14

My modem automatically changes its DNS server from Norton DNS server to AdClick server. How do I prevent this from happen again? Is it possible to have protection from these for modem? How do I check if any of my devices caused this problem?

Modem I've used: TP-LINK TD-W8901G (Model V3.1)


Detailed version of my problem:

This happened months ago, at first, MBAM told me that I have been infected by Trojan.DNSChanger in the registry data. At first, I thought it was a joke, since the registry data stores variables as string, hex, number, etc. But when I run a check again, it came back. I searched about it, and found many results about it, most told the user to reset their modem to fix the problem.

So I have reset my modem, re-setting up it, and few weeks later, it came back. This time I did research about it. The primary DNS is: 37.48.127.131, secondary DNS is 8.8.8.8, which is Google DNS server. The primary DNS server looks compromised, so I've checked where it was located, it was located in Europe, and looks like one of those AdClick servers, cause my phone doesn't have any ad-blocker, and it redirects me to their website.

This time, I deep-cleaned my computer, using Hitman Pro, MBAM, ESET, AdwCleaner. And setup my DNS server to Norton DNS server. This was going for months, and came back again, somehow this virus is able to guess my very-long password and edit the DNS server IP. I scanned my computer again, reset my modem, set DNS server to Norton DNS server.

After few months (now), it came back again, this time my other computers were infected, Same ad-redirection again. I still have no idea how it gets in the setting page, and edits the DNS server IP. I tried to change DNS server without removing, but I was unable to change it, every time I saved it, it will change back to the AdClick DNS server (now showing 5.104.175.151 as primary DNS). I am running a check for my main computer right now [it has low CPU speed, now still scanning].

21

UPDATE

Your device (W8901G) is in all likelihood VULNERABLE, to the very exploit described below, and more, and even more. I think that the steps suggested below may ameliorate your situation, but unless a firmware fix is available from TP-Link, you should consider replacing your router.

The TP-Link search form did not supply any link (W8901G is end-of-life, but even activating EOL listing I only got the W8901N model), or perhaps I wasn't able to have it working properly, but since their pages have the product code as name, I tried entering it directly and found this:

http://www.tp-link.com/lk/download/TD-W8901G.html

This seems the most recent page, and as you can see, the firmware release is earlier than some of the exploits above. It is therefore likely that this firmware upgrade, while fixing some vulnerabilities, may not fix all of them. Also, it is only for V6 hardware; if you have an earlier revision, applying the patch might well brick your router.

Unfortunately, your router also seems not to support DD-WRT, which is a way (not for the faint of heart, in my opinion) of breathing new life into an older router, or squeezing more performances that the original manufacturer allowed - or even believed possible.

So I'm afraid that the easiest way out is purchasing a new router (after checking it out in the vulnerabilities database... just in case).

OLD ANSWER

Some modem-routers have vulnerabilities that allows for unauthenticated access from either the inside or the outside of the network.

So you can be tricked by an Internet page which is able to successfully mount a script attack and have you access, say,

http://192.168.1.1/cgi-bin/adm.cgi?cmd=DNSUpdate&ip1=5.104.175.151...

Your modem "sees" the connection coming from your computer, which is not exactly infected even if it's reading a hostile webpage, accepts it and - bang.

Also, your modem might expose a remote control page, or vulnerability, which allows anyone from the outside to update its values.

What I would do is,

  • UPDATE the modem firmware to the latest compatible version,
  • VERIFY that there are no up-standing known vulnerabilities (a Google search for "MYMODEL MYBRAND vulnerability" is often enough)
  • TEST accessing your own IP from the outside using a different network (a smartphone, for example, not connected to your home wireless) and see what happens (hopefully, nothing). Even a "Not Found" page is BAD NEWS because it means that the modem is listening. It's not obeying your malformed command, yes, but there's no guarantee it can't obey a properly formatted exploit as long as it is able to listen. A deaf modem would be way more secure.
  • DISABLE any remote control capability on the modem. On some models you can not do so explicitly, but you can instruct the modem to redirect all incoming requests to a DMZ host of, say, 192.168.1.254 -- of course you must be sure there are no IPs allocated there; better if it's outside the DHCP address pool altogether. This way, any incoming administrative connections will be rerouted to nowhere-land.
  • CHANGE the IP address range of your modem from the default (often 192.168.1.1 or 192.168.0.1 or 192.168.2.1) to something like 192.168.219.137, and your network to 192.168.219.0/24. This will ensure that any "simple" reflection attack will fail; at the very least the attacker will need to send some 60,000 attempts for a blind attack to succeed.

  • Also: you can instruct your PCs to not ask DNS information to the router, and instead rely on a fixed address you'll enter manually (e.g. the classic Google DNS 8.8.8.8). It is not a complete defense against everything that could be done through a compromised modem-router, but it does protect against simple DNS+DHCP hijack.

What's the worst it could happen?

TL;DR It would be bad" (i.e.: fly, you fools!).

In the general case, with a compromised router of sufficient power you can basically no longer trust anything coming from the network. This includes, for example, any apparently legitimate software update package. Not all software companies employ strong cryptographic verification of their packages.

In a recent news, a company calling themselves the Hacking Team resorted to installing rootkits on targeted computers by temporarily recruiting the ISP's assistance and, among other things, let people download "Flash security upgrades" that were anything but (although - given the abysmal Flash security record - it could be argued that a bona fide malware was indeed coming up in the world).

