2

My home network has been shutoff by my Internet Provider twice now because it is "trying to gain access to unauthorized resources" within the Internet provider's network.

I am trying to track down the offending device so I can purge any malware that has taken root on it, but I am not sure how.
I have a number of computers running, Linux, macOS, and Windows and some (not many thankfully) IOT devices, any of the above could be the culprit, and only a few of the devices (macOS and Windows boxes specifically) have anti-virus software that I know of.

My network topology is pretty simple, I have a Modem/Router connected to the internet provided to me by my Internet Provider (made by Arris) that is also connected to another wireless router (I think both act as DHCP servers with the wireless router sitting on its own subnet, routing traffic to the Modem as needed, but I will need to confirm how I set it up after I get home).
All of my devices connect to either of these two devices and get internet traffic forwarded on to my Internet Provider.

The only way I can think of tracking this down is asking my Internet Provider for details on the resource my network is allegedly trying to access and then setting up Wireshark and putting my NIC in promiscuous mode and waiting for it to happen again.

Is there a better way to track this Malware down?

Improve this question
3
  • 1
    Yes, searching with Wireshark will most definitely get you a clean kill. Using something like Snort is easier becuse it will alert you, but if it's not a well-known threat you'll have to write a rule for the IDS engine.
    – J.A.K.
    Commented Mar 21, 2017 at 0:00
  • 1
    ^This. Wireshark will show you the traffic you're looking for.
    – Henry F
    Commented Mar 21, 2017 at 1:03
  • Thanks, I am kind of leaning on getting another router in front of my modem, so I can set up a tap between all of my internal network and my cable modem and direct that to a box (hopefully a RPI, but I bet my traffic rate is too high for that) with Snort running. Wireshark will be my first step though.
    – Chris
    Commented Mar 21, 2017 at 14:29

1 Answer 1

Reset to default
3

To identify precisely what's happening, the capture over time using Wireshark (and add maybe a little bit of logging on each network node) will make you know quite precisely what's going on. "Quite" because, knowing the attacker is attacking your ISP, we can assume the malware might have spread in your home network, gaining safe and quiet places to hide for some time. Let's follow some crisis methodologies (or a light version of it!)

  • Deny the attacks, limit the spread

Maybe an IDS/IPS can help you to snort the malware, and block the malicious communications on the network bridge. Add some firewall rules: I'm currently thinking about destination IP filtering, but you can add some rules based on the use of each of your machines. That may isolate it, that's a good beginning.

  • Eradicate

Then, eliminate may be harder and the solutions are quite evident: antivirus scans might work or disk wipes will do.

The few IoT objects may still be difficult to deal with, as the device can be locked/proprietary.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .