4

I'm a very computer savvy guy (although not very networking savvy), and I may still be wrong about this, but I think my home network may be compromised somehow. I'd like to know if it's possible for someone to have hijacked my network's connection to Google.com and other popular websites.

Update: The issue seems to take effect with all popular websites. I can connect to small (non-popular) websites without issue, but Facebook, Google, Yahoo, and Bing cannot be accessed by any device on my home network.

On all devices using my home network, I'm being shown

http://www.google.com WARNING! Internet Explorer is currently out of date. Please update to continue.

or similar (depending on the browser) when I attempt to connect to google.com.

I wouldn't be surprised by this at all if it were just the laptop. It's the fact that this is happening on all devices on my network that confuses me.

Here's the screenshot from my iPhone and tablet, for reference.

enter image description here

  • Can my home network be compromised? How does that happen? Does a virus on a connected device break into the router and make changes?

  • How can something like this happen across all platforms on all devices in the same way? I wouldn't imagine every device / platform on the network would get the same virus.

  • Should I assume that my network's security is totally compromised?

Update: All mobile devices and laptops on my home network are experiencing the same alert when attempting to connect to google.com.

Note: Keep in mind this isn't about the solution to the problem. I'll call a networking professional to handle that. I'm more interested in the origin, source, and method. I'd like to understand the issue in a way that might allow me to prevent it in the future.

20
  • 2
    What are your router's DNS settings set to?
    – Mike Koch
    May 28, 2014 at 2:05
  • 5
    Pretty obvious injection. I agree that the dns servers are probably pointing to compromised or malicious servers, or your isp is trying to be 'helpful'. Use opendns (208.67.222.222 and 208.67.220.220} or google dns (8.8.8.8 and 8.8.4.4) by assigning these manually in your router's setup or assign them to one devicd and test to see if the problem goes away. May 28, 2014 at 2:11
  • @MikeKoch this is my parents' house, and they wouldn't know what the login information is for me to get into the router. Best I can figure is that I should call a network expert over in the morning. Sad thing is, I worked for a computer repair and malware removal company for the past year, and I've never seen this.
    – user317572
    May 28, 2014 at 2:14
  • What if you just reset the router? There's nice button the back that is meant for this. You can also try going to routerpasswords.com to see if the PW is still set to the default password.
    – Mike Koch
    May 28, 2014 at 2:16
  • @MikeKoch well rsetting the router will cause it to lose all its settings, and if it's DSL you'll lose the username password. Probably not a great idea. May 28, 2014 at 2:18

2 Answers 2

6
+50

Symptoms

On all devices using my home network, I'm being shown http://www.google.com WARNING! Internet Explorer is currently out of date. Please update to continue. or similar (depending on the browser) when I attempt to connect to google.com.

That’s a pretty typical ad, possibly an attempt to get you to install malware.

I wouldn't be surprised by this at all if it were just the laptop. It's the fact that this is happening on all devices on my network that confuses me.

Can my home network be compromised?

Absolutely.

Technical Explanation

How does that happen? Does a virus on a connected device break into the router and make changes?

Router Vulnerabilities

Check whether the router has a password and whether it is set to be configurable wirelessly and/or from the WAN side (outside the LAN). Most routers come with either a default password (which can easily be looked up) or no password at all. Worse, some routers come preset so that they can be configured wirelessly and/or from the WAN. This makes it easy for a simple network probe scan to find vulnerable routers.

Pseudo-code Attack Example

For example, pseudo-code might include:

for (IP=0.0.0.0 to 255.255.255.255) do { //scan through all possible IPs
  if (canConnect(IP)) {                  //test for connection
    if (login(IP, "admin", "")) {        //try logging in as admin with blank password
      doBadThings();                     //hack router
    }
    else {                               //router has a password, try defaults
      foreach (knownpasswords) {         //try each known password
        if (login(IP, "admin", pass) {   //try logging in with a default password
          doBadThings();                 //hack router
        }
      }
    }
  }
}

Of course real code would be somewhat different (instead of testing for a blank password separately, it would simply be the first password in the known password database, the database would include default login names as well as passwords since they won’t always be admin, the IP range will likely differ, there will be optimizations, and so on), but that’s the general gist.

Router Compromization

Once the malware finds a router that it can log into, it can “pwn” the router, and by extension, the whole LAN and the devices attached to it.

DNS Spoofing and Cache Poisoning

All mobile devices and laptops on my home network are experiencing the same alert when attempting to connect to google.com. How can something like this happen across all platforms on all devices in the same way? I wouldn't imagine every device / platform on the network would get the same virus.

In your case, what’s likely happened is a simple DNS redirection attack whereby the DNS servers on the router were set to a compromised/infected DNS server.

