This is my first post on here, and the first time I put serious thoughts into network security.
I think I have an serious security issue in my network. It seems like someone somehow injected a backdoor program on my devices and can see the content.
I noticed several strange things on my Android Device - messages getting tagged, emails were marked as read without me opening them on any device, etc. A few weeks ago I also got an message from Google saying "that someone knows my userpassword", and showed me a Location somewhere in the U.S. (maybe a proxy?). But I am not quite sure if that is related.
However my suspicion is that someone used an exploit in the Fritz!Box 7362 SL Fimeware (known since a month or so), which allows an attacker to get access to the local network traffic. Also someone I know could have given the standard network key for the router.
I reset the router (set a new password, made changes in the router setting), encrypted my Android devices, and tried to identify any malware on my PCs (Ubuntu, Windows 10).
So basically my question is: How can I know for sure that something on the network or my devices is manipulated? Several checks of open ports/connections didn't show anything suspicious IMO. But I am pretty sure that someone hacked me, my gut instinct tells me so.
So what you guys thinks about this? Whats the best way to solve this issue?
EDIT nmap gives me this output for my local router address
Discovered open port 80/tcp on 192.***.***.*** Discovered open port 53/tcp on 192.***.***.*** Increasing send delay for 192.***.***.*** from 0 to 5 due to 227 out of 566 dropped probes since last increase. Discovered open port 8181/tcp on 192.***.***.*** Discovered open port 5060/tcp on 192.***.***.***
with my current extern ip traceroute leads me to the fritz box but without open ports
netstat -tulnp on my Ubuntu machine shows nothing suspicious too, as far as i see...
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 127.0.1.1:53 0.0.0.0:* LISTEN 1617/dnsmasq tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN 770/cupsd tcp6 0 0 ::1:631 :::* LISTEN 770/cupsd udp 0 0 0.0.0.0:40641 0.0.0.0:* 793/avahi-daemon: r udp 0 0 127.0.1.1:53 0.0.0.0:* 1617/dnsmasq udp 0 0 0.0.0.0:68 0.0.0.0:* 4687/dhclient udp 0 0 0.0.0.0:631 0.0.0.0:* 811/cups-browsed udp 0 0 0.0.0.0:41630 0.0.0.0:* 4687/dhclient udp 0 0 0.0.0.0:5353 0.0.0.0:* 793/avahi-daemon: r udp6 0 0 :::14207 :::* 4687/dhclient udp6 0 0 :::54184 :::* 793/avahi-daemon: r udp6 0 0 :::5353 :::* 793/avahi-daemon: r