1

I'm using a TP-LINK TD-8817 ADSL home router with a customized firmware from my ISP. When using the modem in router mode, I often redirected to a specific link owned by ISP. This is interesting because I never have this problem in my old router. So I used tftp to retrieve router firmware (a file called ras). Then I used binwalk to extract LZMA compressed data from that file. Looks like this ADSL home router use ZynOS. Then I searched for interesting strings.

I was surprised when I found several spelling mistakes, for example:

00301380  3e 3c 62 6f 64 79 3e 00  74 65 78 74 2f 68 74 6d  |><body>.text/htm|
00301390  6c 00 00 00 48 54 54 50  2f 31 2e 31 00 00 00 00  |l...HTTP/1.1....|
003013a0  20 33 30 32 20 4d 6f 76  65 64 20 54 65 6d 70 6f  | 302 Moved Tempo|
003013b0  72 61 72 69 6c 79 00 00  4c 6f 63 61 74 69 6f 6e  |rarily..Location|
003013c0  3a 20 00 00 43 6f 6e 6e  65 63 74 69 6f 6e 3a 20  |: ..Connection: |
003013d0  00 00 00 00 4b 65 65 70  2d 41 6c 69 76 65 00 00  |....Keep-Alive..|
003013e0  43 6f 6e 74 65 6e 74 2d  54 79 70 65 3a 20 00 00  |Content-Type: ..|
003013f0  43 61 63 68 65 2d 43 6f  6e 74 72 6f 6c 3a 20 70  |Cache-Control: p|
00301400  72 69 76 61 74 65 0d 0a  00 00 00 00 54 68 65 20  |rivate......The |
00301410  64 6f 75 63 6d 65 6e 74  20 68 61 73 20 6d 6f 76  |doucment has mov|
00301420  65 64 20 3c 61 20 68 72  65 66 3d 22 00 00 00 00  |ed <a href="....|
00301430  22 3e 68 65 72 65 3c 2f  61 3e 3c 2f 62 6f 64 79  |">here</a></body|
00301440  3e 3c 2f 68 74 6d 6c 3e  00 00 00 00 6d 75 6c 74  |></html>....mult|

The word doucment should be document. It raises my suspicion to find such mistake in a router produced by big company.

Worried about this, I tried to flash this router using its default firmware. But I get the following error:

newFlashSupportFlag = 1
new FW version is 0
new flash can not support old firmware

The box shows that the version for this router is 2.1 and sys ver output is:

RAS version: 3.0.1 Build 110402 Rel. 02846
System   ID: $2.12.35.0(UE9.C39)3.11.2.175 20110402_V005 [Apr 02 2011 14:11:13]

I'm unable to flash this router (to use default firmware) till now.

To avoid the redirection problem, I use this router as modem (by using bridge mode). I just feel that I often get suspicious packets such as in Why there are uninvited incoming packets to my ADSL connection?.

It maybe just me being too paranoid, but is it possible that my router was hacked?

  • 2
    Never be surprised by poor quality code or typos in embedded firmware. The things I have seen make this look inconsequential. – Polynomial Dec 22 '13 at 11:58
  • Drive-by reflashing or bricking of home WAP routers can be trivial, especially if one leaves the router password.set to the default value. Try swapping out the router (they're very cheap) and see if the problem remains. – user35648 Dec 22 '13 at 15:51
1

Probably not hacked, but your ISP seems to use some kind of DNS redirection to make some additional money (especially if you are beeing redirected when you type in a wrong adress or something like that).

You should be able to change the DNS the router uses, simply switch to a alternate DNS like OpenDNS (http://www.opendns.com/)

  • I've tried to use Google DNS (8.8.8.8 and 8.8.4.4). In the client, I've verified they are in use (by using nslookup command). The redirection still happened and they only occured for the first visit to a site (the subsequence request is normal). The redirection didn't happen if I use the modem in bridge mode. – David Bower Dec 22 '13 at 11:30
  • 2
    There are three potential reasons for that. The first is just that your system's DNS cache kept the old IP. The second is that the router firmware contains this mechanism as part of the ISP's branding. The third is that your ISP could be hijacking the DNS requests and modifying them on-the-fly, which would be super douchey, but sadly unsurprising. – Polynomial Dec 22 '13 at 11:57
  • I believe it is the second option (router firmware as part of ISP's branding). Thanks for the fact that this is unsurprising. From what I see in Wireshark, DNS request returned the correct IP. When HTTP request is sent, the returned HTTP response captured by Wireshark is 302 Moved Temporary (and the content contains The *doucment* has moved here). This, of course, is not a response from destination IP but possibly generated by router firmware. – David Bower Dec 22 '13 at 13:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.