At that point they achieved what whoever hacked a sufficiently powerful router could also achieve: total communication control and the possibility of gaining the complete control of the machine beyond, given that at some point either the machine itself would willingly start, or its user could be enticed into, downloading and executing code coming from the network -- i.e., from the attackers.

Another very real possibility is to install keylogger and navigation hijacking/monitoring software. Consider one of the possible scenarios:

  • I am now your DNS's daddy.
  • Every site you want to connect to, you first willingly tell its name to me.
  • Your PC's firewall will more than certainly trust any DNS query.

So now I (aka your friendly if a bit dishonest new DNS) get asked for

  • Q. DNS-QUERY IP_ADDRESS_OF customers.vulnerable-banking.org

I now send you a fake IP address. I could try to set up a Man-In-The-Middle attack (and if I have gained access to your browser's key storage, it would probably succeed, because I am now also your Root Certificate Authority). But I don't need to.

The new IP address is a machine that simply redirects you to the real address via HTTP redirect, but now I have been able to legitimately send "you" some information that I could not via DNS. One of the cookie requests is actually a command to the keylogger to start operating.

And in the next few minutes some other DNS queries come along, and they are not intercepted, sent by the keylogger:

  • Q. DNS-QUERY IP_ADDRESS_OF KeyUp.keylogger.pwn
  • A. KeyUp.keylogger.pwn has address 127.0.0.1
  • Q. DNS-QUERY IP_ADDRESS_OF field.user.content.wuijang.keylogger.pwn
  • A. field.user.content.wuijang.keylogger.pwn has address 127.0.0.1
  • Q. DNS-QUERY IP_ADDRESS_OF field.pass.content.thisismypassword.keylogger.pwn
  • A. field.pass.content.thisismypassword.keylogger.pwn has address 127.0.0.2

...and now what was "only" a DNS server also happens to know that when connecting to customers.vulnerable-banking.org, a certain username/password pair is sent.

Not too long afterwards, your banking account is mysteriously transferred to Elbonia.

In your specific case the router is not so powerful, which means that the above disastrous scenario is still possible but requires a bit more subtlety, and most attackers wouldn't bother developing a sophisticated enough attack. Which means that you would notice anomalies and would cotton to the fact your router was compromised (as, indeed, happened). You would probably notice errors in software packages upgrades, or fishy and sloppy pieces of crap trying to pass for software patches.

Unless you were roaring drunk, you would never fall for it.

I don't feel this is enough to feel safe. Having the equivalent of a spyhole embedded in my router, allowing who-knows-who to reroute my traffic as soon as it catches his fancy, would creep me out of my mind. Also, I might someday want to get roaring drunk, and once is all that would be needed.

What if I never do anything 'meaningful' from my home network?

Your network may not contain any sensitive information (frankly, it would be a first), and never be used for anything meaningful for the "real life" "out there". No Amazon purchases, no eBay, Paypal, maybe Craigslist, no home banking and no email checking. No Facebook or Twitter (would you believe there's a market for FB/TW stolen credentials?)

Even so, the network could be, and sooner or later will be, used as a relaunch point - imagine being able to say, "Send one million copies of this spam" and one thousand compromised networks launch one massively parallel spam run, one thousand copies each. Lots of spammers would gladly pay good money to be able to do that, and so lots of crackers are actively looking for ways to sell them this capability - which translates into being able to acquire it illicitly. They need victims. Don't be one.

Also, from a legal point of view, whatever illicit operation your router does (not spamming, no, but maybe bruteforcing a bank account of someone else?) could bring the Law's attention to your door. Even if you were able to readily explain what happened (it depends on their technical savvyness), and they were disposed to listening (I saw it happen. Every now and then), that's your precious and irreplaceable time going down the drain.

Router suggestion

I don't like this kind of suggestions because I don't know where you live or who you're getting connection from (sometimes it's best to get your ISP's recommended brand as it's the one that will work best). Also I wouldn't want the responsibility :-)

However, a nice router I've been recommended is the Buffalo AirStation WBMR-HP-G300H; not new (it first came up on Amazon in 2011) but sturdy, easy to configure, enthusiastically hacked (and patched), and if the worst comes to the worst, it does support DD-WRT. I myself own a patched D-Link that I ensured is not reachable from the outside (I am on copper Ethernet though, no WiFi).

  • I'm using TP-Link TD-W8901G, for TEST, is it i replace 192... to my current IP seen on other web? for disable, what is the name of the setting? for change, my modem doesn't change it after I press save – wuiyang Jul 31 '15 at 13:51
  • @wuiyang Yes, you need to attempt access from the modem's external IP address, not the internal 192.x.x.x address. The latter won't even work on an external network (or will take you to a device on that network, not yours). – Matthew Read Jul 31 '15 at 14:33
  • I am sorry, but TD-W8901G appears to be bad news. See updated answer. – LSerni Jul 31 '15 at 14:55
  • 2
    "applying the patch might well brick your router." - Seems like that would be the preferred outcome, security-wise – Hagen von Eitzen Jul 31 '15 at 15:53
  • 1
    @wuiyang I recommend a chainsaw followed by gas. Make sure you do it in a well ventilated room or outside. – WernerCD Jul 31 '15 at 16:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.