0

I use a Mac (running macOS Sierra). Yesterday I was watching a movie online from some not-so-trustworthy website and when I clicked the pause button, a tab appeared and suddenly disappeared.

From that moment onwards, whenever I open any https site, it throws an error named "Your connection is not private". It doesn't matter if I use Chrome, Safari or Mozilla Firefox, all of them throw the same error. A moment ago, when I opened google, it opened a tab with the url: Gstatic.com/generate_204 by itself!

The interesting thing is that if I use Tor or if I use a VPN and change my location to anywhere else, all websites start working!. Why does this happen?

Things I have tried:

1) Checked the date and time - They are all correct.

2) Deleted my cache and restarted my computer and browser.

3) Tried finding some unwanted installed applications or some extensions on my chrome that I didn't install - I couldn't find any.

Could someone PLEASE provide some help! I am scared to death that my mac has caught some virus and all my credit card information might be at risk!

1

As you ask in Steffen's answer about is it safe to use email while using VPN, if you don't trust on this VPN, you can set Google's DNS directly on your MAC and stop using this VPN. To do this, go to System Preferences and then Network Preferences. Go to DNS tab and put 8.8.8.8 on DNS #1 and 8.8.4.4 on DNS #2.

Actually, your problem can be restrict to your MAC and your phone's issue could be another thing. When you went to DNS tab, did you find another numbers placed on those spaces? If "yes", change these numbers to Google's DNS can solve your problem.

However, if I understood correctly, you did a factory reset on your router and the problem persists, but you cleaned your brownser's cache data and tried to access some site immediatly? If "not", try these steps.

This can solve your problem temporarily, but if you did a factory reset on your router and it not solved, firstly do what Steffen said (update router's firmware) and if you can not find it, call the ISP and ask to change the router. Also, it's important to configure some things on router, like change the factory password, turn off WPS if you don't use it, set a fixed DNS and created a guest network for your visitors or a person that is not concerned about security (modern routers have this feature).

Keep us informed.

  • IT WORKS! I changed my DNS to 8.8.8.8 and 8.8.4.4 and now all the https sites are working! Secondly, I did not do a factory reset. I just unplugged it and then re-plugged it again :P – Small_Bob Jun 16 at 4:41
  • I am afraid to do a factory reset because I don't know how to configure it myself. – Small_Bob Jun 16 at 4:42
  • Now, what should I do? Keep the DNS to 8.8.8.8 or do a factory reset and use the old DNS? Also, is it safe to use this 8.8.8.8 DNS!? – Small_Bob Jun 16 at 4:43
  • It is safe, this is Google's DNS. However, have a router with a (maybe) security breach isn't a good thing. As Steffen thought, now we have confirmed that your router's DNS has changed by some attacker. – Mycroft Jun 16 at 4:47
  • For example, you just assign a IPv4 DNS, but there is IPv6 connections that are not safe because they may have be changed. The most secure procedure is call your ISP and ask aid to reset your router. When a router is reset, also the password is, so be sure to change it when you do that. Factory password may be the cause of your problem, but your router could have a vulnerability on firmware - in this case, update the firmware or (if you not find it on manufacturer's site, and search for it only in this site) change the router to another one. – Mycroft Jun 16 at 5:09
1

This looks like a man in the middle attack but not on your computer but instead on your network - otherwise the problem would likely not vanish if you use Tor or VPN.

This might be because you are using an insecure network (like an open WiFi hotspot) where somebody is doing an attack or because your private network is compromised. The latter could be for example because of an attacker in the local network or because your router was compromised - for example with something like DNSChanger.

In case of a compromised router doing a reboot or (if does not help) a firmware reset of the router might solve your problem temporarily. But you should better make sure that your router will not be attacked again by updating its firmware with a fixed version from the vendor (which hopefully exists).

  • Thank you for your answer! YES, I do think that the attack was on my Router because when I tried to open youtube on my phone through my WiFi, it did not open! Moreover, I don't use an open WiFi hotspot. My WiFi is password protected. – Small_Bob Jun 15 at 15:49
  • I rebooted my Router but it did not help. Should I call the ISP guys and ask them to change it? Or should I do something else? – Small_Bob Jun 15 at 15:50
  • Also, is it safe to use my email while using a VPN? – Small_Bob Jun 15 at 15:51
  • @Small_Bob Just to clarify, "reboot" means that you did a factory reset on your router, right? – Mycroft Jun 15 at 16:13
  • @Small_Bob: If everything is fine using VPN then it is probably safe to use email. But be aware of typical VPN misconfiguration like still using the local DNS server or not protecting IPv6. And, if a simple reboot did not help then do a firmware reset (factory reset) as I already said. – Steffen Ullrich Jun 15 at 16:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.