When I visit my bank's website, I get forwarded to a phishing mirror site.
- This has persisted through a re-format of my MacBook.
- Even on different browsers!
- Other computers on the same network do not have this problem, so I don't think it's the router.
- Visiting my bank site through a VPN works fine so it doesn't seem like a virus either.
What could be going on here?
A few weeks ago my bank account was hacked. I had typed in the url to my bank's website and was forwarded to a mirror site without noticing, where I stupidly put in my account details. This was using Chrome on an MackBook Pro. I went to the bank to lodge a fraud claim and they said it must be my computer because nobody else has reported this problem.
I formatted my laptop by following these instructions: http://smallbusiness.chron.com/reformat-macbook-53599.html
I went back to the bank's website and was still forwarded to the mirror site! (Now that I'm looking for it, I can tell because the url is slightly different and not https). So I tried on different browsers, because I remembered that in the past this bank used digital certificates, so maybe there is one saved in my chrome settings somewhere that has been compromised. (I tried anonymous browsing, plus Safari, and even downloaded and tried Epic browser) and still I get forwarded to the false site!
On my brother-in-law's laptop on the same router/LAN, it goes to the proper bank website with no forwarding.
But if I visit the website through a VPN, it doesn't forward me to the false site! What the heck?? Is there a virus on my computer? Surely if it was local, the VPN would make no difference? But if it was at the bank's end, then it wouldn't be happening to just me! I'm confused and worried about my online security now. Can anybody shed any light on what might be going on here?
First thing I did was ping the bank's URL from ping.eu and it returned an address that starts 186... When I copy this IP into my URL bar, it says "the site can't be reached. [IP Address] took too long to respond"
Then I pinged the same URL from "network utility" on my macbook, and it returned a different IP address! When I copied this one into my URL bar, I got a chrome page saying "Security error! Deceptive site ahead".
My dns server is listed as 192.168.0.1 - totally normal right? So it's the router? But my B-I-L's laptop doesn't have the issue? What does this mean?? And what should I do??
After the help you guys gave me on router and dns problems I googled "how to detect mitm attack". I checked the dns settings on the router, and it has the "use these dns servers" box ticked, with two random IP addresses filled in. I unticked the box, went to my bank's website and voila! No phishing site.
So they hacked my router? I didn't even know that was possible, but now that I think about it, it is remotely accessible on the LAN and the username/password is the manufacturer default. Will a hard reset of the router and then changing the username/password be sufficient now?
Another question is, how did they gain access to my router in the first place? Should my BIL also format his laptop in case it was a virus?