Could my router be spying on me?

[modobo]

Hi folks,

I bought a router to use with my sim from China and on trying to use it, apart from it being dated with the firmware, it appears to be new on the outside but old software on the inside. It also appears to be a Frankenstein hardware ie half ZTE and something else. I checked the model with the manufacturing company but it appears they never manufactured that model.

Anyway, strange things have been happening like passwords not working on some websites like as if they been changed, sometimes I log into my mail box and find mail I read last time now appearing as unread and a few other oddities.

All these anomalies led me to check the routers internals which led me to the page I have included here. I dont understand what this page is trying to tell me but it looks like my info is going through some network b4 going where it should. Please could anyone shed light on this.

[Geek-9pm]

What is the make and model of your router.

What is "my sim from China "? You mention ZTE, which is a cell phone company,.

[modobo]

Hi,

Its a EDUP 4G LTE-Wireless Router but u wont find this on their website.  "I bought a router to use with my sim from China" means the router is made in China.  "You mention ZTE, which is a cell phone company,"  the hardware inside the router is part ZTE

[Geek-9pm]

Over a period of time, there have been reports of how the Chinese are fining out our passwords and reading our email accounts, or Facebook accounts and almost any other place where we might have stored information about ourselves.
The most recent news item says about 400,000 records were stolen from the military by just two Chinese experts who are using the resources of the Chinese government to spy on Americans. Just how much of this is really true is hard to say. But the announcement was made by the Justice Department that they have arrested two Chinese nationals who are working for the Chinese government in an effort to get as much information about Americans using the Internet.
The fact that some of your equipment was my in China might has something to do with the problems you have. However, even if you had equipment and made only United States, they could still get into your accounts anyway. Once they get into your passwords everything will be available to them regardless of what kind of hardware you are using.
Sorry I can't be of much help to you. Possibly using other hardware might give you better results, but that is no guarantee that your private information is secret. It seems that the big firms such as Facebook and the banking companies do not do enough to protect your private information. You will have to check carefully all the purchases you make on credit cards and all the charges that appear in your bank account.
You may have to buy a new cell phone and get a new phone number in order to protect yourself from all sorts of bad things. I don't know of any easy answer.

[niketathakare]

An easy way to determine if someone is using your wifi to sniff your traffic is simply change your wifi password. This has two benefits. The first obvious one is it will kick out the intruder who wouldn’t know the new password.

The second benefit is you can also determine if someone close by is using something known as an evil twin attack. This is shockingly easy to setup, but requires the person to be near you like a neighbor. This is where they will secretly take down your wifi by flooding it. And put up there own wifi using your routers information so your devices will connect to their equipment allowing them to analyze everything you do. So if you change your wifi password, your devices like your phone will disconnect until you update them with the new password. You may have a problem if they are magically still connected after you change the password.

Using a VPN service like Nord VPN or Pure VPN will completely hide everything you are doing even if someone is actively monitoring your wifi.

[modobo]

It just appears that the router firmware is written to pass my traffic into the hands of the spies, no changing of the password is going to prevent that so I wonder what I can do

[BC_Programmer]

Anyway, strange things have been happening like passwords not working on some websites like as if they been changed, sometimes I log into my mail box and find mail I read last time now appearing as unread and a few other oddities.

Web traffic is pretty much completely SSL and HTTPS, particularly logins. Even if we start with the assumption that the router was under malicious control, the web traffic where you log in and view your E-mail could not be inspected to get your password, nor could those communications be changed since they are encrypted entirely to prevent tampering between the client system and the server.

The "System Log" information indicates nothing untoward. The IP address is probably because a system connected to the router requested it- it's an ad server so it's going to be pretty common.

"Run Manual set APN" likely means a client is connecting- APN is "Access Point Name".

Fact is if they were spying, you wouldn't know . Somebody "spying" on your web activity even with full direct access to your PC doesn't want to be detected and isn't going to leave log entries or start changing your passwords one at a time, or log in to your webmail and arbitrarily flag read E-mails as unread again.

[Shandy]

This is where they will secretly take down your wifi by flooding it.

Interesting. Not sure you could reliably crash a router through wifi traffic pointed at an SSID.

Where do people get this crap from?

[Shandy]

Web traffic is pretty much completely SSL and HTTPS, particularly logins. Even if we start with the assumption that the router was under malicious control, the web traffic where you log in and view your E-mail could not be inspected to get your password, nor could those communications be changed since they are encrypted entirely to prevent tampering between the client system and the server.

The "System Log" information indicates nothing untoward. The IP address is probably because a system connected to the router requested it- it's an ad server so it's going to be pretty common.

"Run Manual set APN" likely means a client is connecting- APN is "Access Point Name".

Fact is if they were spying, you wouldn't know . Somebody "spying" on your web activity even with full direct access to your PC doesn't want to be detected and isn't going to leave log entries or start changing your passwords one at a time, or log in to your webmail and arbitrarily flag read E-mails as unread again.

It's as BC says. If you inspect network traffic anything with end-to-end encryption is garbage without the keys (which are not transmitted).

What's more likely is that you created an account on some fishy domain using your SUPER FAVOURITE username and password and that domain was under control of some nefarious dudes and they used your SUPER FAVOURITE username and password to attempt to login to popular sites.

[modobo]

Web traffic is pretty much completely SSL and HTTPS, particularly logins. Even if we start with the assumption that the router was under malicious control, the web traffic where you log in and view your E-mail could not be inspected to get your password, nor could those communications be changed since they are encrypted entirely to prevent tampering between the client system and the server.

The "System Log" information indicates nothing untoward. The IP address is probably because a system connected to the router requested it- it's an ad server so it's going to be pretty common.

"Run Manual set APN" likely means a client is connecting- APN is "Access Point Name".

Fact is if they were spying, you wouldn't know . Somebody "spying" on your web activity even with full direct access to your PC doesn't want to be detected and isn't going to leave log entries or start changing your passwords one at a time, or log in to your webmail and arbitrarily flag read E-mails as unread again.

I hope you are right, thanks for your response.