Router reset / Password blanked (???) Not by me !

To give some location info, I live in Maryland.

I returned home from work last evening and logged on to my Windows-7 computer. I was greeted by a pop-up that indicated a new network had been detected and needed to be configured. I closed the pop-up without choosing the type of network. This morning I started investigating. The first thing I discovered upon trying to login in to the MI-424WR Ver. C router was that it had apparently been reset to factory defaults because it asked for me to set and verify a password. This reset apparently happened sometime between Thursday night (05/12/11) and last night, 05/13/11, because I did not receive a 'New Network' notification until last night, and I log on every night.

I started poking around in the router system logs and found the following: (IP and GTW addresses replaced with 'xxx')

Aug 31 13:48:20 2007 System Log Message LAN Coax Link Up

Aug 31 13:48:21 2007 System Log Message WAN Coax Link Up

Aug 31 13:48:33 2007 System Log Message DHCP WAN connection IP:xxx.xxx.xxx.xxx,DNS:71.242.0.12 71.252.0.12 ,GTW:xxx.xxx.xxx.xxx,Subnet:255.255.255.0 (WAN MoCA)

May 13 02:07:49 2011 System Log Message LAN Coax Link Rate <TX 210Mbps/RX 186Mbps>

May 13 02:07:50 2011 System Log Message WAN Coax Link Rate <TX 222Mbps/RX 239Mbps>

May 13 02:12:04 2011 System Log Message LAN Coax Link Rate <TX 210Mbps/RX 210Mbps>

May 13 02:12:05 2011 System Log Message WAN Coax Link Rate <TX 239Mbps/RX 238Mbps>

It looks like the clock (and the router?) were reset around May 13 02:07:49 2011, from the above entries.

I then checked the router's firewall log and found:

May 13 02:07:20 2011 Firewall Setup Configuration change Internal application has changed security settings
May 13 02:07:23 2011 Firewall Setup Firewall status changed enabled
May 13 02:08:04 2011 Firewall Setup Configuration change Internal application has changed security settings

At 2 A.M. I'd been asleep for several hours.

Can someone shed some light on what's happened here? Did Verizon force out an update to the router firmware and reset the router to defaults? I'm concerned because from the time of the reset until I set a new password this morning, my router was wide open. If this was Verizon's doing, I'm EXTREMELY concerned !

Accepted answers

Anti-Phish1

@Thor wrote:
The first thing I discovered upon trying to login in to the MI-424WR Ver. C router was that it had apparently been reset to factory defaults because it asked for me to set and verify a password.
Check if your firmware version has been upgraded to 4.0.16.1.56.0.10.14.4.
There is a thread discussing this firmware update & rotuer reset here:
http://www.dslreports.com/forum/r25834136-Actiontec-reset-by-itself-
Most firmware updates require a reboot of the router, but don't usually require a hard reset.
Not that it would do much good, but my suggestion is to call VZ and request an explanation of why they did a hard reset on your router (beyond the obvious "we did a firmware push").
Your post doesn't indicate if you had done any customizations of your router. If you had, these would have been lost.
This also strikes me as contrary to VZ's security concerns. Last August to their credit, VZ made a change to any router that had a common password such as "password" or "password1" to use the router's serial number instead, because of a hack published at last year's DEFCON hacker conference. By doing a hardware reset of the router and not setting the password to the serial number as before, VZ is leaving the router open to the same hack. As Smith6612 points out, your router is only accessible from the LAN, however, this particular hack involved PC malware that could access your router and make configuration changes potentially opening your LAN to attack from the internet.

All comments

viafax999

@Thor wrote:
I'm concerned because from the time of the reset until I set a new password this morning, my router was wide open. If this was Verizon's doing, I'm EXTREMELY concerned !

Wide open only to your internal network and anyone on your internal network that attempted to logon to the router. Agreed it sounds like a factory default reset probably due to a firmware update but not really much of a security issue. Does mean that you lost all router configs you'd made.

Could try asking VZ if they did it, if they say no then you should probably request a new router as that would indicate a fault in your current router.

smith6612

2AM sounds almost like a firmware push or a Verizon-issued reboot through their CWMP Agent. Unless it becomes more frequent I wouldn't worry about it too much.

Anti-Phish1

@Thor wrote:
The first thing I discovered upon trying to login in to the MI-424WR Ver. C router was that it had apparently been reset to factory defaults because it asked for me to set and verify a password.
Check if your firmware version has been upgraded to 4.0.16.1.56.0.10.14.4.
There is a thread discussing this firmware update & rotuer reset here:
http://www.dslreports.com/forum/r25834136-Actiontec-reset-by-itself-
Most firmware updates require a reboot of the router, but don't usually require a hard reset.
Not that it would do much good, but my suggestion is to call VZ and request an explanation of why they did a hard reset on your router (beyond the obvious "we did a firmware push").
Your post doesn't indicate if you had done any customizations of your router. If you had, these would have been lost.
This also strikes me as contrary to VZ's security concerns. Last August to their credit, VZ made a change to any router that had a common password such as "password" or "password1" to use the router's serial number instead, because of a hack published at last year's DEFCON hacker conference. By doing a hardware reset of the router and not setting the password to the serial number as before, VZ is leaving the router open to the same hack. As Smith6612 points out, your router is only accessible from the LAN, however, this particular hack involved PC malware that could access your router and make configuration changes potentially opening your LAN to attack from the internet.

Thor

Thanks to all. Yes, it appears, by the version #, that the firmware has been upgraded. I still haven't had an opportunity to speak to anyone at Verizon, but that is on my near-term to-do list.

Again, thanks all !