Received email from ISP saying one of my devices has malware

Question

My dad received a suspicious email from our ISP (mtnl.net.in). The email was from [email protected] and it had our user ID (I masked it as xxxxxxxx@a) in the email so it must have come from the ISP itself.

Email details below:

Subject:

"Intimation Regarding Malware/ Virus Infected Systems"

Body:

Dear Sir/Madam,
Greetings!
It is observed that your device connected with MTNL Mumbai broadband network with broadband number xxxxxxxx@a is infected with Malware. This is as per the analysis of Computer Emergency Response Team -INDIA (Cert-IN), under the Ministry of Electronics and Information Technology.
Malware (CNC) is unwanted software that is installed in users system without users consent while user is surfing on the Internet. An attacker or cybercriminal can remotely send commands to such systems which are compromised by malware. These compromised machines can be used to create powerful networks (botnet) of infected devices capable of carrying out distributed denial-of-service (DDoS) attacks, stealing data, deleting data or encrypting data in order to carry out an extortion scheme. The device becomes part of the botnet due to malware/virus installed on it.
To secure your devices , Kindly check your devices for malware/ botnet using Antivirus S/w.
For more information on malware/botnets and the counter measures kindly visit https://www.cyberswachhtakendra.gov.in. You can also download "Free botnet removal tools".
Thanks & Warm Regards,
MTNL, Mumbai

---

I extracted all links from the email and scanned them via the https://www.virustotal.com/ URL scanner but all were reported as safe.

Links:

• http://www.cert-in.org.in/
• https://www.cyberswachhtakendra.gov.in/
• https://www.quickheal.co.in/bot-removal-tool
• http://mtnlmumbai.in/index.php/broadband/triband/promotional-plans#unlimited-high-speed-plans
• https://selfcare.mtnl.net.in/mumbai/TribandRegistrationInstn.aspx

Looking online there is a similar question on Quora but a different scenario.

NETWORK AT HOME

• Two mobile phones (Android)
• One laptop (Windows 10 with Avira antivirus)

QUESTION:

• Can an ISP really detect this?

• Should I act on this and what should I do?

---

To answer some of the questions:

• Only the above 3 devices are connected to the wifi, no other IoT devices.
• My parents are the only users ... so you can rule out TOR browsers or any inappropriate searches.
• Also no VMs on the network.
• I will try to contact the ISP but they are a government one and have very bad support.

Also after doing some more research it seems that Quick Heal has a tie up with MTNL and BSNL, both government providers, so there is a chance they might be just promoting Quick Heal.

Links: Link1 Link2 Link3

Personal note: I find it very odd that MTNL is actually taking trouble to find bots !!

Answer 1

Can an ISP really detect this?

The ISP can see all data your systems exchange with the internet (but not the plain text from encrypted data). Based on this he can detect botnets which often show typical behavior.

Should I action on this and what to do?

Yes, you should action on this since there seems to be malware in your network which is used to disturb other systems on the internet (sending spam mails, DDoS attacks, used as VPN to hide malicious activity and others) and which might also affect your internal network (infect computers, steal data, take data as ransom ...).

If you don't fix the problem you might also risk that the ISP restricts your network or even completely disconnects you from the internet (depending on the terms of service).

Based on the information you've provided it is impossible to say what exactly the problem is though. It might be that your laptop is infected (Antivirus do not offer 100% protection) or that one of your phones or that the router itself. It might also be other devices in your network you are not really aware of, like a TV, printer, IP camera or other IoT devices. And it might be also caused by software you have knowingly installed yourself, but which has a hidden malicious functionality you are not aware of.

The links they provided in the mail seem to be fine so that you can follow these for more information and for the offered botnet removal tool. But if you are in doubt if the mail really originated by your ISP please contact the ISP - it is impossible for us to see based on the information provided what the real origin of the mail is.

Answer 2

This looks like a legitimate email.

Someone detected that a computer with an Indian IP address was part of a botnet. This was shared with your National CERT (CERT-In). In turn, as they didn't know which user had that IP address at the time it was detected, they notified your ISP, which in turn found out which customer was responsible of that connection and forwarded that notice to your father.

As you see, they are pointing you to a botnet clearinghouse set up by CERT-In on https://www.cyberswachhtakendra.gov.in/

The piece I miss from that notification is that they don't mention when the connection happened, whic.

If you wanted to verify their claim or get further information, I would recommend you to contact directly with CERT-In (the Contact Us link on https://cert-in.org.in/ provides their email addresses).

I miss from the notification that they sent you the time on which the malicious behavior was detected or at least the IP address you had at the time, which would make it difficult for them to find out which of the hundreds of similar alerts they sent out is the one received by your father. Although if you have had the same IP address for some time, it is likely they could find events for your current IP address (you would have to provide it to them in your request).

Given that -supposedly- in that home there are only one computer and two mobile phones, my suspicion is that the infected device is the laptop, so I would begin by running there the Bot Removal Tool they recommend on the Cyber Swachhta Kendra for disinfection, as it should be able to disinfect the malware they are warning about. And in case it found out nothing, then ask the CERT-In for more detail.

Answer 3

The email address from which you have received the mail seems genuine. The body of the mail also adds to the genuineness. However, senders email addresses can be spoofed by using open mail relays. As per the Department of Telecom, port 25 must be blocked to reduce surface area of spoofing, yet there are many open relay that are live still.

To confirm authenticity of mail, please copy the headers and see the reputation score of originating SMTP server. Reference to online tool , do not forget to delete your headers from this site after you have analyzed the source.

