8

I'm using the Ubuntu GNOME Linux distribution as my desktop. Recently, it became impossible for me to connect to the Internet with it. When I checked its network settings, I saw that the DNS address was 46.161.40.29.

When I searched this IP address on my other desktop (a Windows 7 machine), I found the article http://anti-hacker-alliance.com/index.php?details=46.161.40.29.

On my Linux machine, I set the DNS nameserver in /etc/resolv.conf to 8.8.8.8 and 8.8.4.4, and was able to access the Internet.

Note that every time I reboot my machine, I'm unable to connect to the Internet, and the DNS file (/etc/resolv.conf) is blank. My wired connection is also not showing in the network manager.

I still see 46.161.40.29 in my wired connection's settings:

Network manager showing DNS set to 46.161.40.29

Is my computer compromised? If so, what can an attacker do?

Note: I'm using the D-Link DSL-2520u home modem, and the firmware version is v1.08. When I checked my DNS settings in the modem interface (192.168.1.1) it was pointing the primary DNS address to 188.42.254.137, and the secondary to 8.8.8.8.

|improve this question
  • 2
    You might want to have a look at /var/lib/dhcp3/dhclient.leases which stores the DHCP data used by your machine. Its possible that your router may be compromised. – symcbean Sep 25 '15 at 15:01
  • "cat /var/lib/dhcp3/dhclient.leases " is not working..I use dlink 2520u, where can i check whether my router is compromised? thnx – Dave Mn Sep 25 '15 at 15:10
  • Note that everytime i reboot my machine, i'm unable to connect to internet and DNS file (/etc/resol.conf) showing black..and also my wired connection is not showing in network manager... – Dave Mn Sep 25 '15 at 15:15
  • 4
    A good rule of thumb is: If the question is 'am I compromised?' then assume you are until you can prove otherwise. – James Snell Sep 25 '15 at 21:21
  • 1
    I dunno about you, but the /etc/resolv.confs on all of my Ubuntu systems say Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8) and DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN at the top. – Blacklight Shining Sep 26 '15 at 5:02
23

Something in your environment has definitely been compromised. It seems more likely that your router has been compromised. You haven't provided much information, so I'm going to make some basic assumptions:

  • You're at home
  • You are behind a commercial router, provided by your ISP
  • You haven't done anything to secure your router
  • Your linux desktop is a DHCP client of the router.

These devices often have default passwords that users never change and critical firmware vulnerabilities that go unpatched. As a DHCP client of the router, your Linux desktop is going to pull DNS information as part of its DHCP request, and so will see the behavior you've described above. Configuring other DNS servers in resolv.conf is only a workaround. I strongly suggest that you try to log in to your router (probably @ 192.168.1.1, based on your screenshot). I bet you won't be able to. You'll probably have to reset it to factory defaults, then log in. You'll want to secure it better - update firmware, change default passwords, and hope that's enough.

For confirmation without logging into your router, check the DNS configuration on your Windows desktop. If it points to the same 46.161.40.29, then it's very likely the router.

|improve this answer
  • Thanks for the answer, now i reset my dlink modem and turned on firewall n set good password :) hop it will never happens in future, Considering am compromised what could attacker do? in worst case scenario.. Note that everytime i reboot my machine, i'm unable to connect to internet and DNS file (/etc/resol.conf) showing EMPTY..and also my wired connection is not showing in network manager :/ every time i have reset my dns name server to 8.8.8.8, So plz let me know how to fix this Thanks again Jesse! – Dave Mn Sep 25 '15 at 16:12
  • 3
    @Dave Mn Sorry to tell, According to article, threatpost.com/… , its likely to come back! Consult with DLink website for a firmware update or ISP(if they provided the device) or altogether dump the device if you see this issue next time. – Nikhil_CV Sep 25 '15 at 17:28
  • @DaveMn a hacker would for example serve you the IP address of their own server (looking like the one of your bank's) when you try to login to your bank's web site. Or use one of your devices to attack other systems anywhere in the world (which may get you into trouble). Or add your devices to their botnet to earn money with e.g. DDoS attacks etc. – Andre Holzner Sep 25 '15 at 18:23
  • Thnx, I'm using "dlink 2520u" home Modem, firmware version is v1.08. When i checked my DNS in Modem interface(192.168.1.1) its pointing primary DNS address to 188.42.254.137, and secondary to 8.8.8.8...ip 188.42.254.137 seems scary when i searched in google :( – Dave Mn Sep 26 '15 at 7:13
  • For what it's worth, there's confirmation of a similar exploit on Netgear routers, see bbc.com/news/technology-34491583 As far as the risk you face, temporary control of your DNS is pretty serious. Worst case scenario, they could redirect you to malware sites or subject you to phishing attacks. If you're a reasonably responsible user and do things like make sure you are using HTTPS before entering any passwords, you'll probably be OK. There's lots of other possible badness, like someone redirecting all your traffic to initiate a DDOS attack. – Jesse K Oct 12 '15 at 20:42
2

Take a look at this resource:
http://thesimplesynthesis.com/post/how-to-set-a-static-ip-and-dns-in-ubuntu-14-04

In summary, you may be updating /etc/resolv.conf but Ubuntu is rewriting it based on other pre-defined settings. You can think of /etc/resolv.conf as the resulting entries that your system derived from the various options.

