0

I have a fixed line broadband connection at home. This morning when I tried accessing Google or Facebook through my browser (Google Chrome) I got a webpage asking me to update my flash player. I found this to be a little suspicious since I had accessed Facebook just a little while earlier from the same machine on a different network. My suspicions were confirmed when the similar thing happened when I tried to connect through a different system and my mobile.

When I tried to ping Facebook or Google, the packets are sent to an IP based in Seattle (108.62.62.234). When I tried to trace the route of the packets, I found a shocking thing that the packets were being sent first to my ISP and then were being sent to that IP.

Is someone tampering my connection? What is happening? What needs to be done in future?

Improve this question
4
  • 2
    "When I tried to trace the route of the packets,I found a shocking thing that the packets were being sent first to my ISP and then were being bifurcated to that IP" - the entire point of an ISP is to start the routing of traffic to it's intended destination. It's totally normal to have your ISP as the second or third hop in a trace route.
    – DKNUCKLES
    Commented Jul 22, 2014 at 18:48
  • If you don't trust your ISP, use HTTPS. If they're trying to be a man-in-the-middle, this will prevent it or allow easy detection (because your browser will complain that the certificate's not valid because it's issued to another address or not signed by a trusted CA). FWIW, the fact that your packets are going through your ISP is completely expected (they route the connection through their servers), and the end IPs not being where/who you might expect them to be is normal (e.g. Akamai).
    – Tim S.
    Commented Jul 22, 2014 at 20:18
  • What about that IP I mentioned?What about it?Is it a malicious machine?
    – user1369975
    Commented Jul 22, 2014 at 20:21
  • Unfortunately yes: a basic whois investigation will show you this is a web server hosted by Ubiquity Hosting Phoenix, AZ, USA.
    – athena
    Commented Jul 22, 2014 at 21:47

2 Answers 2

Reset to default
3

It sounds to me as though your router might have it's DNS server setting compromised with malicious servers. The reason you might be getting sent to the malicious IP address when you ping facebook.com is because that lookup is being referenced to either a rogue DNS server that serves bogus requests, or you have a hosts file that's been overwritten.

I would try manually changing the DNS servers on one of the devices within your network to simply use 8.8.8.8. Try pinging again and see if you get the same address.

You might also use an nslookup to see what DNS server you currently have responding to the request.

> nslookup
> facebook.com
Improve this answer
6
  • ,can there be a question of someone in the ISP involved in this?
    – user1369975
    Commented Jul 22, 2014 at 19:21
  • 2
    @user1369975 why are you convinced the ISP has to be involved? If an ISP is going to modify your traffic, they're going to do it in a way that is much less obvious than transforming common websites to try to trick you into installing a virus. Malicious modification of clients traffic doesn't make for good business.
    – DKNUCKLES
    Commented Jul 22, 2014 at 19:30
  • Sounds like you are right.The ISP might not be involved.My DNS might have been compromised,because the nslookup is revealing the IP addresses of various sites to be that same IP.So what needs to be done to correct this?
    – user1369975
    Commented Jul 22, 2014 at 19:41
  • 1
    You need to determine where you're getting your DNS server settings from - likely the DHCP server which is most likely on the router. Log into your router, go to the DHCP settings and change the DNS servers that are being distributed to your clients. It would also behoove you to change your password, remove remote administration ability, etc.
    – DKNUCKLES
    Commented Jul 22, 2014 at 19:44
  • DKNUCKLES,if I directly access sites with their IP addresses,there should not be any risk incolved?
    – user1369975
    Commented Jul 22, 2014 at 20:22
2

I have no idea who you are and thus why I should or should not trust you. It is my habit, though, of not trusting people "over the Internet"; I use the Internet to exchange information and there is no notion of trusting people for that (there is such a notion of cross-validating information, though).

"ISP" means Internet Service Provider. It is perfectly normal that packets that you send to "the Internet" go through your ISP because that is exactly what you pay them for: to provide you some connectivity with the rest of the world. Maybe you previously imagined that IP packets magically teleported across the planet from your computer to some distant server; learn today that it is not true. Packets travel over links: radio, wire, optic fibre... the mediums are varied, but the concept is the same: an IP packet hops from node to node, starting with your computer, final node being the destination server. The link which goes from your computer to the next node is, exactly, the one rented to your by your ISP, and the next node is the one maintained by the ISP.

If you don't want your ISP to do their job, you can switch to another ISP. Or you can elect to dispense with any ISP altogether, but it may have adverse effects on your bandwidth (meaning: when there is no Internet, well, there is no Internet).

Improve this answer
5
  • ,the trust thing was because I had to place several downvotes in my previous questions.So that is why the community trust thing was quoted.
    – user1369975
    Commented Jul 22, 2014 at 19:20
  • 1
    You don't get downvoted when you are not trusted; you get downvoted when your questions or answers are poorly written, off-topic, or just plain wrong.
    – Tom Leek
    Commented Jul 22, 2014 at 19:24
  • well I read on an answer in meta website that the no of votes you receive is a sign of how much the community trusts you.
    – user1369975
    Commented Jul 22, 2014 at 19:30
  • ,any suggestions you would like to offer since it looks like an attack on my DNS?
    – user1369975
    Commented Jul 22, 2014 at 19:47
  • Your problem doesn't look like an attack on the DNS, but rather like a tampering on your router you left the admin account open with the default password. As a consequence, the DNS server your router is providing you was changed so as to turn all your network accesses toward Ubiquity Hosting, Phoenix, AZ, USA on a booby trapped web server.
    – athena
    Commented Jul 22, 2014 at 21:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .