking recently via the console.
He executed the following commands: User:console logged command:access-list 199 permit icmp host 10.10.10.10 host 20.20.20.20.20
User:console logged command:crypto map NiStTeSt1 10 ipsec-manual
User:console logged command:set peer 20.20.20.20
exit - then Loopback0, changed state to up
User:console logged command:no access-list 199
User:console logged command:no crypto map NiStTeSt1
The system restarted at that point. Some days after this I received the following suspect traffic on my logs, repeatedly (ongoing):
list permitted udp 10.240.96.1(67) > 255.255.255.255(68) 1 packet (or 12 or more, at intervals of between 2 and 10 minutes)
Since then there has been one more intrusion event, exactly the same commands, although I had changed the password on the console.
How do I sweep the router clean of any commands he left there, and, more importantly, how do I stop this guy from breaking in again?
The attacker would appear to be IP address 58,218.199.250, I have had portscans from this address frequently until recently when that ceased and was replaced with the 10.240.96.1(67) > 255.255.255.255
Any assistance would be gratefully appreciated. I have put a similar request in Security, other questions.
