WBM User Unknown - firewall config change

[Kei897]

In my Security Log I have been seeing a strange message that keeps appearing, see below.

I have no idea what this is or if this is someone hacking my router or if a virus is on my computer.  It has appeared even during times when my computer has been turned off.  I have my firewall set at max security and changed my password.  Even after changing my password this appeared.  Not sure what this is or what to do about it but I am very concerned.

Firewall Setup Configuration change

WBM user Unknown (0.0.0.0) has changed security settings[repeated 5 times, last time on Aug 25 03:00:26 2010]

[Hubrisnxs]

I don't know what it is for sure, but there are users at another forum asking about it.   not sure if it means anything. 

One guy reset the log, and disconnected physically from the net, and then factory restored his router, and he still got the message, so he was thinking it might be just a bug in the firmware,    

you can see their discussion here.

[Hubrisnxs]

a user on the other forum mentions this.    

kinda makes sense.

"I believe the default config for the router is to query for updated firmware at specified intervals."

WBM means web based management, and 0.0.0.0 means the request did not come from outside your home.  it was internal. 

[VSurfn]

This explanation was given by Actiontec (they build the router for Verizon)

Product:MI424WR (Rev. I) - Wireless Broadband Router

Incident Summary
=========================
Since Verizon can't answer this question I would like to know for the
people who built this router. 

Verizon Actiontec MI242WR (not sure of Rev) 
firmware 40.19.36

Why do I get this log security event every day?

mmm dd hh:mm:ss yyyy
Firewall Setup Configuration change WBM user Unknown (0.0.0.0) has
changed security settings
=========================

Resolution:
=========================
Each and every day, Verizon has a server that makes contact with your
router to check its firmware.

No changes are made to your router however, it simply checks the router

to make sure the firmware is up to date and this generates a log entry.
=========================

[abern01]

VSurfn:

Although that sounds like a viable explanation from Actiontec...I just don't buy it!  You say you get that log entry every day?  I received just one entry in my log showing the identical message.  That issue took place 27 times between January 22 and January 30, 2013.  My log goes back to December 14, 2007 and that entry has never, ever appeared prior to last week.

If you ask me...Actiontec is just blowing smoke up your skirt!

Apparently neither Verizon nor Actiontec has a viable answer!

[lfish43]

I dont buy it either. I have been having the same issue - the thing is it that it seems to happen right after I log into the router and make changes. The ither night I logged in at 3AM and changed some settings because I was having issues with my android phone transfering files. The next  day I logged in and one hour after I had logged in, I had this message:

WBM user admin (192.168.1.7) has changed security settings [repeated 2 times, last time on Feb 6 03:55:21 2013]

Why would I have a login 1 hour after I did? So the last few days, I have been regularly logging in and changing things just to see what happens. EVERY TIME I login, shortly after I get the same log as above. Why does it have to check for firmware updates several times a day, right after I login? I also chaged the general settings to allow only 1 session at a time, so If I am logged in, nobody else can. Well, several times I have tried to login and I get a message saying that I have to wait for the current session to end. Meaning that somebody else is logged in.

I am not liking this at all. I think it is a back door, and there is more going on than firmware checks. I am going to keep researching this and to the bottom of it. 

[Hubrisnxs]

"WBM" is Web Based Management and the ip address 0.0.0.0 is known as the default route, so it's unlikely these are external events.

There are backdoors to that router, but they don't come from WBM.

[lfish43]

Thanks for the info..

Are you pretty savvy with networking? There are some other logs that concern me. Here is one:

Its the bittorrent part that I was wondering about.. I dont have that on my machine. I double checked ( at one time my son installed utorrent, but it was uninstalled over a year ago)

Thanks.

Peace,
elPhish

Inbound Traffic

Accepted Traffic - Service

BitTorrent (TCP): TCP 120.192.95.36:43092->192.168.1.7:32701 on clink1

[Hubrisnxs]

That IP '120.192.95.36' is from china so that log entry is telling you that a machine at your location (192.168.1.7) has a torrent program and is downloading from that other ip.  

So you want to do an ipconfig on each of your machines to see which has the .7 address

Deciphering the Information

To get to ipconfig, we have to get to the command line.

• Click Start, click Run, type in “cmd” & hit enter.
• Type in ipconfig & hit enter. (you can use ipconfig /all for detailed information)

You will get a screen that looks like this.

[stamina1914]

For what it is worth guys and I am no techy here, but I have gotten that message several times.  I actually got 13 today. However, the caveat is, I have been trying to unsuccesul to wake my pc via a mobile phone today with the Ceton media Center App.  the 13 events that the security log documented was in fact me trying to get into my system.

The irony here for me is that my port forwarding should be working, but I router kung fu is still to strong.