Has my router been hacked?

[coldraven]

In my routers Firewall configuration section it has two settings. I'm away from home right now so this is from memory. One setting was something like "Normal" and the other is "SPI". Nowhere in the help or the instruction manual did it say what SPI means.
Anyway, one day my internet connection was going very slow so I checked to see if there where any ports open by going to ShieldsUp here:
https://www.grc.com

It revealed that I had three ports open,FTP, Telnet and HTTP
So I enabled the "SPI" setting and now ShieldsUP cannot find any ports, in fact it tells me that my machine is invisible to the outside world. It cured the slow response so maybe someone was trying to hack in.
I found it hard to believe that the makers of my router (Edimax) shipped it with those ports enabled.
This may not be your problem but for peace of mind check it.

[Paqman]

If you aren't using any type of encryption all of your passwords for email, banking or anything else you happen to be doing are going out in the clear.

Important stuff like banking will still be https, so not quite in the clear, but there's really no reason to use an unencrypted wifi connection at home.

WPA passwords are relatively laboursome to crack, assuming you don't use a dictionary word, but chaniong it if you suspect funny business would be a good idea, and switch to MAC address filtering as an added check. At the very least you'll find that if something unexpected stops working you might have accounted for your extra MAC and can sleep easy.

[x-shaney-x]

Thanks for all the replies and info.

The bit of research I have done suggests that as Ji Ruo indicated, it wouldn't be that hard to get into a router and it seems it isn't hard to spoof or even clone an existing MAC address so I certainly wouldn't want to rely on MAC filtering alone.

In any case, I have discovered that the router will no let me add devices to the accept list if they don't have a device name and neither my PS3 or wireless printer have device names come up so I can't use it at all.

I have contacted my ISP with my concerns so I'll see what they have to say or if they can check into it.

On my part I have always changed router passwords when I get them but I do use the default pre-shared key for convenience.

[rencemc]

I don't really do anything involving online banking or anything like that so I'm not too concerned about encryption. I am also in a sparsely populated area - I can barely see any neighbors wireless networks. If I lived in a more densely populated area, I would probably use encryption. So right now I am at peace just keeping wardrivers off my network. But yeah, if I thought people were jumping on it, I would enable encryption.