10

Firefox started loading urls with a huge delay despite having a fast plan (70 MBit download)

Also in status line at the window bottom it sometimes prints waiting for 192.168.101.1:8888

My laptop is connected via WiFi with no dns-nameservers configured in /etc/network/interfaces and my router has wired connection to the ISP.

Who does that IP address belong to? Why does my browser wait for that strange address?

UPDATE:

~ > ifconfig
eth0      Link encap:Ethernet  HWaddr e0:db:55:d9:75:56  
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:51841 errors:0 dropped:0 overruns:0 frame:0
          TX packets:51841 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:2886606 (2.8 MB)  TX bytes:2886606 (2.8 MB)

wlan0     Link encap:Ethernet  HWaddr 60:36:dd:5b:45:58  
          inet addr:192.168.1.64  Bcast:192.168.1.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:135266 errors:0 dropped:0 overruns:0 frame:0
          TX packets:125324 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:125014077 (125.0 MB)  TX bytes:21390135 (21.3 MB)

UPDATE2:

I've conclude that my laptop was hacked.

Here what shows in the conection telnet 192.168.101.1 8888 the command GET / HTTP1.1

Look at <LI><A HREF="data_durablis/">data_durablis/</A>. I created that folder by myself, thus these links to my root dir folders, not typical linux install folders.

<HTML>
<HEAD>
<TITLE>Directory /</TITLE>
<BASE HREF="file:/">
</HEAD>
<BODY>
<H1>Directory listing of /</H1>
<UL>
<LI><A HREF="./">./</A>
<LI><A HREF="../">../</A>
<LI><A HREF=".rpmdb/">.rpmdb/</A>
<LI><A HREF="0">0</A>
<LI><A HREF="bin/">bin/</A>
<LI><A HREF="boot/">boot/</A>
<LI><A HREF="cdrom/">cdrom/</A>
<LI><A HREF="core">core</A>
<LI><A HREF="data/">data/</A>
<LI><A HREF="data_durablis/">data_durablis/</A>
<LI><A HREF="dev/">dev/</A>
<LI><A HREF="etc/">etc/</A>
<LI><A HREF="home/">home/</A>
<LI><A HREF="initrd.img">initrd.img</A>
<LI><A HREF="initrd.img.old">initrd.img.old</A>
<LI><A HREF="lib/">lib/</A>
<LI><A HREF="lib32/">lib32/</A>
<LI><A HREF="lib64/">lib64/</A>
<LI><A HREF="libnss3.so">libnss3.so</A>
<LI><A HREF="lost%2Bfound/">lost+found/</A>
<LI><A HREF="media/">media/</A>
<LI><A HREF="mnt/">mnt/</A>
<LI><A HREF="opt/">opt/</A>
<LI><A HREF="proc/">proc/</A>
<LI><A HREF="root/">root/</A>
<LI><A HREF="run/">run/</A>
<LI><A HREF="sbin/">sbin/</A>
<LI><A HREF="srv/">srv/</A>
<LI><A HREF="sys/">sys/</A>
<LI><A HREF="tmp/">tmp/</A>
<LI><A HREF="usr/">usr/</A>
<LI><A HREF="var/">var/</A>
<LI><A HREF="vmlinuz">vmlinuz</A>
<LI><A HREF="vmlinuz.old">vmlinuz.old</A>
</UL>
</BODY>
</HTML>
Can't connect to HTTP1.1:80 (Bad hostname)

LWP::Protocol::http::Socket: Bad hostname 'HTTP1.1' at /usr/share/perl5/LWP/Protocol/http.pm line 41.

and route

> route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref   Use Iface
default         192.168.1.254   0.0.0.0         UG    0      0       0 wlan0
192.168.1.0     *               255.255.255.0   U     9      0       0 wlan0

and traceroute

> traceroute 192.168.101.1
traceroute to 192.168.101.1 (192.168.101.1), 30 hops max, 60 byte packets
 1  192.168.1.254 (192.168.1.254)  7.812 ms  8.046 ms  8.306 ms
 2  10.134.0.1 (10.134.0.1)  12.951 ms  13.556 ms  13.567 ms
 3  10.254.246.49 (10.254.246.49)  15.881 ms  15.197 ms  16.198 ms
 4  * * *
 5  * * *
 6  * * *
 7  * * *
 8  * * *
 9  * * *
10  * * *
11  * * *
12  * * *
13  * * *
14  * * *
15  * * *
16  * * *
17  * * *
18  * * *
19  * * *
20  * * *
21  * * *
22  * * *
23  * * *
24  * * *
25  * * *
26  * * *
27  * * *
28  * * *
29  * * *
30  * * *

UPDATE3:

