0

Something strange is happening to my internet requests and I don't have the knowledge to know why it's happening.

I've suddenly started to be directed to google france whenever I do internet searches so I looked up my IP and ip location to see where google thought I was positioned and it turns out that my ip address had changed, the new ip address now belonged to a server in france, a server of an isp that is not my isp.

I checked the ip of my home router and the router's ip didn't match the new ip. I have two windows machines, one running w10 and the other w7, the problem happens on both machines. I also have android tablets and I have checked my ip on these tablets and the correct ip is returned with the correct location and the correct isp. all tablets and pcs are connected to the local network which should in theory share the same IP address(?).

I downloaded wireshark so I could see what was being sent and where, and I can see that packets are continually being sent and received by the ip address of the server in france.

To confuse things, this morning I looked up my ip on both pcs again and the correct ip, location and isp was returned however I checked wireshark and packets were still being sent and received to the ip of the server in France.

Is it possible that some malware is routing traffic to this server in France, and it has infected both my pcs through the network?

I don't use a vpn and don't have one configured. I checked in the windows settings and none were being used. I have scanned with avast and malwarebytes and they have turned up nothing. I'm currently running a microsoft safety scanner but it's not showing anything yet.

I just can't understand what is going on, but then again I have very limited knowledge of security and networking. Does anybody have more of a clue? I've been reading about Mitm attacks and thought this sounds similar.

  • 2
    Does all traffic you send go to that server in France? How about DNS requests? Where do responses come from? Have you configured a proxy? Did you check proxy configuration on all possible levels? (OS, browser,…) Do you use the TOR? – Tobi Nary Nov 25 '17 at 12:45
  • No, not all traffic goes there, I haven't got a proxy set up, i don't know how to check all possible levels, but under the windows LAN configuration there is no proxy set up. I can see on wireshark that all packets sent to the french server are sent using TCP. I don't use Tor. – Robert Brooks Nov 25 '17 at 12:55
  • 1
    Then which traffic goes there? All TCP traffic? Is that in correspondence with the DNS requests/responses? What connections are established, according to netstat? Is the DNS server that of your ISP? – Tobi Nary Nov 25 '17 at 12:57
  • No not all tcp traffic goes there so if it is indeed malware it hasn't hijacked everything. according to netstat there is an established connection to that unknown server. according to the address of the dns server given by ipconfic the dnsmatches the dns of my router. I'm not sure what you mean by in correspondence with dns requests. Maybe I'm a little out of my league here. I don't want to waste your time. I realise this QA forum is for people more savvy than I. – Robert Brooks Nov 25 '17 at 14:21
  • Are you on Windows? Control Panel\Network and Internet\Network and Sharing Center > Ethernet* > Properties > General. Are these on "Obtain an IP address automatically," and "Obtain DNS server address automatically?", or did someone change them? Also, go to your browser's network settings and see if someone pointed your browser to a proxy server. Usually it could even be 127.0.0.1 on a specific port, meaning a program on your system would be using that port. If so, try TCPview, or in cmd.exe, tasklist /svc | findstr "portnumberhere" to find the program with that port open. – Mark Buffalo Nov 25 '17 at 17:11
2

I have seen this happening on some machines, with different target IPs (last one was in Texas, of all places: the actual server should have been in Northern Italy, not even on the same continent).

Verify your network configuration and manually set the DNS entry to Google's 8.8.8.8, and see whether this continues to happen or not.

What happened in my cases was that something had hijacked the routers, thanks to the fact that the users had left them with remote access enabled and trivial passwords (but I am advised that there somethings that can brute force entry or exploit router vulnerabilities), and reprogrammed the DNS sent via DHCP to the internal network so that DNS queries were routed to a rogue server.

The rogue server then replies to "most" DNS queries with the address of another rogue server, which is then able to hijack all of your communications. Google mail, home banking site, and so on. HTTPS encrypted connections will receive faked signed certificates, which may trigger a browser security alert... or not, depending on the browser.

I would carefully review the logins you've used while being hijacked, and consider those passwords compromised.

If the DNS trick works, your router is in all likelihood compromised also; I'd reset it to factory and secure it, unless you already secured it when you installed it, in which case it must be considered vulnerable and replaced with a new model, or its firmware updated if possible. You may want to Google your router's make and model and keywords such as "vulnerability", "botnet", "CVE".

  • Thanks for the answer. I've taken all your advice. I've reset the router, although it wasn't set to allow remote access, changed the admin password and the wifi password. I've also set up a firewall on the router blocking upstream and downstream comunication with the rogue IP. I set the dns routers to 8.8.8.8 and my pc routers to that dns. It seems to have worked so far but I'll be monitoring everything for the next month as I'm still not sure how they got into the network either from a file on my pc or from outside. – Robert Brooks Nov 26 '17 at 17:16
  • The one I saw was probably distributed via an email attachment (a fake invoice that downloaded an executable). But there are other ways to get in. – LSerni Nov 26 '17 at 17:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.