Alternatively you may call your ISP to confirm the authenticity of mail.

Now if your ISP has really sent this mail to you, request you to follow below steps for mitigating the issue.

• Initiate a full malware scan on the laptop. you may use any one of these anti-malware software Trendmicro House call, MalwareBytes, Avast. After scan is completed, delete the detected files, if any.
• Install the tool Process Explorer to see what processes are running on the laptop. you have a really good option in this tool to check if the running process is malicious or not against Virustotal(60+ anti-malware software). If any processes flagged as malicious, kill it, open its location on your local drive and delete it.
• Check for any recently installed applications that you're not aware of, or seems suspicious to you.
• Have your phones scanned for malware as well, with anti-malware mobile applications
• Report the findings of above steps followed to your ISP and ask them if they still see any botnet connections.

Hope the above solves your issue, if not, at least you would have given your ISP a head start in detecting the root cause of the malware.

Answer 4

You should take this mail seriously.

There is no reason not to investigate your network for malware. (You don't need to click their links or download their tools for that, find your own from reputable sources or investigate them first.)

The only suspect information I can see in the mail is the omission of a specific threat/malware. That makes finding and removing it very hard for the average end-user.

Despite that, I believe it's legit.

Since the mail is referencing Cert-IN (https://cert-in.org.in/) you can check on their website for recent alerts, their mail is likely referencing a recently discovered threat, so you can look for these.

Since you say "devices are connected to the wifi", there could be a slight chance it's not any of your devices being infected... but if that were the case, you'd still have a problem.

Why would they take the trouble to notify you?

Historically, ISPs were very lax about this, but with malware and botnets becoming an ever-increasing threat, the international community is becoming more forceful with ISPs to inform and sensibilize their customers, or being subjected to a bad reputation themselves.

Why would they take the trouble to find bots?

Often, it is not the ISP who finds the bots, but some Malware analysts and investigators -- such as Cert-IN -- tracking down C&C (command and control) server infrastructure, or bot communications, and then finding infected peers and informing ISPs of those IP addresses, who then have the information (IP address to ISP customer lookup) to be able to inform their customers.

You could read some interesting blog posts from malware analysts to get a better understanding of this:

• https://www.malwaretech.com/2019/01/tracking-the-hide-and-seek-botnet.html
• https://www.malwaretech.com/2017/04/the-kelihos-botnet.html

Answer 5

Is this a joke?

This is 100% a malicious email.

The (Too happy) language, as well as trying to explain to a user what a 'botnet' is, throwing random scary things such as extortion and encryption, then asking the user to search for 'free virus removal' software and run it.

Yeah, great idea! (no, it's an awful idea).

Answer 6

There's nothing in that e-mail that would be of use to a black hat, thus it's almost certainly legitimate. You've got something on your system that's either attempting to infect other systems or it's communicating with a known botnet command-and-control server and I would think the former scenario is far more likely.

Answer 7

The email seems legit. But it could have been written by someone who may have worked for an ISP or other tech companies previously. If you said the customer service is bad there, you probably won’t be able to call them to confirm if they sent that email or not.

At any rate, don’t click on any of the links in the email, and do follow the advice of the other people above about scanning your systems. Being cautious about it be a good idea, but I personally think that it is not legit.

Answer 8

Try calling your ISP to confirm. It looks suspicious just in the fact it's an unsolicited email without any personalisation or information about you which they should have if they're legitimately your ISP.

They wouldn't bother monitoring their customer's devices to track malware, that's not their job.

Answer 9

Can an ISP really detect this?

One comment regarding this question. It is possible an ISP got a complaint and is forwarding it to you as the subscriber.

I review my server log files for suspicious activity, like trying to access php admin. When I see it, I have a script that sends an email to the abuse department of the ISP based on the IP address. The email includes the relevant log entries based on the IP address. I ask the ISP control their customer, and ask them to stop trying to break into my machines.

In this case the ISP is not monitoring your connection or MitM'ing your sessions. They are simply reacting to a complaint.

Answer 10

Maybe. But Don't click that link!

Sure. The folks here have ground through the details and everything seems legit.

But that would also be true of any competent phish. We have gotten spoiled, seeing incompetent phishes so often. But speaking of that, note the email's salutation -- Where is OP's proper name, which the ISP should certainly know? As for the account number you XXX'd, that looks like something derivable from the email address.

A big part of people's confidence is not seeing a payload. The displayed URL matches the hover/click URL here on StackExchange's cut-pasted copy, because StackExchange saw a plain text URL and made it hot.

I for one have no confidence in a scanner that declares a list of URLs safe; how would it know? It can't detect a cracker merely knowing a site's password. Its mechanism for knowing is sure to have some delay. If I hacked a website, I would not make any apparent changes until I was ready to blast the email.

I'll go one step further. Analyzing an email to this degree isn't worthwhile, because it doesn't "scale". You can't afford this scrutiny for every email.

Do contact your ISP - through independent channels

Do not use any contact information found in the email. Use contact info you arrive at independently, e.g. Off their legit website.

The letter might be true - is fairly likely true - and you do need to followup. The ISP can tell you either a) whether it's legit, or b) what measures to take prophylactically (as a precaution) in case it's legit.

Dont forget IoT devices

That could be anything from a child's toy to a smart switch to an IP camera. A great many of them actually have a mini Unix system onboard, with standard IP sIf they are capable of getting on Wifi, they can be hacked and do malicious things on the Internet (as a side activity to their normal tasks).