Has my office network been hacked or tapped into? (Web pages sometimes not loading and then redirecting on refresh)

Recently employees in my office (about 5 people) have reported that sometimes web pages can not load for no reason, but after pressing refresh button in the browser, it first shows 'Redirecting you to www.....' then the page loads normally.

This only started to happen this week and it has happened to all users (so I've ruled out spyware / virus on individual PCs.)

Could this be a man-in-the-middle attack? I.e. someone is intercepting all web requests and forwarding them onto the real server. If so how could you tell?

Network configuration:

internet --> |ADSL  |--> wireless router --> office PCs
             |modem |--> web server

ytk

Posted 2011-06-14T07:50:43.447

Reputation: 424

3What did you do to rule out SpyWare and viruses? – Randolf Richardson – 2011-06-14T07:54:29.137

What kind of router is it? Have you been into the routers configuration and checked that the DNS and other settings are all aquired from the ISP rather than manually entered? – Mokubai – 2011-06-14T07:59:23.030

Just because it is happening to all users does not rule out a virus at all. It REALLY sounds like your computers are infected. – KCotreau – 2011-06-14T13:38:22.040

If they are redirecting you, there has probably been a virus or something. Try resetting proxy servers? – Simon Verbeke – 2011-06-14T11:19:16.687

Answers

If it occurs often enough, I would use Wireshark to examine the response that is causing the "Redirecting" message.

RedGrittyBrick

Posted 2011-06-14T07:50:43.447

Reputation: 70 632

To find out what happens behind the curtains you can try Fiddler for a high level (http) view of the browser requests or Network Monitor for a more low level (ethernet) view.

oleschri

Posted 2011-06-14T07:50:43.447

Reputation: 1 075

Well crafted malware can infect All PC's on the network, so simply ruling it out using that logic is flawed.

See my "Alternate Method" in this link to scan ALL the PC's. Be sure to run the boot CD first.

Do a hard reset of the Router also.

Moab

Posted 2011-06-14T07:50:43.447

Reputation: 54 203

+1 Agreed - I would suggest the fact that all PC's show the same symptoms would make me very certain it was malware. – Rory Alsop – 2011-07-06T10:59:07.863