1

I'm seeing notifications from my antivirus software that scans are being blocked. Some are from external IP addresses, but others are coming from my router. For example, here's the text from one notification from my antivirus about a scan that, apparently, came from my router.

Attack: an intrusion attempt was blocked.
Risk Level | Medium
Attacker Computer
{router internal ip address}:53768
Destination Computer
{webserver internal ip address}:80
Protocol
TCP
Attack Signature
Web Attack: Malicious Scan Request
Attack URL
{webserver external ip address}/cgi/common.cgi
Targeted Application
SYSTEM
Status
Blocked
Action
Resolved - No Action Required
Date & Time
12/4/2017 3:07 PM

Does anyone have any idea of what is going on here?

1
  • 1
    yes, your router is compromised – schroeder Dec 5 '17 at 18:08
1

If it's coming from your router, then your router's been compromised, no question about that. Someone is tunneling through it.

Simply resetting the IP isn't enough. You should do a factory reset of the device, reset the password, and report the incident to the ISP.

4
  • If you're resetting the IP, I'd also suggest considering blocking all incoming communication and never using that ID and password again. If you're on a home network, there shouldn't be much reason for anyone to reach in to your network. This assumes that the firmware on your router hasn't been altered... – baldPrussian Dec 5 '17 at 20:40
  • What about the possibility of a device on my network that is spoofing the attack? – umsrato Dec 5 '17 at 20:50
  • @umsrato spoofing is unlikely and would not do the attacker any good – schroeder Dec 5 '17 at 21:31
  • Yea, @schroeder is right, spoofing wouldn't help – Dwad Dec 6 '17 at 14:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.