7

Just found out that the primary & secondary DNS servers have been changed to 95.211.156.101 & 5.45.75.11.

I had the following setup in place.

  • MAC filtering and WPA2 for WiFi.
  • Administrator password was left at default. (Suspect this was the loophole exploited. Clickjacking I bet?)
  • NAT & IPv4
  • All the Services were turned off for WAN side, including ICMP.
  • Only HTTP interface was turned-on for LAN side.
  • Two other windows laptops connect to the modem via WiFi. Used by old parents and kids. Probably the easiest targets. Scanned for virus/trojan. Nothing found.

Would be helpful to know the steps I should take to lock down the network from being compromised again. Also, what kind of data leak could have took place, besides the DNS names ? Are these IPs known to anyone ?

EDIT :

Modem : DSL-2750U

Firmware version : IN_1.10

  • 1
    It might help to state the DSL modem brand, model and firmware version you are using as there may be some known vulnerabilities. – Neil Robertson Dec 14 '13 at 12:25
  • added the modem brand and firmware. – saleem Dec 24 '13 at 10:38
3

Many DSL modems are open from the WAN side for use by the telecompanies (you can try telneting from the wan side and see if it's open on your modem, try default username/passwors [1]), while it could have been the ISP that changed the DNS-servers it seems unlikely as the IPs are not in the same range.

Like you said, the most likely intrusion vector is a simple cross site scripting attack. To guard against XSS is generally hard, usually there is not much a user can do other than keep the browser updated. Changing the password will of course fend off the majority of such attacks but still leaves you vulnerable while logged in to the modem.

Worst case scenario (probably(?) low likelihood) would be a change of the modem firmware, there would have been a downtime of a few minutes as the modem restarts. What you would be left with in terms of data leakage is anyones guess but the theoretical worst case would be a compromising of all network traffic that's not end to end encrypted with endpoint authentication (like SSL).

The change in DNS-servers in itself would have leaked all non cached domain name requests to the third party with the potential of the DNS owner to provid false DNS results. (Say for example giving the IP of fakebank.com when you requested the IP of mybank.com, or just giving you a the right site but with extra ads). This is a more likely scenario.

[1] http://internetcensus2012.bitbucket.org/paper.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.