Return to Answer

Yes, your router's primary DNS entry was pointed to a rogue server to redirect you to phishing sites. The router possibly got compromised through an unpatched vulnerability in its firmware.

Although Asus doesn't publish bug details, attackers might have independently discovered some of the critical vulnerabilities patched in that release. Diffing firmware releases to reverse-engineer what parts were patched is usually quite straightforward, even without access to the original source.

Also, this looks like it's part of a more wide-spread recent attack. This tweet from three days ago seems to describe a very similar incident to what you experienced:

The fact that you got certificate warnings makes it less likely that an attacker managed to get into your machine. Otherwise, they could have messed with your local certificate store or browser internals and wouldn't need to conduct a blatant DNS spoof.

The idea here is to trick you into visiting a prepared website that makes you conduct the attack yourself by issuing a specially crafted cross-origin request to the router interface. This can happen without you noticing and wouldn't require your interface to be remote accessible.

Yes, your router's primary DNS entry was pointed to a rogue DNS server to make devices in your network resolve apple.com and other domains to phishing sites instead. The router possibly got compromised through an unpatched vulnerability in its firmware.

Although Asus doesn't publish bug details, attackers may have independently discovered some of the vulnerabilities patched in that release. Diffing firmware releases to reverse-engineer what parts were patched is usually quite straightforward, even without access to the original source. (This is routinely done with Microsoft security updates.) Such "1-day exploits" are comparatively cheap to develop.

Also, this looks like it's part of a more wide-spread recent attack. This tweet from three days ago seems to describe an incident very similar to what you experienced:

The fact that you got certificate warnings makes it less likely that an attacker managed to get into your machine. Otherwise, they could have messed with your local certificate store or browser internals and wouldn't need to conduct a blatant DNS change.

The idea here is to trick you into visiting a prepared website that makes you conduct the attack yourself by issuing a specially crafted cross-origin request to the router interface. This could happen without you noticing and wouldn't require the interface to be remote accessible.

Although Asus doesn't publish bug details, attackers might have independently discovered some of the critical vulnerabilities patched in that release. Diffing different firmware releases to reverse-engineer what parts were patched is usually quite straightforward, even without access to the original source.

Also, this might be part of a more wide-spread recent attack. This tweet from three days ago seems to describe a very similar attack as you experienced:

@harlanbarnes on Twitter (2018-03-09)

[...] my browser warned me (Google Chrome) saying this website was not secure. [...] I began to suspect maybe my Mac machine had been infected

Since any website can issue a cross-domain request to any other website, the attack idea here is to trick you into visiting a prepared website that makes you conduct the attack yourself by issuing a specially crafted request to the router interface (essentially a CSRF attack on the intranet). This can be done by a background script without you noticing and wouldn't require your interface to be remote accessible.

It's hard to tell what exact path the attackers took to compromise your router. However, it's plausible that they leveraged vulnerabilities in your outdated release.

Yes, your router's primary DNS entry was pointed to a rogue server to redirect you to phishing sites. The router possibly got compromised through an unpatched vulnerability in its firmware.

Although Asus doesn't publish bug details, attackers might have independently discovered some of the critical vulnerabilities patched in that release. Diffing firmware releases to reverse-engineer what parts were patched is usually quite straightforward, even without access to the original source.

Also, this looks like it's part of a more wide-spread recent attack. This tweet from three days ago seems to describe a very similar incident to what you experienced:

(@harlanbarnes on Twitter, 2018-03-09)

[...] my browser warned me (Google Chrome) saying this website was not secure. [...] I began to suspect maybe my Mac machine had been infected [...]

The idea here is to trick you into visiting a prepared website that makes you conduct the attack yourself by issuing a specially crafted cross-origin request to the router interface. This can happen without you noticing and wouldn't require your interface to be remote accessible.

Ultimately, the given information doesn't reveal the exact attack path. But it's plausible that they leveraged vulnerabilities in your outdated firmware release. As an end user you should at least update your firmware as soon as possible, do factory resets if necessary, and keep your router interface password-protected even if it's only accessible from the intranet.

The latest release 3.0.0.4.382.50010 (2018-01-25) comes with lots of security fixes, including unspecified RCE vulnerabilities.

Although the bug details don't seem to be public, attackers might have independently discovered or reverse-engineered some of the critical vulnerabilities patched in that release. Diffing different firmware releases to find out what parts were patched is usually quite straightforward, even without access to the original source.

Also, there might be a more recent attack going on. This tweet from three days ago seems to describe a very similar attack as you experienced:

The fact that you got certificate warnings is an indication that the attackers did not get into your machine. Otherwise they could have messed with your local certificate store or browser internals and wouldn't need to opt for a blatant DNS spoof.

Even if your router interface isn't visible from outside your network, it can be vulnerable to a range of attacks. As an example, take this Netgear router arbitrary code execution exploit from a while ago which had Netgear routers execute arbitrary commands sent in the URL.

Since any website can issue a cross-domain request to any other website, the attack idea here is to trick you into visiting a prepared website that makes you conduct the attack yourself by issuing a specially crafted request to the router interface (essentially a CSRF attack on the intranet). This can be done by a background script on an untrusted website without you noticing and wouldn't require your interface to be remote accessible.

Your release is over half a year old. The latest release 3.0.0.4.382.50010 (2018-01-25) comes with lots of security fixes, including RCE vulnerabilities which may have been exploited here.

Although Asus doesn't publish bug details, attackers might have independently discovered some of the critical vulnerabilities patched in that release. Diffing different firmware releases to reverse-engineer what parts were patched is usually quite straightforward, even without access to the original source.

Also, this might be part of a more wide-spread recent attack. This tweet from three days ago seems to describe a very similar attack as you experienced:

The fact that you got certificate warnings makes it less likely that an attacker managed to get into your machine. Otherwise, they could have messed with your local certificate store or browser internals and wouldn't need to conduct a blatant DNS spoof.

Even if your router interface isn't visible from outside your network, it can be vulnerable to a range of attacks. As an example, take this Netgear router arbitrary code execution exploit from a while ago which had Netgear routers execute arbitrary commands sent as part of the URL.

Since any website can issue a cross-domain request to any other website, the attack idea here is to trick you into visiting a prepared website that makes you conduct the attack yourself by issuing a specially crafted request to the router interface (essentially a CSRF attack on the intranet). This can be done by a background script without you noticing and wouldn't require your interface to be remote accessible.

It's hard to tell what exact path the attackers took to compromise your router. However, it's plausible that they leveraged vulnerabilities in your outdated release.