Check the locations referenced for the head/base/tail/interfaces entries and see if they have been updated (might be good to make note of permissions, ownership and date changed). I expect you will find one or all of them have the unwanted nameserver entries. Update the file and regenerate the resolv.conf file (the steps in the above entry look correct, but would not hurt searching for a Ubuntu KB to verify the correct process for your specific version of Ubuntu).

Last but not least though... the updating of your resolv.conf may have just been one of the changes to your system and other nasty items may be lurking. If it were me... once I had secured my network (as you appear to have been looking at by setting good password on your router, etc.) I would reinstall.

If a reinstall is not something you are up for yet, at the very least change all your passwords (all users and root) on the system. If someone updated resolv.conf they would have already gained root access (unless you have funky permissions only root or users with sudo access should be able to update resolv.conf) and could have easily grabbed your shadow file and have a hash of your passwords.

This could have all also been self-inflicted... think installing something that prompted you for elevated access (sudo) and you thought it was doing xyz, when it was really doing XYZ and you may have done it to yourself (sometimes exploits are not the work of criminal masterminds but rather hacks of opportunity).

Good Luck.

|improve this answer
  • Just reread your notes. Double check your router and modem and see what DNS they are pointing to. Make sure they are not pointing to the wrong source in addition to checking the settings on your system. – User4890 Sep 25 '15 at 18:47
  • Thnx, I'm using "dlink 2520u" home Modem, firmware version is v1.08. When i checked my DNS in Modem interface(192.168.1.1) its pointing primary DNS address to 188.42.254.137, and secondary to 8.8.8.8...ip 188.42.254.137 seems scary when i searched in google :( – Dave Mn Sep 26 '15 at 7:11
1

Fix for DNS hijacking issue on Dlink DSL 2520U. Go to the modem interface. Click on Advance - Remote Management. Under Remote Management settings, tick the Enable Remote Management option. Leave the Remote Admin Port at the default 80. Select the Deny All option for Remote Admin Inbound Filter. The next options Details automatically becomes No one is allowed. Click on on Apply settings and restart the modem. The dns server will never get changed now or hijacked. Before I enabled Remote Management, the dns server would get hijacked and change daily or sometimes within a couple of hours and my internet performance and speed decreased till i changed the dns server manually. The dns server on my modem is now unchanged for a month now since I enabled the Remote Management settings.

|improve this answer
0

I had the exact same problem. I run linux Ubuntu 12.04 / Win Xp (dual OS) on my PC and I have a DSL 2520U modem which I bought here in India. At first everything was fine. After a few weeks I noticed the problem described in this thread. The reason I got suspicious, was due to the slow loading of the web pages that I normally go to and some pages would not load at all. My ISP recomends the automatically acquire DNS servers setting (not the manual setting). What happens is that somebody (either hacker or somebody from the internet changed the firm ware code in the modem) gets into my modem changes it to manual dns setting and puts 2 addresses like 31.3.XX.YY for primary and secondary DNS. I would reset to to automatic and it would change back to manual in 2 hours. It was frustrating.

I called my ISP and they could not understand why. Visited Dlink support and realoaded the firmware (the same firmware, bcos they did not have an update) but problem persisted. Even reformatted my harddisk and reloaded Ubuntu but problem did not go away. Finally felt modem has a firm-ware bug and switched to TP-LINK 8816 wired LAN modem and problem has been SOLVED(atleast for now). I think DLINK 2520u has a security issue which is exploited by some website we accidentally visit.

My suggestion is that all wired lan modems are cheap and you should just switch rather than waste time. I know TP LINK works but you can try Net Gear or even Cisco if they have one at the user level.

|improve this answer
0

That IP is in Russia, and that can't mean anything good. You could try disconnecting your router, and try renewing DHCP leases and see what happens. If it's just your router then it's not too serious.

If you weren't able to get internet access while this DNS address was set, this might mean the server had already been de-activated, so you might be ok.

It would still be best to use a clean computer and network to access and change the passwords for all your online services.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.