> cat clamscan,report3.txt 
> grep -v ": OK" clamscan,report2.txt | grep -v ": Empty file" | grep -v ": Can't read file ERROR" | grep -v ": Symbolic link" | grep -v "/proc/"
/usr/local/share/multisystem/EFI/BOOT/BOOTx64.EFI: Win.Trojan.Agent-1428496 FOUND
/home/user/Azureus Downloads/Kingpin - How One Hacker Took Over the Billion-Dollar Cybercrime Underground/Kingpin - How One Hacker Took Over.tgz: Html.Phishing.Bank-1305 FOUND
/home/user/.thunderbird/fbndhlgo.default/Mail/pop.mail-2.ru/Trash: Heuristics.Phishing.Email.SpoofedDomain FOUND
/home/user/Dropbox/books/программирование/Э. Хант, Д. Томас
/home/user/Dropbox/books/программирование/Kingpin - How One Hacker Took Over.epub: Html.Phishing.Bank-1305 FOUND
/home/home/user/.wine/drive_c/Games/Counter-Strike 1.6/hlds.exe: Win.Trojan.Agent-1276168 FOUND
/home/home/user/.wine/drive_c/Games/Counter-Strike 1.6/proxy.dll: Win.Trojan.Ramnit-7771 FOUND
/home/home/user/.wine/drive_c/Games/Counter-Strike 1.6/valve/cl_dlls/particleman.dll: Win.Trojan.Ramnit-6181 FOUND
/home/home/user/.wine/drive_c/Games/Counter-Strike 1.6/platform/AddOns/spades/Spades.dll: Win.Trojan.Ramnit-5848 FOUND
/home/home/user/.wine/drive_c/Games/Counter-Strike 1.6/platform/Friends/friendsUI.dll: Win.Trojan.Ramnit-7169 FOUND
/home/home/user/.thunderbird/fbndhlgo.default/Mail/pop.mail-2.ru/Trash: Heuristics.Phishing.Email.SpoofedDomain FOUND
  • That's a local IP. What's your computer's IP? Do you have a proxy or VPN set up? – TheWanderer Oct 2 '16 at 18:16
  • No for both VPN and a proxy. Updated the question with ifconfig output – zuba Oct 2 '16 at 18:20
  • What is the output of netstat | grep 192.168.101.1? – Terrance Oct 2 '16 at 19:00
  • After a dozen of minutes the command sent by telnet GET / HTTP/1.0 to 192.168.101.1 has returned a valid HTTP which while being opened in Firefox showed me my root partition with working links to the subdirectories which I can traverse like a charm. – zuba Oct 2 '16 at 19:04
  • Is my laptop hacked? – zuba Oct 2 '16 at 19:04
2
+25

192.168.101.1 is a private IP from RFC1918. Meaning it's not routable through the internet. No hacker (on the internet) can use it. With that said your ISP is using 10.134.0.1 & 10.254.246.49 inside their network which is also a private IP RFC1918. So your ISP is using a private IPs inside their network, thus they're the only ones that could route to 192.168.101.1

The http site that's hosted on 192.168.101.1 8888 is odd but are just a bunch of links to a typical linux install.

clamscan output just shows a bunch of windows viruses (from what i can tell)

So from what i can see, the most logical answer is your ISP has a fast (70 GBit???) connection to their LAN, but a slow pipe to outside Internet. To speed things up your ISP is running a proxy server and tunneling all http requests through 192.168.101.1:8888

  • Can also check this out lagado.com/proxy-test and their cache test – meccooll Oct 13 '16 at 4:09
  • The http site that's hosted on 192.168.101.1 8888 is odd but are just a bunch of links to a typical linux install. Nope, these are NOT just a bunch of links to the typical linux install. See <LI><A HREF="data_durablis/">data_durablis/</A> that is the link to real folder in my laptop filesystem. – zuba Oct 17 '16 at 9:23
  • 1
    That one is not typical. And you see that from telnet? What happens when you try to connect to say telnet 1.1.1.1 80 and if it connects issue GET / HTTP1.1? And to know for sure you can run wireshark and try connecting to google.com and see where 192.168.101.1 comes up – meccooll Oct 17 '16 at 17:01
  • Ok, I'll try to connect by telnet to telnet 1.1.1.1 80. But why such an odd 1.1.1.1 80 destination? I'll try wireshark – zuba Oct 18 '16 at 7:14
0

the clamav antivirus hits are all for windows viruses that won't effect windows. I am unaware of any viruses working in wine but i guess its possible, i am unaware of any viruses being able to jump from wine to linux but i guess it is possible even if its very very very hard indeed.

This looks to me like your service provider doesn't know what they are doing and have broken their proxy server or you have not configured your router to provide NAT properly.

The best advice at this stage would be to phone them and ask them to check your router settings and check their proxy server, sometimes its easier to just say you need to connect your mobile via wifi not a linux computer, some ISP's get scared of linux.

-2

Ever heard of Nginx? That's a GPSV [General Purpose Security Vulnerability] in the form of an on-line http server that anybody can connect to, brought to you by the makers of your favorite browser but also thoughtfully included (without your permission, naturally,)in the CUPS distribution [Common Unix Print Spooler] that runs dutifully and apparently cannot be disabled even when running on laptops that never had and never will have a printer.

My suggestion is to run FreeBSD in a gateway machine with dual NICs, one connected to the Internet and the other connected to your internal ethernet using the Berkeley Packet Filter [ ipfw ] application to stop the intruders. Be aware that most Mozilla browsers will choke because they will not stop waiting for replies that never come. While everyone was sleeping, advertisers stole the Internet. It will take a bit of wrestling and inconvenience to take it back from them.

Uninstall the Nginx package and make certain it remains uninstalled and that should solve your problem.

  • Thank you! Can you suggest any reading on the subject? – zuba Oct 2 '16 at 21:02
  • 1
    I'm not sure how you come to this conclusion? Nginx and CUPS have nothing to do with Firefox in a default installation (and most systems are not running nginx). It would also have shown in the netstat the user ran. – Thomas Ward Oct 4 '16 at 12:29
  • this answer is totally irrelvant ranting – Amias Oct 16 '16 at 10:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.