User Sells Out For $200/year.
You’ll need one of these before continuing to read. You’ve been warned.
Picture this ticket:
- User’s VPN loses connection every 90 seconds exactly.
- All the regular drivers/updates/reinstalls don’t work.
- Enterprise T3 support is as lost as we are.
- User has been having speed/throughput issues for months.
- Note: User has fiber @ 500+ Mbps connection. On VPN it would be <10Mbps.
- Note2: This is very unusual, even in full tunnel our VPN is typically only a 50% hit at higher fiber speeds.
- Relative of our user who also is WFH experienced disconnects (Cisco Anyconnect, different VPN).
Given all that, must be the ISP right? That’s where I ended up after hours of diagnosing but as Comcast techs come and go still the issue persists. Time for a deeper dive.
After a lunch break I dove back in back to notice a clue in the humble ipconfig /all results- see if you can spot it:
Everything on a technical level seems fine, lease time is pretty short but notice the DHCP server? It struck me as odd that a Comcast home router would self assign 10.0.0.32, every home network I’ve worked with was a x.x.x.1 address. Sure enough, 10.0.0.1 does exist as it responds to pings. Confirming that suspicion visiting 10.0.0.1 in the browser gives the router settings sign in page:
Unfortunately for me the credentials to the router had been reset and didn’t match the password on the rear of the router. Still, I got what I needed- we know there is a rogue device on the network handing out DHCP leases and acting as a gateway to the 10.0.0.1/24 subnet. Time to go on a (remote) adventure!
Some cable tracing, phone pictures sent over Teams, and walk through of the house later we found the culprit, to my horror:
The user was apprehensive to discuss the box with me at first, citing embarrassment but we’d invested too much time to drop it here so onward we pressed. Now a quick Google search leads you to find that Digital Reflection is “an internet ratings and research community dedicated to understanding how people use the internet in their homes” company. While discussing this find with the user they dropped a bombshell: “… they make me install a certificate on my devices …”
In plain English installing a certificate can facilitate traffic inspection, also know as a Man-in-the-middle attack. Quite the hair raising moment…
Turns out that the user has had this device on their home network for the past 7 years. For the last 7 years every website, online purchase, bank payment, social media post, porn habits, you name it has been snooped on. In return the user gets paid a few dollars a month, extra if you install that certificate on a new device.
Effectively this is user-sanctioned spyware, but it gets worse. Remember that certificate that gets installed to facilitate the snooping? Well it’s actually an executable lol:
And yes I did submit it to VirusTotal:
Notice the “Checks-user-input” -> likely a keylogger.
All your passwords -> thanks for sharing :D
At that point it’s just so much worse than just a certificate… it can do literally anything it wants on your computer. You are handing the keys to your life over to this company. In a crazy turn of events turns out that a friend of mine used to work for Digital Reflection. Here’s some quotes:
“They would change your IE proxy setting to route your traffic through their servers….they saw everything.”
“.. would build very accurate profiles on you, then sell that data to advertisers for a crap ton of money.”
Effectively these guys were the predecessors to Cambridge Analytic, Facebook, and the giants of today. Perfectly legal too because the user accepts those pesky terms and conditions! To top it all off the user had tons of shopping coupon extensions so their personal privacy was well and truly hosed. Some assistance, education and laptop replacement later things are much better. After removing the box from the network our VPN now runs correctly and they can sleep at night knowing big brother isn’t watching… as closely at least ;)
~Marcus