So by opening an application/browser on my Android device, I found that it pops open a set of ads. I channeled a proxy through my laptop trying to track the first web site it connects to. Later I found out that my router DNS is the same as that server that pops open the ads. Also I found that my /etc/resolv.conf contains the same DNS but it was printed by the network manager. So scenarios are:
- My mobile device was infected and attacker accessed my router since it has different kinds of vulnerabilities and changed the DNS there. Then network manager prints it to my /etc/resolv.conf
- My laptop was infected (highly unlikely since its a new device nothing untrusted installed)
- Attacker accessed the router first then some how figured to infect apps on my android device and this DNS change in /etc/resolv.conf also happened by network manager just copying router's dns to my system
So the question is how to debug this situation? How to figure out the core problem here, also many apps are infected on my android device? I tried different anti-virus but no luck. Also I would appreciate a word of advice on reporting the attacker here since I believe this could be a sort of mass attacks on the routers within my IP address range.