1

This is my first post on here, and the first time I put serious thoughts into network security.

I think I have an serious security issue in my network. It seems like someone somehow injected a backdoor program on my devices and can see the content.

I noticed several strange things on my Android Device - messages getting tagged, emails were marked as read without me opening them on any device, etc. A few weeks ago I also got an message from Google saying "that someone knows my userpassword", and showed me a Location somewhere in the U.S. (maybe a proxy?). But I am not quite sure if that is related.

However my suspicion is that someone used an exploit in the Fritz!Box 7362 SL Fimeware (known since a month or so), which allows an attacker to get access to the local network traffic. Also someone I know could have given the standard network key for the router.

I reset the router (set a new password, made changes in the router setting), encrypted my Android devices, and tried to identify any malware on my PCs (Ubuntu, Windows 10).

So basically my question is: How can I know for sure that something on the network or my devices is manipulated? Several checks of open ports/connections didn't show anything suspicious IMO. But I am pretty sure that someone hacked me, my gut instinct tells me so.

So what you guys thinks about this? Whats the best way to solve this issue?

https://www.insinuator.net/2014/03/how-to-own-a-router-fritzbox-avm-vulnerability-analysis/

EDIT nmap gives me this output for my local router address

Discovered open port 80/tcp on 192.***.***.***
Discovered open port 53/tcp on 192.***.***.***
Increasing send delay for 192.***.***.*** from 0 to 5 due to 227 out of      566    dropped probes since last increase.
Discovered open port 8181/tcp on 192.***.***.***
Discovered open port 5060/tcp on 192.***.***.***

with my current extern ip traceroute leads me to the fritz box but without open ports

netstat -tulnp on my Ubuntu machine shows nothing suspicious too, as far as i see...

Proto Recv-Q Send-Q Local Address           Foreign Address             State       PID/Program name
tcp        0      0 127.0.1.1:53            0.0.0.0:*               LISTEN      1617/dnsmasq    
tcp        0      0 127.0.0.1:631           0.0.0.0:*               LISTEN      770/cupsd       
tcp6       0      0 ::1:631                 :::*                    LISTEN      770/cupsd       
udp        0      0 0.0.0.0:40641           0.0.0.0:*                           793/avahi-daemon: r
udp        0      0 127.0.1.1:53            0.0.0.0:*                           1617/dnsmasq    
udp        0      0 0.0.0.0:68              0.0.0.0:*                           4687/dhclient   
udp        0      0 0.0.0.0:631             0.0.0.0:*                           811/cups-browsed
udp        0      0 0.0.0.0:41630           0.0.0.0:*                           4687/dhclient   
udp        0      0 0.0.0.0:5353            0.0.0.0:*                           793/avahi-daemon: r
udp6       0      0 :::14207                :::*                                4687/dhclient   
udp6       0      0 :::54184                :::*                                793/avahi-daemon: r
udp6       0      0 :::5353                 :::*                                793/avahi-daemon: r
Improve this question
12
  • So you gave your WEP/WPA/WPA2 key to somebody, is that correct? Did you live with someone who might have pulled all this (a jealous SO, perhaps)?
    – A. Darwin
    Commented May 10, 2016 at 19:13
  • The reason why I asked is that this kind of attacker has different ways to obtain your credentials, from coercion/emotional blackmail to attacks exploiting physical access to your devices, to sniffing attacks,... without exploiting the vulnerability you mentioned.
    – A. Darwin
    Commented May 10, 2016 at 19:22
  • true, I thought about this too! I live in a student doorm, people hatin on me non stop... My room has an key lock with an card (like an credit card) the chipset in the card unlocks the door. I think their would be the possibily to copy such card, without big effort! Someone here on my floor (probably also a lovely girl, which studies something computer related - means : could be able to install something with good instructions -, could have taken access to my computer, while I was in the kitchen or bathroom). An HD camera installed somewhere here in my room is also an possibility.
    – user1612540
    Commented May 10, 2016 at 19:37
  • 1
    Is this a riddle? Is the girl Cortana?
    – Dave
    Commented May 10, 2016 at 21:40
  • 2
    Why do you think that it is a network issue? All the evidence you provides points to a Google account compromise. Do you have a reason to think that it is something besides your Google account?
    – schroeder ♦
    Commented May 10, 2016 at 22:44

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .