Can a NETWORK Be Infected?

[ArtShapiro]

I think this is a strange one. I have a dual boot 7 / 8.1 desktop machine, two dual-boot Thinkpad laptops, and two single-boot Thinkpads. Everything is 7 or 8.1. I'll leave my Windows Home Server box out of the equation.

For the last couple days, I've been getting large full-screen popups on all these machines with amazing regularity. Whenever I click on my insurance company's Logon link (Farmers), a popup for "GetMyInsurance.com" opens up. When I click on most (not all) links on the local newspaper site, a talking popup for some sort of update appeared. When I clicked on the Anandtech Forums to post this, up came a large popup for something. Some of them can only be cleared with task manager.

Trend "House Call", Eset, SuperAntiSpyware, Malware Bytes, Symantec Endpont Protection, and ADWCleaner have all come up clean other than a sporadic tracking cookie.

The system is a cable modem (Cox ISP) connected to a Cisco E3000 wireless router. The desktop is hard-wired; the others are wireless. Temporarily using a wired connection didn't affect the problem.

I took out the router, and tried connecting two of the machines, in turn, directly to the wired cable modem connection. It was awkward - took multiple resets of the router and disabling/enabling the laptop's Nics to get internet connectivity. In brief testing the problem Did Not occur.

I just took a laptop over to a nearby Starbucks and connected. The problem Did Not occur. Came back here and it once again gave the popups from Farmers and the local newspaper.

Has anyone ever heard of a bleedin' ROUTER being infected??? It's starting to really look like that. I reset the router once without affecting anything.

None of the machines show a spurious proxy server being injected.

Any pontification out there would be welcome. I can get another wireless router in a few days; I loaned my old Belkin to a friend and it hasn't ever been connected.

As I said, this is a strange one.

Art

This seems to have been resolved but I am moving it out of Computer Help so that someone else might benefit from it in the future.
admin allisolm

 

[imagoon]

Check to see what DHCP is handing out. I have seen routers that get "infected" via a web exploit and the settings get changes to redirect everything on the router to infected DNS / proxies etc.

Specifically the webpage runs scripts that makes your computer reach out to the common router IP's and try to change network settings, passwords etc.

--edit--

http://www.pcworld.com/article/2098...rability-targeted-by-linksys-router-worm.html

 

[ArtShapiro]

Check to see what DHCP is handing out.>

Can you elaborate a little? IPCONFIG shows an expected address (192.168.2.50; my router is on the 192.168.2.xxx subnet). The default gateway is 192.168.2.1. Connection settings look normal - assign automatically. Art

 

[ArtShapiro]

Check to see what DHCP is handing out.

Followup: I just logged onto the router for the first time in ages. There are two "static DNS" entries that are "strange": 162.243.207.106 and 107.170.189.30. I cleared them, and it appears (checking the desktop and two of the laptops) that the problem has gone away.

I don't pretend to be a networking heavy, but this sure wasn't expected.

Art

 

[gbeirn]

Yeah it is pretty rare but I have seen maybe 2 or 3 cases where some malicious software charged the DNS in a router to redirect web searches. Make sure to change the password on the router, these things only work when they try the default username/password..

 

[ArtShapiro]

Yeah it is pretty rare but I have seen maybe 2 or 3 cases where some malicious software charged the DNS

It just happened again on this desktop machine, but in fairness I hadn't rebooted. I've just done so. The router isn't showing any spurious entries. It has a non-default password.

Thanks for the guidance. I'm uneasily optimistic.

Art

 

[imagoon]

Patch your routers firmware.

 

[ArtShapiro]

Patch your routers firmware.

Don't think Cisco has released anything in quite a while; they seem to drop any attention to a model after a subsequent model (in my E3000 case the E3200) is released.

I've been pounding on the laptops for the last hour without anything exciting happening.

 

[inachu]

I will use those ip addresses on my network so I can mess with those jerks messing with peoples pc.

vmware is awsome!

 

[serpretetsky]

I will use those ip addresses on my network so I can mess with those jerks messing with peoples pc.

vmware is awsome!

could you elaborate? How are you going to use those ip addresses on your network and in what way will that screw with the jerks?

 

[azazel1024]

Yup, likely they used an exploit to change the DNS entries.

At a minimum I'd reload the latest firmware even if it is exactly the same firmware. Doesn't mean that they didn't remotely flash firmware that is malignant instead of simply changing the DNS entries.

