Was I hacked? Unknown renderer - Wget

For help and support with Universal Media Server in general
Forum rules
Please make sure you follow the Problem Reporting Guidelines before posting if you want a reply
Post Reply
bluesdevil
Posts: 3
Joined: Tue Sep 02, 2014 5:54 am

Was I hacked? Unknown renderer - Wget

Post by bluesdevil » Tue Sep 02, 2014 6:03 am

I left my computer on while I was sleeping with UMS still running and when I woke up I noticed "Unknown Renderer" icon on status page. I checked the logs and my router's IP is noted to be accessed with this message below it a dozen times minutes apart:
"Media Renderer not recognized. Possible identifying HTTP headers: user-agent wget"

Just wondering if this is normal behavior when not used for 4 hours or so..... or was my computer compromised?
Sorry, I'm an idiot and closed the program before saving log file.

EDIT: Okay, I restarted UMS and the unknown rendered showed up again. This time I grabbed log files and zipped.
Thanks for any advice.
Attachments
ums_dbg.zip
(15.71 KiB) Downloaded 70 times

SpeedyQ
Posts: 173
Joined: Tue Jul 03, 2012 9:43 pm

Re: Was I hacked? Unknown renderer - Wget

Post by SpeedyQ » Tue Sep 02, 2014 8:50 pm

Hi,

From your log I can see UMS is running on 192.168.1.2 and listening for client requests on port 5001.
Your request (Wget) seems to come from 192.168.1.1.
I can't tell what device it is, but usually that IP is in use by the router.
So I don't think that you are hacked as it's coming from your LAN.
If you are not sure what devices you have on your network using which IP address, you may want to install the application Fing on your android device and connect to your LAN.
Fing will show you the devices, IPs and services on your LAN.
Have a try...

bluesdevil
Posts: 3
Joined: Tue Sep 02, 2014 5:54 am

Re: Was I hacked? Unknown renderer - Wget

Post by bluesdevil » Wed Sep 03, 2014 7:14 am

Thanks for the reply, SpeedyQ!
I don't have any Android devices, so I installed Fing on my PC and get this when entering on command prompt:
“fing” is not recognized as an internal or external command, operable program or batch file."


The unknown media renderer would have to have my WEP security code to access my wi-fi router? I'm thinking something got in through the internet connection, which is hardwired through my router all the way to my PC.

I use UMS to stream movies from my PC to my wireless Sony blue-ray player hooked up to my tv.

I'm off to figure out why Fing isn't working and I'll update when I get more info. Thanks!
_________________________________________________________________________
EDIT:
Okay, would not work from command prompt, but I found fing.exe file in program folder and just clicked from there.
It shows my router, my computer and a Motorola Mobility device.... don't know anything about the Motorola device!
_________________________________________________________________________
Double Edit:
Ah............ my 2 tv converter boxes are Motorola!! So, that's solved.... jeez, I'm feeling stupid!
I wonder if one of the boxes was showing up as the "Unknown Media Renderer"?

SpeedyQ
Posts: 173
Joined: Tue Jul 03, 2012 9:43 pm

Re: Was I hacked? Unknown renderer - Wget

Post by SpeedyQ » Wed Sep 03, 2014 9:07 am

If you want to be sure, you can power off your Motorola boxes or at least disconnect them from your lan.
But I think UMS always shows the Unknown renderer, so even if there is no device connecting.
All devices that do connect, should show a User-Agent detection string in the debug.log.

bluesdevil
Posts: 3
Joined: Tue Sep 02, 2014 5:54 am

Re: Was I hacked? Unknown renderer - Wget

Post by bluesdevil » Wed Sep 03, 2014 9:31 am

Thanks again, SpeedyQ...... good to know there are patient folks here willing to share knowledge and help. I'm learning as I go, always learning something new.
I disconnected the tv boxes and the Motorola Mobility devices disappeared in Fing, now just gonna wait for that "Unknown Media Renderer" to show again and run that software to make sure.
We had a brownout around the time of the Wget agent activity that's noted in the UMS log.... now I'm guessing it was just my tv box trying to reconnect to my LAN. I probably freaked out over nothing.
Many thanks again for the heads up on the Fing software.

Post Reply