2

Last week, my cable modem went dead, and the ISP guys came over to my house and replaced the modem, but they came while I was away.

I was told that they spent a very long time configuring my cisco linksys wireless router and TPLink wireless repeater. For some reason paranoia kicked in and alarm bells started ringing in my head, I got to thinking that maybe they were installing some sort of spyware to monitor my home network traffic, maybe some kind of MITM. Since they came I haven't been able to open the web admin panel, it just shows a 502 bad gateway error and I haven't had time to fix it.

I am an IT guy but not exactly a security expert. How do I find out if there is such a thing?

Notes:

  1. this is in a far east country where consumer protection laws are practically nonexistent.
  2. just to clarify it doesn't necessarily have to involve the ISP, I also consider the possibility that it's just a couple of rogue technicians installing surveillance for their own purposes.
  • I recommend that all IT people use their own routers for multiple reasons. – MikeP Oct 18 '16 at 15:55
  • What do you mean? A DIY router using a linux box? – daxter1992 Oct 18 '16 at 15:58
  • @daxter1992 DDWRT ... or you could setup a remote socks5 proxy on a linux vm in the cloud and tunnel all your traffic through that. – CaffeineAddiction Oct 18 '16 at 16:24
  • 1
    Why would they need to do anything to your router since they can monitor the traffic and/or MITM it everywhere else, starting from the modem and throughout the rest of their systems carrying all your traffic? – Peteris Oct 18 '16 at 21:48
  • 1
    @daxter1992, Own vs. Rent. That way you have your own control of your own wifi name and password, updates to keep your router from becoming part of the DDoS attacks. Running your own DDWRT, OpenWRT, pfsense, or whatever is more complex, but also a good way to get more features, and likely more security since many routers never get security updates. – MikeP Oct 22 '16 at 21:58
2

If the installers were a higher skill level than you, then they could do something entirely undetectable by you.

That said, unless you have very good reasons for expecting someone to try and bug your network, it is a fairly irrational worry. These guys came from your ISP - and ISP's generally try to avoid committing criminal acts like that, as it can really harm business.

A much more likely reason for it taking a long time (and how long were you expecting exactly?) is that configuration for your network or line didn't work as smoothly as possible. This kind of thing happens all the time - a 2 minute upgrade becomes a 2 hour upgrade as some unexpected hiccup occurs.

Tl;dr - paranoia is generally unfounded for most folks. If you are a target, then worry. If not, remember state-level surveillance of the population doesn't happen at the home router end of things...

So, now that's out the way, here are some ways to detect surveillance:

  • compare firmware with a known-good machine
  • compare configuration with a stock machine
  • monitor traffic and routing

Your mileage may vary - it is possible to hide all sorts of things. If you are very worried, change ISP and router...assuming you trust another ISP.

  • "ISP's generally try to avoid committing criminal acts like that", that would be true, except that I live in a far east country where consumer protection laws are practically nonexistent. – daxter1992 Oct 18 '16 at 15:54
  • I understand it's most likely unfounded. I just didn't expect them to take that long because when I first set the repeater up, took me literally just 1-2 minutes with no trouble at all. – daxter1992 Oct 18 '16 at 15:58
  • 1
    @daxter1992 "Never attribute to malice that which is adequately explained by stupidity" ... it might have just be a Nub Tech that took too long cause he didnt know wtf he was doing. Though double checking there isnt a terrible idea. – CaffeineAddiction Oct 18 '16 at 16:27
0

Successfully detecting high quality surveillance is much harder than simply starting afresh; and you might never be certain that you spotted it. To allay your suspicions, re-flash your devices.

First, do some research to learn how to restore factory defaults on your router without using the current admin password. That will likely be the only way to reset the admin password, which you will need in order to re-flash it.

If you can flash it with a file uploaded from your PC, do so: disconnect your router from the internet, then bring your laptop to download the router firmware update file from somewhere where you won't be monitored, such as a wifi hotspot well-away from your home. Consider using a VPN or Tor to download the flash file from a different country, so that you won't get some kind of corrupted, country-specific flash. After you return, re-flash the router before reconnecting it to the internet.

If your router has to be online to re-flash it, carry your router to a friend's house - a friend who has a different ISP than you - and flash it there.

Re-flash your repeater in the same way. Of course, change the default admin password after flashing, then set up your network again. Ensure the router's firewall is on. Turn off UPnP on your router, so that a compromised network device inside your house can't open any extra ports on it.

If things aren't working right after flashing everything, check to make sure you have the DHCP server in your router is turned on, and the DHCP server in your TP-Link repeater is turned off. You only want one DHCP server in your house.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.