4

I don't know if this is the correct forum where to ask, but I didn't find anything more appropriate.

I have a TP-Link router model TD-W8951ND, and three months ago I noticed that the network was getting slower each day. I then looked at the router settings, after various reboots and i noticed it had been changed, to a service that resolves to "GhostNet GmbH".

After several PC restores, cache wipes and other sort of things, that think kept occurring. I then looked in a forum that was the ROM-0 problem, in fact every router with the ZynOS operating system, have the top page /rom-0 that can be accessed without authentication and contains the router full configuration. So, the hackers were able to get my router password from that file, and change the DNS through Telnet.

So I blocked incoming connections over telnet and HTTP from remote, changed admin password and the problem was gone for a month. Now it occurred once again but this time the DNS resolves to Edis GmbH... Any help?

  • I actually traced the route to the address of the DNS and windows found it at the address 127.0.0.2... I can't understand what is going on – user82003 Jul 28 '15 at 12:59
0

That's likely caused by a classic Cross-Site Request Forgery attack from back in the day. See the image below that explains the attack. Some countermeasures:

  1. Change the default LAN network IPv4 range and make sure the router IP is NOT 192.168.0.1 or 192.168.1.1 - make it a seemingly random one, e.g. 192.168.X.21 or something of that sort (lol @ security by obscurity).
  2. Change your router to use an open source/third-party firmware - Tomato, OpenWRT or DD-WRT are all a great option.
  3. If you can't use a third party firmware, get an updated version from the router manufacturer.

enter image description here

The problem is not related to your router being remotely accessed from the Internet (via telnet or HTTP), it's a deflection via your own web browser.

  • Thanks for the answer, but atm i can't change the firmware... Could you suggest some good router brands/models? – user82003 Jul 28 '15 at 14:28
  • Btw, in fact by wiping the cache and probably removing that malicious javascript code, the problem won't repeat again for a longer period – user82003 Jul 28 '15 at 14:30
  • 1
    Why can't you change the firmware? Not even update the firmware to the latest version from TP-Link? – Wayne In Yak Jul 28 '15 at 16:13
  • I updated to the last firmware version from the manufacturer, but the problem is still there. I can access to /rom-0 locally at any time... – user82003 Jul 30 '15 at 7:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy