4

All my computers in the house will not connect to Amazon.com, but some unsecure (http) Amazon login page. This is the second time I'm having this issue. The first time I resolved it by changing my DNS servers to Goggle's DNS (8.8.8.8 and 8.8.4.4). I checked them tonight and a random one was first, while 8.8.8.8 was second. I reset them to Googles yet I still get this bogus login page. Every link I hit just refreshes the same page (like the Privacy Policy, Help, etc...)

My router is an Asus RT-N66R with the latest firmware. If I use the network tools to ping amazon.com, all packets are lost. If I use my laptop, I get responses from www.amazon.com, but not amazon.com

I used F-Secure's router checker and it shows everything as ok - both when I use Google's DNS and when I set to auto and use my ISP (Comcast). I'm at my wit's end as to WTF is going on. Please help me!

[EDIT] Used Google's DNS servers and reset the router -all is well now but I would still love to know what the heck has been going on.

  • You should re-edit your question to reflect the current problem rather than ask one question and say never mind but here's another question. – Neil Smithline Nov 22 '15 at 2:11
  • 3
    @NeilSmithline actually, no. What OP did is perfectly fine. The information in the original problem can definitely be helpful to explaining the situation and solving the issue. It's actually more problematic if they completely re-edit the question. – d0nut Nov 22 '15 at 2:53
4

Based on your details something is messing with the DNS settings and since it affects the whole network it is probably the router. Also the fact that the first DNS address in the router was something you did not set indicates an attack against the router.

I used F-Secure's router checker and it shows everything as ok

I have no idea what the router check really does, but from a short look I would suggest that it looks up various random hosts inside the ismydnshijacked.com domain. The DNS server will probably check where these lookups come from. But if this is really all then an attacker could setup its own DNS server (and set your router to use it) which then resolves these domains using the public DNS servers of google. In this case everything will look fine because the DNS lookup came from a trusted DNS server.

Insofar I'm sure that this router checker could easily be tricked into believing that everything is fine and attackers are known to make sure that their attacks will not be detected by known security solutions.

[EDIT] Used Google's DNS servers and reset the router -all is well now but I would still love to know what the heck has been going on.

Again this indicates an attack against your router. Based on your description the router is Asus RT-N66R which just based from a google search has a bad history which contains several possible exploits. It looks like there were fixes done in 06/2015 to reduce the attack surface ("Enhanced the login authentication strength and fixed CSRF related issues.") but there is a firmware from 2015/11/06 which again makes fixes at these area ("Modified brute-force protection mechanism in router login page." and several buffer overflows fixed).

Thus I would suggest that your router is either not on the latest firmware since this was only released 2 weeks ago or that the device is still vulnerable even after the latest fixes. Given the problems the vendor had in the past this would not be that unexpected.

  • Thanks - when I ran the check firmware on the router it reported it was the latest, but I was in fact, one version behind. I just used your link and manually updated the router to the latest version. – merlot Nov 22 '15 at 13:37
0

A few things worth considering:

  1. Change your router's administrative password to something random. Ideally, do this from a separate computer/smartphone if possible. Don't log on the router from any of your compromised computers and do not save the password
  2. Configure your router so that remote management is not enabled
  3. Make sure TR-069 is not enabled

Wait and see if this happens again.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.