{"action":"created","issue":{"url":"https://api.github.com/repos/Jackysi/advancedtomato/issues/255","repository_url":"https://api.github.com/repos/Jackysi/advancedtomato","labels_url":"https://api.github.com/repos/Jackysi/advancedtomato/issues/255/labels{/name}","comments_url":"https://api.github.com/repos/Jackysi/advancedtomato/issues/255/comments","events_url":"https://api.github.com/repos/Jackysi/advancedtomato/issues/255/events","html_url":"https://github.com/Jackysi/advancedtomato/issues/255","id":188986407,"number":255,"title":"Spam relay hidden inside AdvancedTomato ?","user":{"login":"Spheerys","id":2228364,"avatar_url":"https://avatars.githubusercontent.com/u/2228364?v=3","gravatar_id":"","url":"https://api.github.com/users/Spheerys","html_url":"https://github.com/Spheerys","followers_url":"https://api.github.com/users/Spheerys/followers","following_url":"https://api.github.com/users/Spheerys/following{/other_user}","gists_url":"https://api.github.com/users/Spheerys/gists{/gist_id}","starred_url":"https://api.github.com/users/Spheerys/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Spheerys/subscriptions","organizations_url":"https://api.github.com/users/Spheerys/orgs","repos_url":"https://api.github.com/users/Spheerys/repos","events_url":"https://api.github.com/users/Spheerys/events{/privacy}","received_events_url":"https://api.github.com/users/Spheerys/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":7,"created_at":"2016-11-13T18:44:08Z","updated_at":"2016-11-14T21:08:21Z","closed_at":null,"body":"Hi !\r\n\r\nI'm faced to a very strange issue.\r\n\r\nI have a NETGEAR WNR3500Lv2 device, and since several months I had switched from TomatoUSB Shibby to AdvancedTomato\r\n\r\nLast week, I have installed a [Pi-Hole](https://pi-hole.net/) on a rasberry Pi to remove all ads on my network/\r\nOnce pi-hole installed, I have checked the DNS resolutions of all my devices on the pi-hole GUI, by curiosity.\r\n(Pi-hole is working very well :) )\r\n\r\nThat is at this moment that I have found those kind of suspicious DNS resolutions, in addition of all legitimes DNS resolutions. \r\nHave a look : \r\n\r\n```\r\nNov 13 18:40:49 dnsmasq[439]: query[AAAA] mx-ha02.web.de from 192.168.0.254\r\nNov 13 18:41:24 dnsmasq[439]: query[AAAA] smtp.rgv.rr.com from 192.168.0.254\r\nNov 13 18:41:45 dnsmasq[439]: query[A] smtp.sina.com from 192.168.0.254\r\nNov 13 18:42:21 dnsmasq[439]: query[AAAA] smtp.163.com from 192.168.0.254\r\nNov 13 18:42:45 dnsmasq[439]: query[AAAA] smtp.newmail.ru from 192.168.0.254\r\nNov 13 18:43:34 dnsmasq[439]: query[AAAA] smtp.dodgeit.com from 192.168.0.254\r\nNov 13 18:43:57 dnsmasq[439]: query[AAAA] smtp.tiscali.it from 192.168.0.254\r\nNov 13 18:44:27 dnsmasq[439]: query[AAAA] mail.tin.it from 192.168.0.254\r\nNov 13 18:44:54 dnsmasq[439]: query[AAAA] smtp.rapidmobiles.co.uk from 192.168.0.254\r\nNov 13 18:45:37 dnsmasq[439]: query[AAAA] mail.oldskool.ru from 192.168.0.254\r\nNov 13 18:46:27 dnsmasq[439]: query[AAAA] smtp.buziaczek.pl from 192.168.0.254\r\nNov 13 18:46:49 dnsmasq[439]: query[AAAA] mxs.mail.ru from 192.168.0.254\r\nNov 13 18:47:43 dnsmasq[439]: query[AAAA] dnvrco-pub-iedge-vip.email.rr.com from 192.168.0.254\r\nNov 13 18:48:28 dnsmasq[439]: query[AAAA] smtp.rochester.rr.com from 192.168.0.254\r\nNov 13 18:48:59 dnsmasq[439]: query[AAAA] securesmtp.t-online.de from 192.168.0.254\r\nNov 13 18:49:20 dnsmasq[439]: query[AAAA] smtp.onet.pl from 192.168.0.254\r\nNov 13 18:49:41 dnsmasq[439]: query[AAAA] smtp.op.pl from 192.168.0.254\r\nNov 13 18:49:47 dnsmasq[439]: query[AAAA] ncfgraphics.com from 192.168.0.254\r\nNov 13 18:49:48 dnsmasq[439]: query[A] ncfgraphics.com from 192.168.0.254\r\nNov 13 18:50:07 dnsmasq[439]: query[AAAA] smtp.pochta.ru from 192.168.0.254\r\nNov 13 18:50:39 dnsmasq[439]: query[AAAA] pop.o2.pl from 192.168.0.254\r\nNov 13 18:51:12 dnsmasq[439]: query[AAAA] smtp.spoko.pl from 192.168.0.254\r\nNov 13 18:51:53 dnsmasq[439]: query[AAAA] smtp.vp.pl from 192.168.0.254\r\nNov 13 18:53:45 dnsmasq[439]: query[AAAA] smtp.tiscali.co.uk from 192.168.0.254\r\nNov 13 18:54:24 dnsmasq[439]: query[AAAA] smtp.pochta.ru from 192.168.0.254\r\nNov 13 18:55:00 dnsmasq[439]: query[AAAA] smtp.163.com from 192.168.0.254\r\nNov 13 18:56:15 dnsmasq[439]: query[AAAA] mx.autorambler.ru from 192.168.0.254\r\nNov 13 18:57:44 dnsmasq[439]: query[AAAA] smtp.parkmail.dk from 192.168.0.254\r\n```\r\nMy Router Netgear as the IP 192.168.0.254\r\nI have shutdowned all devices on my network except the pi-hole and after one minute, the suspicious DNS resolutions were continuing.