Security issue -- strange PC pops up in my "Shared" list

Question

Level 1

6 points

Security issue -- strange PC pops up in my "Shared" list

Just noticed today a PC that shows up in my "Shared" list in Finder.

My wireless is a closed network, with MAC filtering, passwords and WPA2 enabled.

So has someone hacked my wireless network or is this some local PC that Airport is picking up on an open wireless network? Whatever it is, I can't connect to it.

iMAC 24", 2.4 GHz 4 GB - 500 GB HDD, Macbook 2.0 GHz, 2GB, Macbook 2.4 GHz, 2GB, Mac OS X (10.5.6), 250 GB LaCie, Pentax K10D

Posted on Apr 29, 2009 5:34 AM

Reply

Answer 1

Rusty Rat Author

Level 1

6 points

Apr 29, 2009 6:27 AM in response to Rusty Rat

More info:

The unknown PC is identified as brn_d85516.

I changed my base station and access passwords in Airport and the unknown machine was back within minutes. Pull the ethernet cable out of my Airport Express and the unknown machine disappears. I'm using my Airport Express as a bridge as I already have a wired Linksys router installed.

My network is a combination of wired and wireless. There are no PCs connected to the network, though I do have a bootcamp Vista install. That install has been given a machine name and it doesn't match the unknown machine.

Reply

Answer 2

Rusty Rat Author

Level 1

6 points

Apr 29, 2009 8:25 AM in response to Rusty Rat

Anyone know where the logs are stored? the Airport utility has the log function greyed out and Console doesn't seem to have any.

Reply

Answer 3

Duane

Level 10

124,293 points

Apr 29, 2009 8:34 AM in response to Rusty Rat

It is someone else connected to your ISP who has file sharing enabled. They have not breached your network.

Reply

Answer 4

Rusty Rat Author

Level 1

6 points

Apr 29, 2009 8:57 AM in response to Duane

Thanks for your reply

Not likely as my ISP does not permit sharing to show. I'm aware of this issue and reported such a problem with my then cable ISP back in the mid nineties when their service became available. They had it shut down fairly quickly.

No, this machine disappears as soon as I shut down my wireless bridge. My iMac is connected via a wired router so my ISP is still accessible through it and the intruder is gone. Bring the bridge back up and he pops up within five minutes or so. Even changing the passwords had him popping back up quickly. If he's cracked the SSID and encryption key, then he's in until I do a hard reset. Even then, if he can do it once, he can do it again, so a hard reset only postpones things.

Reply

Answer 5

kinnybee

Level 1

7 points

May 12, 2009 8:58 PM in response to Rusty Rat

I have the same problem, an unknown pc machine pops up in my shared list in finder... machine name is npi098731...

It does not show up in my Airport Extreme's list of "Wireless Clients" (as all the mac addresses there are known and accounted for), nor does it show up in the Airport Extreme's list of "DHCP Clients" (all known).

Finder allows me to connect to it as a "Guest", but there are no shared files or folders. When I click "get info", all it says is that it is a pc.

Some help to discover the identity of this mystery machine would be greatly appreciated! My ISP is comcast. Could someone please further explain the issue of an isp possibly providing a file sharing connection?

Reply

Answer 6

Rusty Rat Author

Level 1

6 points

May 13, 2009 4:07 AM in response to kinnybee

Here's a link to HP that provides some explanation of the npi number:

http://forums13.itrc.hp.com/service/forums/bizsupport/questionanswer.do?admit=10 9447627124221162466228353475&threadId=554329

Since I haven't learned the equivalent yet in MAC land, I used my Bootcamp Vista install to ping using both the IP Address and the machine name, confirming that both are one and the same.

In my situation, what was very confusing about this was why a printer showed as a PC sometimes, and secondly why it would disappear when I'd yank out the wireless bridge, even though the printer was connect via Ethernet cable directly to the wired router.

I was able to connect to the printer web admin, but for whatever reason, the supplied password doesn't work so I can't se any details.

Type the printer IP address into Safari and it will get you to the web admin page for the printer. you should be able to dig out the rest there.

Reply