1

I have an ASUS RT-AC66U router, and I'm not the most tech-savvy individual. Earlier today, the router login prompt appeared in my browser, even though I hadn't gone to 192.168.1.1. I was nervous about it, so I installed the latest firmware update from the router web app (not ASUS's website), then decided to reset to factory and change all the passwords. To the best of my knowledge, all of the vulnerable ASUS settings are disabled. F-Secure's Router Check gave me a "clear" report before and after the firmware update.

A few hours later, while in the System Log, I noticed the Active Connections tab has some unusual destinations. I attempted to plug some of these into Google, assuming they would show the websites I had visited. When that didn't work (I was mostly getting IP lookup results), I began plugging the addresses into VirusTotal after noticing it appearing in my search results. I noticed one in particular was showing server names advertising porn websites in the WHOIS lookup.

My DNS servers appear to be legitimate Charter servers, and at some point in this process I changed them to Google's DNS servers. I rarely go to websites I'm not familiar with, so I can't understand why these connections would be showing up. I'm somewhat concerned about the firmware update, since ASUS's servers aren't HTTPS. I've also never poked around in Active Connections before, so I have no clue if it's typical for these sorts of things to show up.

Any help here would be sincerely appreciated! For whatever reason, I'm extremely nervous about my router being compromised. I do have an Apple Airport Express that I haven't set up as a router, and I'm tempted to switch to that as opposed to the AC66U.

A small update...

I've turned my Wi-Fi off and on a few times to clear the Active Connections. It never clears fully (I'm not sure if it should?), and there are more connections than I have websites open (11 to 4). Strange IP addresses are still showing up (mostly as TIME_WAIT, though some as ESTABLISHED), though not necessarily the same ones each time.

Rebooting the router clears the Active Connections almost entirely. Briefly there were 4 established connections to 4 tabs open (though I'm not certain if they matched). I ran one IP (104.16.13.13, which I believe is stackexchange's) through VirusTotal, and immediately, several new ESTABLISHED connections showed in the Activity Log. They appear to be dropping off as time passes, but there are still 6 connections to 4 websites open.

  • A single tab in your browser can open multiple TCP connections, try to deactivate Javascript if you feel paranoid about it. Without further information, I'd say it's just ads on the websites you're going to. – Dillinur Apr 28 '15 at 7:56
  • Do I have to worry about those connections, though? Even if they are just ads? I'm worried about something being downloaded onto my computer, and I don't understand these connections well enough to know if that's a valid concern. Also, what sort of further information would you be looking for? I would be happy to provide. – Jean Apr 28 '15 at 7:59
  • Well, my gut feeling would be no, but it's hard to tell. Your router might be corrupted (highly unlikely), your computer might be corrupted (possible?), or you're just looking at totally normal traffic (most likely). You could try to find a neat example of "one website & multiple connections" and post IPs & URL if you want to dig deeper for curiosity purpose (beware of privacy concerns, please don't post anything too fancy/exotic!) – Dillinur Apr 28 '15 at 8:12
  • I'm pretty certain my computer's not corrupted. The hard drive was recently replaced, and my browsing habits are pretty boring! I'm also having trouble finding instances of one website with multiple connections, though I am finding connections that I'm not sure where they're from (74.125.225.1, for instance). I'm also now somewhat concerned about entering all of these IPs into VirusTotal to try and figure out where they lead, ha. Maybe I should just let it be tonight. – Jean Apr 28 '15 at 8:23
  • 2
    <Organization: Google Inc.> You're most likely looking at Google Analytics traffic or something equivalent. – Dillinur Apr 28 '15 at 8:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.