This is my first post on here, and the first time I put serious thoughts into network security.

I think I have an serious security issue in my network. It seems like someone somehow injected a backdoor program on my devices and can see the content.

I noticed several strange things on my Android Device - messages getting tagged, emails were marked as read without me opening them on any device, etc. A few weeks ago I also got an message from Google saying "that someone knows my userpassword", and showed me a Location somewhere in the U.S. (maybe a proxy?). But I am not quite sure if that is related.

However my suspicion is that someone used an exploit in the Fritz!Box 7362 SL Fimeware (known since a month or so), which allows an attacker to get access to the local network traffic. Also someone I know could have given the standard network key for the router.

I reset the router (set a new password, made changes in the router setting), encrypted my Android devices, and tried to identify any malware on my PCs (Ubuntu, Windows 10).

So basically my question is: How can I know for sure that something on the network or my devices is manipulated? Several checks of open ports/connections didn't show anything suspicious IMO. But I am pretty sure that someone hacked me, my gut instinct tells me so.

So what you guys thinks about this? Whats the best way to solve this issue?


EDIT nmap gives me this output for my local router address

Discovered open port 80/tcp on 192.***.***.***
Discovered open port 53/tcp on 192.***.***.***
Increasing send delay for 192.***.***.*** from 0 to 5 due to 227 out of      566    dropped probes since last increase.
Discovered open port 8181/tcp on 192.***.***.***
Discovered open port 5060/tcp on 192.***.***.***

with my current extern ip traceroute leads me to the fritz box but without open ports

netstat -tulnp on my Ubuntu machine shows nothing suspicious too, as far as i see...

Proto Recv-Q Send-Q Local Address           Foreign Address             State       PID/Program name
tcp        0      0  *               LISTEN      1617/dnsmasq    
tcp        0      0 *               LISTEN      770/cupsd       
tcp6       0      0 ::1:631                 :::*                    LISTEN      770/cupsd       
udp        0      0 *                           793/avahi-daemon: r
udp        0      0  *                           1617/dnsmasq    
udp        0      0    *                           4687/dhclient   
udp        0      0   *                           811/cups-browsed
udp        0      0 *                           4687/dhclient   
udp        0      0  *                           793/avahi-daemon: r
udp6       0      0 :::14207                :::*                                4687/dhclient   
udp6       0      0 :::54184                :::*                                793/avahi-daemon: r
udp6       0      0 :::5353                 :::*                                793/avahi-daemon: r
  • So you gave your WEP/WPA/WPA2 key to somebody, is that correct? Did you live with someone who might have pulled all this (a jealous SO, perhaps)? – A. Darwin May 10 '16 at 19:13
  • The reason why I asked is that this kind of attacker has different ways to obtain your credentials, from coercion/emotional blackmail to attacks exploiting physical access to your devices, to sniffing attacks,... without exploiting the vulnerability you mentioned. – A. Darwin May 10 '16 at 19:22
  • true, I thought about this too! I live in a student doorm, people hatin on me non stop... My room has an key lock with an card (like an credit card) the chipset in the card unlocks the door. I think their would be the possibily to copy such card, without big effort! Someone here on my floor (probably also a lovely girl, which studies something computer related - means : could be able to install something with good instructions -, could have taken access to my computer, while I was in the kitchen or bathroom). An HD camera installed somewhere here in my room is also an possibility. – user1612540 May 10 '16 at 19:37
  • 1
    Is this a riddle? Is the girl Cortana? – Dave May 10 '16 at 21:40
  • 2
    Why do you think that it is a network issue? All the evidence you provides points to a Google account compromise. Do you have a reason to think that it is something besides your Google account? – schroeder May 10 '16 at 22:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.