\r\n\r\nSo I decide also to switch off my router. \r\nAfter 30 minutes, no more suspicious DNS resolutions appears on my pi-hole (in fact, none at all ^^ )!\r\n\r\nAfter a restart of the router, the suspicious DNS resolutions comes back !\r\n\r\nI say to myself : \"oh sh****, my device was hacked !\"\r\nI ran an old version of AdvancedTomato (Netgear-3500Lv2-K26USB-1.28.AT-RT-N5x--3.0-132-AIO)\r\nSo I have installed the very last version : Netgear-3500Lv2-K26USB-1.28.AT-RT-N5x--3.3-138-AIO\r\nI have checked the MD5, of course, before flashing, and it was correct.\r\n\r\nBut after upgrade, the suspicious DNS resolutions were still there !\r\n\r\nIt's looking my device was transformed to a smtp relay for spam !\r\n\r\nSo my questions are : \r\n- How can it be possible ? \r\n- Is someone can reproduce this ?\r\n- If not, what did I miss ?"},"comment":{"url":"https://api.github.com/repos/Jackysi/advancedtomato/issues/comments/260463013","html_url":"https://github.com/Jackysi/advancedtomato/issues/255#issuecomment-260463013","issue_url":"https://api.github.com/repos/Jackysi/advancedtomato/issues/255","id":260463013,"user":{"login":"Spheerys","id":2228364,"avatar_url":"https://avatars.githubusercontent.com/u/2228364?v=3","gravatar_id":"","url":"https://api.github.com/users/Spheerys","html_url":"https://github.com/Spheerys","followers_url":"https://api.github.com/users/Spheerys/followers","following_url":"https://api.github.com/users/Spheerys/following{/other_user}","gists_url":"https://api.github.com/users/Spheerys/gists{/gist_id}","starred_url":"https://api.github.com/users/Spheerys/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Spheerys/subscriptions","organizations_url":"https://api.github.com/users/Spheerys/orgs","repos_url":"https://api.github.com/users/Spheerys/repos","events_url":"https://api.github.com/users/Spheerys/events{/privacy}","received_events_url":"https://api.github.com/users/Spheerys/received_events","type":"User","site_admin":false},"created_at":"2016-11-14T21:08:21Z","updated_at":"2016-11-14T21:08:21Z","body":"After desactivated \"Remote Access\" and \"Remote Forwarding\" and restarted the router, a netstat -a is more appreciable : \r\n```\r\n# netstat -a\r\nActive Internet connections (servers and established)\r\nProto Recv-Q Send-Q Local Address           Foreign Address         State       \r\ntcp        0      0 tomato:www              0.0.0.0:*               LISTEN      \r\ntcp        0      0 0.0.0.0:domain          0.0.0.0:*               LISTEN      \r\ntcp        0      0 0.0.0.0:ssh             0.0.0.0:*               LISTEN      \r\ntcp        0      0 tomato:ssh              192.168.0.3:57334       ESTABLISHED \r\ntcp        0      0 :::domain               :::*                    LISTEN      \r\ntcp        0      0 :::ssh                  :::*                    LISTEN      \r\nudp        0      0 localhost:38032         0.0.0.0:*                           \r\nudp        0      0 localhost:38032         0.0.0.0:*                           \r\nudp        0      0 0.0.0.0:domain          0.0.0.0:*                           \r\nudp        0      0 0.0.0.0:bootps          0.0.0.0:*                           \r\nudp        0      0 0.0.0.0:38000           0.0.0.0:*                           \r\nudp        0      0 0.0.0.0:38000           0.0.0.0:*                           \r\nudp        0      0 :::domain               :::*                                \r\nraw        0      0 0.0.0.0:255             0.0.0.0:*               255         \r\nActive UNIX domain sockets (servers and established)\r\nProto RefCnt Flags       Type       State         I-Node Path\r\nunix  2      [ ]         DGRAM                      2191 \r\n\r\n```\r\n\r\nSo I suppose my mistake comes from this remote access... I'm very confused :S \r\nMy pihole don't record any suspicious DNS request... so it's looking good...\r\nI will re-flash my firmware, just in case..."}}
{"actor":{"display_login":"Spheerys"}}