When you visit a webpage, the computer contacts a DNS server to look up the site’s IP address. With DNS spoofing, the compromised DNS server returns a false IP address to either some other website (likely hosting malware), or a phishing site which looks like the real site (again likely hosting malware), or it redirects to the real site after doing some other bad thing (logging your information, attempting to install drive-by malware, stealing passwords/cookies/etc., and so on).

Diagnostic and Repair Precautions

Should I assume that my network's security is totally compromised?

More than likely. In a case like this, it is best to disconnect all devices from the network until the problem can be resolved. It is not safe to even connect to a compromised network even if you don’t log into any sites. Simply connecting will expose the network password at a minimum, and visiting web sites even without logging in could expose things like cookies or at least metadata like the sites visited along with timestamps and such. A safe, dummy system with no sensitive data should be used to diagnose and fix the compromised router.

Prevention and Network Hardening

Keep in mind this isn't about the solution to the problem. I'll call a networking professional to handle that. I'm more interested in the origin, source, and method. I'd like to understand the issue in a way that might allow me to prevent it in the future.

To prevent this, you must always set a good password on your routers and even better, set them to only be configurable via a direct, wired connection (most people don’t need to modify their router settings from outside or often enough to make it too inconvenient to use a cable when a change is needed. These simple steps will drastically improve your LAN security.

DNS Server Settings

Pretty obvious injection. I agree that the dns servers are probably pointing to compromised or malicious servers, or your isp is trying to be 'helpful'. Use opendns (208.67.222.222 and 208.67.220.220} or google dns (8.8.8.8 and 8.8.4.4) by assigning these manually in your router's setup or assign them to one devicd and test to see if the problem goes away. – Ryan Griggs @RyanGriggs I've never needed to get into my router settings, and I don't quite understand your explanation. I tried going to those IPs to get in, but got nothing so that must not be what you meant. I then tried routerpasswords.com but this router has absolutely no branding, name, or anything on it.

Actually, you did have a need to access your router settings. Simply adding a password and setting it to not be accessible from the Internet (and while you’re at it, also setting it to discard WAN-side pings to hide your LAN altogether), would harden the system immensely.

You wouldn’t visit the IPs that Ryan mentioned, instead you would set the DNS servers in your router to OpenDNS’ name servers (or Google’s or your ISP’s). That way, you ensure proper DNS resolution from a trusted name server (make sure to also clear the DNS cache on your devices to avoid continuing to use any poisoned DNS entries).

Router Identification

@bkr it's literally anonymous. Not a stitch of branding, not even on the back label.

There should still be some sort of identifying mark. At the very least, like all electronics, it should have an FCC identification number which can be looked up.

Also, as Ryan said, you can find the router’s IP address by using ipconfig, then visit that IP address in a web-browser. Even if you don’t know the login details for the router, its web-interface should have some sort of identifying mark which you can then look up.

Hmm…

@bkr it's a local company. They connected to the router remotely, possibly through a computer here.

If it is the ISP’s router or if it is a modem/router combination (often advertised as an “enhance home-WiFi-gateway”), then they may have access to configure it remotely. In that case, you should definitely make sure to tell them that their system was compromised and that it is not secure. Demand that they secure them better, allow you to configure the router, or at least offer you a basic modem-only device so that you can get and use your own superior and more secure router. (You may even be able to get a bit of credit as an apology for their sloppy insecurity affecting your systems.)

If it is not the ISP’s router, then presumably there was nothing wrong with your router and the problem was indeed with their DNS servers (compromised at the ISP) since the only other explanation is that the ISP hacked into your own personal router and reset it. I’m not sure which is more concerning…

2
  • Best answer I've gotten on Stack Exchange yet, after hundreds of questions. Thanks
    – user317572
    May 30, 2014 at 5:44
  • I've seen in the wild someone maliciously reconfiguring the DNS servers at a router (either at the WAN setting, or a the DHCP server setting).
    – LatinSuD
    Jun 4, 2014 at 12:17
0

The problem is clearly a virus infection, and can be at the level of your router or that of the ISP. The later is unlikely, since it would have been signaled and fixed very quickly. So it's likely that it's your router that is infected.

All the answers have supposed a virus infection of the PC that has in turn infected the router. However, there is also the possibility that the router was directly infected from the Internet. If that's the case, it could be re-infected again at any time, unless action is taken now.

For example see this article : Bizarre attack infects Linksys routers with self-replicating malware.

I would suggest these actions :

  1. Do a factory reset of the router. If the infection disappears then the source of the problem is proven.
  2. Search for the latest firmware update to the router
  3. Change the default password
  4. If the router has a Web-administration option, ensure it is turned off
  5. Do full anti-virus scans of the PC with several known security products, and especially Malwarebytes Anti-Malware.

(If you gave the make of your router, I can be more specific.)

You must log in to answer this question.