This is in small part why I use google and openDNS IP addresses for static DNS. Makes it easier to quickly tell if someone exploited my router and changed the DNS entries just looking at my router status page (as it tells me what the current primary and secondary DNS entries are. I am not going to remeber the DNS IPs that are for my ISP that my router grabs otherwise). It also cuts down on my ISP deciding to do fun things with their DNS servers (it doesn't stop Google or OpenDNS from doing things though).

 

[azazel1024]

Also I'd go through your router and disable anything not used. ESPECIALLY DISABLE UPnP!!!! There are so many UPnP exploits it is scary. You may by chance close whatever hole someone used to drive-by your router.

Also disable (if it was enabled) WAN remote administration.

 

[ArtShapiro]

Also I'd go through your router and disable anything not used. ESPECIALLY DISABLE UPnP!!!! There are so many UPnP exploits it is scary.

I'm the OP.

I did that when I had the router's configuration screen up - it attracted my attention as something I didn't need.

I don't think this was a drive-by incident; I'm at the end of a small (4 house) cul-de-sac and the signal is getting quite weak by the time one goes out to the actual street. The neighbors are not technical wizards. And I'm secured with a non-default password.

This may have been going on for quite some time. For quite a while, IE and Chrome were getting frequent "update windows drivers" browser windows, while I can only recall that hitting Firefox once. All the malware checks were coming up clean; I didn't focus on the router until the frequency became preposterous and predictable.

The idea of re-flashing the firmware is interesting; right now all the systems have run without incident for the few days since my original posting, so I'm not inclined to rock the boat with an action that can potentially brick the device if one is unlucky.

Art

 

[azazel1024]

Drive-by, as in drive-by hack. Mean that someone was attempting a mass exploit, as opposed to specifically targeting your router/network to be hacked. Not war driving where they pulled up on the curb and tried to hack your wifi, they came over the WAN, almost deffinitely.

Flashing the default firmware is very unlikely to brick it. I've never personally experienced a bricked network device due to a firmware flash in the hundreds of times I have. I've bricked one motherboard due to a bad BIOS, but it was the BIOS itself, not the flashing process (MB manufacturer pulled back the BIOS version a couple of weeks later). If it is the latest firmware and has been around for a couple of months, odds are excellent it won't brick (like less than .1% it will, if not less).

 

[JackMDS]

You can Flash the E3000 with Tomato Shibi K-26

http://tomato.groov.pl/?page_id=164

Will work better and will be less vulnerable than the Linksys/Belkin firmware.

 

[ArtShapiro]

You can Flash the E3000 with Tomato Shibi

OK, I've heard of it but don't have any technical familiarity with it.

The page that includes my E3000 has a zillion different download links.

Is there any sort of learning curve, or do I merely need to assign an administrative password and configure the SSID and WPA passphrase?

Can you give the twenty-five-words-or-less summary of its benefits?

Art

 

[EvaCarey]

Yes, a router can be infected, but like noknojon I've never seen it. So, it is possible, but not probable. The lack of Internet is most likely caused by your ISP. Reset your modem. Some ISPs, Comcast is one, only give you one IP address and the modem "remembers" what device was first connected to it and it will not work with another device until it is reset. Changing the Admin password on the router is a basic security step you can take to protect your router.

 

[EvaCarey]

It is not easy to that network will be infected, before few days a read an article based on networking there I read that it is not an easy task to infect Wi Fi or Wi Fi will be infected because Wi Fi access is least protected by encryption and passwords.

 

[azazel1024]

Except that many people still use unencrypted Wifi, or maybe worse, WEP.

A lot of routers these days come with WPA2-PSK standard with an actual password, which is a HUGE step up from the years of routers shipping completely unpassword protected and then users either not changing anything, or at least not changing the unencrypted nature of their Wifi.

A downside though is, most router default passwords might be unique (fairly unique), but are often only 8-10 characters and often purely numeric (and DEFFINITELY no symbols) printed on the bottom of the router. Even at 10 trillion possible combinations, that is a matter of an hour for a good GPU to crack. Now if it uses characters as well, that does make it a lot more difficult at 3.65 quadrillion + possible combinations (and worse if caps are mixed in). All supposing 10 characters, that would take months or more to crack.

Now down to 8 characters and numeric, seconds to crack and even with alphas thrown in it only ups it in to the hours range.

At any rate, if you want to infect a router and have some time to dedicate to research, it is not that difficult to infect most consumer routers as basically all of them have some vulnerabilities that can be exploited and often with off the shelf exploits/malware. That doesn't mean it is common to see exploited routers.

 

[billyb0b]

you have a case of DNS poisoning.... i would reflash your router's firmware with the latest build or go to a 3rd party build (i.e. DDWRT, Tomato)