Is my network infected? Suspicious messages and devices slowing down

Question

Recently a family friend has been complaining that he has been getting hacked on his home network and that he has been receiving suspicious messages from the attacker. He says that the attacker has been taking all his subscriptions and email details. His friend who specializes in IT said there's nothing going on after checking his connection. He formatted all computers and instructed him to only use a wired network. His friends and family thought he was just going crazy because he has slight mental issues.

He asked me to come to his house and see if I can find anything suspicious (I am a current IT student and have only completed one semester). I did virus scans and cmd checks and found nothing. I installed a top security router (after he requested it) to ease his mind and attempted to add a VPN. As I was adding the VPN, suddenly his computer started to slow down to the point that I could not switch to any tabs or click on any website. At first, I thought that this was just his laptop playing up because it's a few years old. I decided to connect my phone to the network to enter the VPN details and behold I received a suspicious text message saying that I won an eBay voucher. I immediately disconnected from the network and formatted my phone. There's no way this is a coincidence and I am convinced his network is infected.

Is it possible for his network to infect anything it connects to? Even after changing the router and modem?

Can my smartphone (android) still be infected after formatting it? Am I at risk when using it?

What kind of attack can this be and what steps should I take to resolve the issue?

Answer 1

One of the helpful things in this situation is a knowledge of the OSI model and the layers of technology. OSI layers can be extremely boring to study in school, but they, and an understanding of technology stacks in general, form the basis of almost all understanding of the interrelationships of technology. And that understanding will help you troubleshoot things like this.

Networks do not infect anything. Networks are connections between nodes (computers, phones, routers, etc.) So, if there was malicious code lurking in the network to infect new things, it would have to exist on one of the nodes. You replaced the router, so that's not it. Your phone was new to the network, so that's not it. What's left is everything that is left. His computer and anything else that is a node on the network (TV? Game consoles? Other IoT?). The laptop was formatted and rebuilt, but the malicious code could have been reintroduced when things were reinstalled.

There is nothing in your description to suggest that your phone was infected at all. It received a message. How you got that message is a good question, but you need to provide more details so that there can be an understanding of what layers are involved. If you got a pure SMS message, then the message is a coincidence. There is no technology overlap between WiFi and SMS.

The steps you need to take is to work through a basic troubleshooting process to eliminate the various elements of the problem. You need to understand the connections between the various technologies and trace the behaviours from one technology to another.