cancel
Showing results for 
Search instead for 
Did you mean: 

Possible Plusnet attack effecting my Internet connection?

AndyH
Grafter
Posts: 6,824
Thanks: 1
Registered: ‎27-10-2012

Re: Possible Plusnet attack effecting my Internet connection?

The rather worrying thing here is that TP-Link were told about this exploit months ago and appear to have done nothing.
frank34uk
Dabbler
Posts: 13
Registered: ‎10-03-2014

Re: Possible Plusnet attack effecting my Internet connection?

Update.
I have just updated the firmware on the router and BINGO, it`s working again!. Should the problem arise again though I will change the router.
Looked for DNS settings in router but could not find anywhere to input them? may have not looked hard enough.
Kelly
Hero
Posts: 5,497
Thanks: 380
Fixes: 9
Registered: ‎04-04-2007

Re: Possible Plusnet attack effecting my Internet connection?

The firmware update will have just reverted all the settings.  You'll need the attack to occur again to revert the dns server to the malicious one. 
Kelly Dorset
Ex-Broadband Service Manager
frank34uk
Dabbler
Posts: 13
Registered: ‎10-03-2014

Re: Possible Plusnet attack effecting my Internet connection?

Quote from: Kelly
The firmware update will have just reverted all the settings.  You'll need the attack to occur again to revert the dns server to the malicious one.  

Ok, I will sit and wait then. Gutted! lol. Bit worried now about passwords on PayPal...etc. Is it possible they could have been comprised then? I thought it was just a phishing attack with the DNS thing but I guess it`s far worse?
Kelly
Hero
Posts: 5,497
Thanks: 380
Fixes: 9
Registered: ‎04-04-2007

Re: Possible Plusnet attack effecting my Internet connection?

I would change them anyway.
If you've installed the "flash update" it could contain a key logger or anything!  Not with the risk not doing.
Kelly Dorset
Ex-Broadband Service Manager
frank34uk
Dabbler
Posts: 13
Registered: ‎10-03-2014

Re: Possible Plusnet attack effecting my Internet connection?

Going to buy a new router tomorrow and change all my passwords from a secure location. Thanks for all the help guys! appreciated  Cool
PitchBlack
Grafter
Posts: 301
Registered: ‎10-01-2014

Re: Possible Plusnet attack effecting my Internet connection?

Sorry to hijack this thread, but is it best to leave the Automatic from ISP box ticked, or should I untick it and enter the DNS manually.
This is what it says :
If your ISP provided you with a specific DNS address to use, enter the address in this window and click "Apply Changes" .
I have the option of Automatic from the ISP ticked on a Belkin router, so the boxes where you type the DNS are greyed out with a "0" in them, but reading this thread made me think I should enter it manually.
picbits
Rising Star
Posts: 3,432
Thanks: 23
Registered: ‎18-01-2013

Re: Possible Plusnet attack effecting my Internet connection?

I always change the DNS to the Google + OpenDNS anyway as I find many ISP's DNS servers to  be somewhat flaky at times.
picbits
Rising Star
Posts: 3,432
Thanks: 23
Registered: ‎18-01-2013

Re: Possible Plusnet attack effecting my Internet connection?

P.s. I doubt your Belkin router would be compromised and by the look of this exploit it wouldn't make a difference if you had automatic or manual DNS assigned.
PitchBlack
Grafter
Posts: 301
Registered: ‎10-01-2014

Re: Possible Plusnet attack effecting my Internet connection?

Thanks for the reply Dom S,  I will try and educate myself on DNS.
Domain Name Service, Domain Name System, DNS server, DNS Address. I think I will leave it on AUTO  Wink
Laser
Grafter
Posts: 206
Registered: ‎23-09-2007

Re: Possible Plusnet attack effecting my Internet connection?

I've had this problem too. Sad    TP-Link 8840T V3. Same "GoDaddy" DNS, plus Google DNS.
Having seen the recently published attack which requires the user to have been configuring the router in the same browser session as the attack, I had hoped I would have avoided it. My router is not on the default address and, of course, I have changed the password. So much for that.
I've now reset the router to defaults, re-arranged my network to not use the TP-Link for DNS, and limited the configuration access to LAN. (Managed to lock myself out completely at one point, requiring yet another reset. Ahem.  Embarrassed ) We shall see whether the DNS addresses change again over the next couple of days.
What is more worrying is how long it may have been like this and what information, if anything, they have obtained. No point in running round changing passwords if the problem is still present.