Symptoms
On all devices using my home network, I'm being shown http://www.google.com WARNING! Internet Explorer is currently out of date. Please update to continue.
or similar (depending on the browser) when I attempt to connect to google.com.
That’s a pretty typical ad, possibly an attempt to get you to install malware.
I wouldn't be surprised by this at all if it were just the laptop. It's the fact that this is happening on all devices on my network that confuses me.
Can my home network be compromised?
Absolutely.
Technical Explanation
How does that happen? Does a virus on a connected device break into the router and make changes?
Router Vulnerabilities
Check whether the router has a password and whether it is set to be configurable wirelessly and/or from the WAN side (outside the LAN). Most routers come with either a default password (which can easily be looked up) or no password at all. Worse, some routers come preset so that they can be configured wirelessly and/or from the WAN. This makes it easy for a simple network probe scan to find vulnerable routers.
Pseudo-code Attack Example
For example, pseudo-code might include:
for (IP=0.0.0.0 to 255.255.255.255) do { //scan through all possible IPs
if (canConnect(IP)) { //test for connection
if (login(IP, "admin", "")) { //try logging in as admin with blank password
doBadThings(); //hack router
}
else { //router has a password, try defaults
foreach (knownpasswords) { //try each known password
if (login(IP, "admin", pass) { //try logging in with a default password
doBadThings(); //hack router
}
}
}
}
}
Of course real code would be somewhat different (instead of testing for a blank password separately, it would simply be the first password in the known password database, the database would include default login names as well as passwords since they won’t always be admin
, the IP range will likely differ, there will be optimizations, and so on), but that’s the general gist.
Router Compromization
Once the malware finds a router that it can log into, it can “pwn” the router, and by extension, the whole LAN and the devices attached to it.
DNS Spoofing and Cache Poisoning
All mobile devices and laptops on my home network are experiencing the same alert when attempting to connect to google.com. How can something like this happen across all platforms on all devices in the same way? I wouldn't imagine every device / platform on the network would get the same virus.
In your case, what’s likely happened is a simple DNS redirection attack whereby the DNS servers on the router were set to a compromised/infected DNS server.
When you visit a webpage, the computer contacts a DNS server to look up the site’s IP address. With DNS spoofing, the compromised DNS server returns a false IP address to either some other website (likely hosting malware), or a phishing site which looks like the real site (again likely hosting malware), or it redirects to the real site after doing some other bad thing (logging your information, attempting to install drive-by malware, stealing passwords/cookies/etc., and so on).
Diagnostic and Repair Precautions
Should I assume that my network's security is totally compromised?
More than likely. In a case like this, it is best to disconnect all devices from the network until the problem can be resolved. It is not safe to even connect to a compromised network even if you don’t log into any sites. Simply connecting will expose the network password at a minimum, and visiting web sites even without logging in could expose things like cookies or at least metadata like the sites visited along with timestamps and such. A safe, dummy system with no sensitive data should be used to diagnose and fix the compromised router.
Prevention and Network Hardening
Keep in mind this isn't about the solution to the problem. I'll call a networking professional to handle that. I'm more interested in the origin, source, and method. I'd like to understand the issue in a way that might allow me to prevent it in the future.
To prevent this, you must always set a good password on your routers and even better, set them to only be configurable via a direct, wired connection (most people don’t need to modify their router settings from outside or often enough to make it too inconvenient to use a cable when a change is needed. These simple steps will drastically improve your LAN security.
DNS Server Settings
Pretty obvious injection. I agree that the dns servers are probably pointing to compromised or malicious servers, or your isp is trying to be 'helpful'. Use opendns (208.67.222.222 and 208.67.220.220} or google dns (8.8.8.8 and 8.8.4.4) by assigning these manually in your router's setup or assign them to one devicd and test to see if the problem goes away. – Ryan Griggs
@RyanGriggs I've never needed to get into my router settings, and I don't quite understand your explanation. I tried going to those IPs to get in, but got nothing so that must not be what you meant. I then tried routerpasswords.com but this router has absolutely no branding, name, or anything on it.
Actually, you did have a need to access your router settings. Simply adding a password and setting it to not be accessible from the Internet (and while you’re at it, also setting it to discard WAN-side pings to hide your LAN altogether), would harden the system immensely.
You wouldn’t visit the IPs that Ryan mentioned, instead you would set the DNS servers in your router to OpenDNS’ name servers (or Google’s or your ISP’s). That way, you ensure proper DNS resolution from a trusted name server (make sure to also clear the DNS cache on your devices to avoid continuing to use any poisoned DNS entries).
Router Identification
@bkr it's literally anonymous. Not a stitch of branding, not even on the back label.
There should still be some sort of identifying mark. At the very least, like all electronics, it should have an FCC identification number which can be looked up.
Also, as Ryan said, you can find the router’s IP address by using ipconfig
, then visit that IP address in a web-browser. Even if you don’t know the login details for the router, its web-interface should have some sort of identifying mark which you can then look up.
Hmm…
@bkr it's a local company. They connected to the router remotely, possibly through a computer here.
If it is the ISP’s router or if it is a modem/router combination (often advertised as an “enhance home-WiFi-gateway”), then they may have access to configure it remotely. In that case, you should definitely make sure to tell them that their system was compromised and that it is not secure. Demand that they secure them better, allow you to configure the router, or at least offer you a basic modem-only device so that you can get and use your own superior and more secure router. (You may even be able to get a bit of credit as an apology for their sloppy insecurity affecting your systems.)
If it is not the ISP’s router, then presumably there was nothing wrong with your router and the problem was indeed with their DNS servers (compromised at the ISP) since the only other explanation is that the ISP hacked into your own personal router and reset it. I’m not sure which is more concerning…