How to trace location where MITM is occurring?

Question

My computer has been a target of a Man-in-the-Middle attack. When I am using the same site for more than 5-10 minutes, occasionally that website gets replaced by a compromised website for a couple hours. Since I am using HTTPS, I immediately detect the attack, since the certificate is suddenly self-signed-- and I avoid sending sensitive data; however, the attacks have been getting more sophisticated lately. Furthermore, I need to be able to continue my work-- I need to be able to connect to the original website somehow.

One odd thing is, that this attack is browser-specific. For example, when eBay.com has been compromised on Firefox, it continues working on Opera. However, after 5 minutes of working on Opera, it is compromised there too; but switching to IE allows me to continue working for another 15-20 minutes. It is never compromised when I am accessing it via command line (presumably to prevent me from using tools such as tracert).

I have been able to obtain my system administrator's password, and admittedly it is only a moderately strong password; and, the router allows remote control; so possibly, the router has been hacked. I can change the router password; but first, I would like to confirm where the attack is coming from. Because if I don't, and the attacker detects my attempts to thwart him, then he can stop for a time, to make me think I've found where the problem is coming from, when I actually haven't.

Answer 1

Before entering any type of passwords, you need a secure system to safely diagnose what is happening. If you have another machine or a Live DVD or USB drive of a Linux distribution like Linux Mint or Ubuntu to boot up on your current system, or another system on the same network start there.

This will help determine if you have some sort of malware or backdoor on the system you were experiencing this on. If you are able to use another known clean/secure system and none of the symptoms occur, then you know your computer is affected locally on the operating system running. If on the other hand, any system in your network is getting re-routed, then yes, it's possible your router is compromised too.

What are the details of the system you are using? Is it on a domain with a Windows Server?

Answer 2

This sounds remarkably (exactly) like an issue I've had to deal with a few months back on one machine. If it is the same one, then it's not a MITM attack. This was local malware, infecting the Windows network stack, redirecting browsers to a different website - an auto-generated facsimile of the original, belonging to the malware owner.

The reason it doesn't affect the command line is because it can't, the redirect happens at a higher level. It also wouldn't affect UDP or other network apps. Unfortunately I didn't find an easy way to remove the malware nondestructively and ended up just reimaging the machine.

P.S. Unless someone is dying and it's your line to EMTs, never try to work on an infected machine! Once you suspect an infection, that's it - cut it off, boot from external media, move sensitive and valuable data, then proceed to find and remove the malware.