4

At the office I noticed malware symptoms on one of the computers. I tried cleaning it and found nothing. Then I noticed I got the same behavior on my phone and the other computer: occasional links would redirect to malware download pages.

I changed my phone to cellular data and the behavior went away. I figured it must be the router or cable modem. I power cycled them and checked for a proxy or any other strange settings. I didn't see any, and it worked normally for a while, only to return again later.

What am I missing? Where else could the malware be coming from?

4

Check DNS settings on the router, modem and other devices. Also consider a factory reset, rather than just a reboot - the reset will completely clear all settings.

If you are using default (ISP-assigned) DNS servers, consider changing them to an alternative, such as Google's 8.8.8.8 - if you observe this behaviour stopping, consider checking with other users of this ISP, or reporting the issue to them. It's possible (though unlikely) that your ISP was compromised. There's also the possibility that malware on your computer itself was designed to attempt common passwords on consumer routers and make this change, though that is unlikely.

Another potential attack vector is a vulnerability in the router software itself. Unfortunately, it's not easy to detect such an attack - probably the simplest thing to do is look up the model number and see if there are any known vulnerabilities. If any exist, then you should either update the firmware (if possible) or replace it with a different device.

8
  • The router password is non-default and relatively complex. DNS and factory reset are good ideas. I'll try that. It is the same ISP I use at home, and I dont see the behavior at home. – Jim McKeeth Dec 20 '14 at 16:23
  • 1
    If you’re positive the password wasn’t compromised, the router might well have at least one security hole. – Daniel B Dec 20 '14 at 16:26
  • 2
    @JimMcKeeth If you save the password, or even just type it while malware is active, that's a possibility. Some routers also have vulnerabilities allowing their web configuration utilities to be accessed by remote hosts without a password - you can check if your model has a known vuln. These are all somewhat unlikely, but certainly possible. – Bob Dec 20 '14 at 16:27
  • Just found this, which seems like a candidate arstechnica.com/security/2014/12/… – Jim McKeeth Dec 20 '14 at 16:46
  • From the cite: "Check Point has uncovered no evidence the vulnerability has been actively exploited..." Seems highly unlikely, and far more likely that the infection (if it is one) spread by open shares or other inadequate security between devices. Also, was Java recently updated? Check to see if the Ask toolbar was installed with a Java update. I have the sad feeling that your office computers have no security software installed, so you could have been hacked in a thousand ways (with the router being by far the least likely.) – Debra Dec 21 '14 at 16:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.