Timeline for Bank website forwards to false site - formatted hard drive - still forwards
Current License: CC BY-SA 3.0
6 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 6, 2016 at 17:46 | comment | added | user102753 | He said that only his device is affected with this problem, if the modem is compromised then all devices connected to his gateway should be redirected to the fake website, isn't it? | |
| Apr 6, 2016 at 17:39 | comment | added | Jeff Meden | @Cricco95 To expand on that the ARP cache only holds IP/mac relationships, so you would need to compare the mac it shows for the gateway, with the mac on your router. Also it could be a purely DNS mitm via a compromise in the router, which wouldn't cause anything strange to show up in ARP table. | |
| Apr 6, 2016 at 17:15 | comment | added | user102753 | Yes, you can use Jeff solution too. I'm pretty sure it is a DNS problem. Also you can check your ARP cache and see if the gateway IP it's the real one (es. 192.168.1.1) or it is strange. If it's not the real one there is a MITM attack in progress | |
| Apr 6, 2016 at 17:11 | comment | added | Jeff Meden | To tell if its a DNS issue, from the affected computer try to ping the basic hostname (first part of URL) for your bank, see what IP comes back. Then check that IPs ownership on a site like arin.net, if its not owned by your bank or by a reputable CDN provider, boom you know you have a DNS mitm. | |
| Apr 6, 2016 at 17:08 | comment | added | multithr3at3d | You're better off pinging from your own machine to see if there are additional hops on you LAN I.e. a MitM. | |
| Apr 6, 2016 at 17:03 | history | answered | user102753 | CC BY-SA 3.0 |