2

Today, when I tried to access the internet (google on HTTPS), my browser (Google Chrome) gave me the following error:

Chrome error

I am on my own home Wi-Fi, which has WEP. When I tried to reload google on regular HTTP, I got redirected to

http://ezp-prod1.hul.harvard.edu/search?q=<search term>&...

which gave me a 404 error. Sites other than google seemed to work fine.

I assumed this was a MITM attack and so I changed the WEP key on my router and rebooted it. However, minutes later, the error page and attack was back.

My questions are:

  1. How is the attacker still able to connect to my wi-fi, even after I changed my router's WEP key? I don't think it's possible to crack a WEP key in minutes, despite WEP's insecurities.
  2. How is the MITM attack being made? Specifically, how can the attacker insert themselves between my computer and internet servers?
  3. How can I prevent this from happening, now and in the future?
  4. I am still under this attack, now using tor. Can the attacker still read data sent over SSL through tor?
Improve this question
9
  • Do you or anyone who uses your computer have any affiliation with Harvard? From what I can tell, that URL is associated with the Harvard library proxy (which affiliates use to access online resources for which Harvard has a subscription), which I'd expect to be not an attack, but a misconfigured browser proxy setting or extension.
    – cpast
    Commented Jan 19, 2015 at 0:48
  • No one who uses my computer is affiliated with Harvard, and I have double checked my browser and system proxy settings (no proxy is being used). Furthermore, when I changed my WEP key, the error page (for google on SSL) did not show up anymore for a few minutes, after which it started showing up again.
    – DankMemes
    Commented Jan 19, 2015 at 0:53
  • 1
    Also, it's possible to crack WEP in seconds. If it takes a few minutes for an attacker to crack it, that's abnormally long.
    – cpast
    Commented Jan 19, 2015 at 0:54
  • I'm not sure where you're getting that information, but according to ars technica, even the fastest crack takes a few minutes: arstechnica.com/gadgets/2007/04/…
    – DankMemes
    Commented Jan 19, 2015 at 0:58
  • 2
    I think you know the answer to no.3 . Do NOT use WEP. Why are you using WEP?
    – Ulkoma
    Commented Jan 19, 2015 at 1:03

2 Answers 2

Reset to default
3

If you are using a windows PC, run:

ipconfig /all | more

Which DNS servers come up? Your ISP's, Google, OpenDNS, or some unknown/unexpected IP?

If unexpected DNS IP, that's probably the answer. Either your router has been hacked and is serving a bad DNS IP over DHCP (for a DNS server that is redirecting you to the wrong place), or your PC has been reconfigured (by malware) for the same...

Improve this answer
2
  • ipconfig shows my router as the DNS server. I manually switched over to google's servers (8.8.8.8; 8.8.4.4) and verified that it was changed with ipconfig, yet the problem still persists. ping google.com returns an IP that points to a subdomain of my ISP instead of an IP associated with google, and sending an http request to "google" returns a 301 to the harvard page
    – DankMemes
    Commented Jan 19, 2015 at 20:27
  • Log in to your router's admin web interface and check which upstream DNS servers the router is using. Even if your PC is set to Google DNS, some routers fiddle with DNS traffic so you may want to make sure the router itself is also using Google DNS.
    – KristoferA
    Commented Jan 20, 2015 at 1:37
1

If you accept fake ssl cert then yes he can read everything you are sending over https. Using tor is no better than using you normal internet browser. I would check the dns settings on your computer and router. I have managed to crack wep in less than 5 minutes. Changing the password will not provide you with anymore security all it will do is kick him off the network for 5 or so minutes. He can use a tool called arpspoof to reroute traffic through his computer this allows him to modify data being sent back and forth from the internet. In order to stop the attacker if there is one you need to get another router that supports more than WEP.

Improve this answer
1
  • To help determine if you connection is being hijacked could you run tracert 8.8.8.8 in command prompt and post back with the results. This will help determine if the attacker is on your network or if he has altered your dns settings on your equipment.
    – Tim Jonas
    Commented Jan 20, 2015 at 7:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .