This Network is Compromised

Bwoirhaye,

It was ARP spoofing yet it wasn't malicious? What do you mean? Norton detected what it was supposed to detect, yet it was ok? Any clarification would be appreciated. 

Thanks.. 

 

bwoirhaye:

The detection was accurate, it is ARP spoofing.  However, in this scenario, it should not be considered an attempt at malicious redirection of traffic.

The detection was accurate, it is ARP spoofing.  However, in this scenario, it should not be considered an attempt at malicious redirection of traffic.

RaSgo, all I can say is "you are lucky" to have solved it! I am still getting the error message sporadically so I am (as well as others) relying on Norton to fix the problem! cheers

I had Norton WiFi Privacy installed but not activated. Initially I thought its their trick to scare me so that I buy a subscription for Norton WiFi privacy. I have uninstalled it before changing encryption to WPA2+PSK and AES

Oceanracer
Thanks for not treating me an agent of Norton. This problem bugged me so I came into forums to find an answer from all you experts. I may be blunt in saying no need for a patch or update becoz I think the problem can not keep troubling so many people and Norton will sit quietly. What I did was a hit and trial and I got rid of the problem. Changed the encryption type, ssid and p/w of my router offline thinking if someone is trying to hack will not know.
Gavacho
Troll is definitely an annoying word, use it carefully.

Gavacho, ditto ;-)

Oceanracer,

I think the guy might be a troll. He creates an account just to make that post? He clearly didn't read the thread. At least he left out the "click here to meet girls who want to date you" link.. :-)

 

Oceanracer:

RaSgo, no offence but I have WPA+psk and AES on my routers and repeater (as I am sure a lot of other knowledgeable people on this tread do) and that did not stop the problem from occurring. Gee, at least I am glad you do not work for Norton. How can you  claim bluntly "There is no need to release any update or patch by Norton".LOL.  It's a bit arrogant, don't you think?

RaSgo, no offence but I have WPA+psk and AES on my routers and repeater (as I am sure a lot of other knowledgeable people on this tread do) and that did not stop the problem from occurring. Gee, at least I am glad you do not work for Norton. How can you  claim bluntly "There is no need to release any update or patch by Norton".LOL.  It's a bit arrogant, don't you think?

Hi, The problem being discussed here is of encryption used in WiFi link. Please change encryption to better one like WPA+psk and AES by login to router through Admin password. You will find that the Norton will pass your WiFi as safe. I have done this and its working perfectly. There is no need to release any update or patch by Norton.

We expect to release an update in the next week which should tighten up the ARP spoofing detection to exclude cases like this.

 

Not sure how else to interpret this statement, other than it was a false positive. ARP spoofing was detected in the cases reported here, and the update tightens up the detection for cases reported here so it should not happen again.

 

We are supposed to "infer" it was a false positive?  Is that a reasonable professional response?  Nobody is asking for code, but how about Norton officially tells us it was indeed a false positive?  This is all we've heard

"We expect to release an update in the next week which should tighten up the ARP spoofing detection to exclude cases like this.  We'd appreciate feedback if you still see this after the update (actually available now if you are part of the NMS Beta program). "

I guess the above quoted response is all we'll get? No confirmation of a false positive, and that there was actually no ARP spoofing going on. People trust Norton. The absolute number one priority in any business is keep the customer informed. Norton didn't do that in this circumstance, as many here will agree... 

peterweb:

They might have fixed the notification in one particular scenario, but it can't be considered "fixed" until they tell us what was wrong, in general terms, and what they did to fix it.

What you can infer from the fact that the update to NMS fixed that detection is that it was a false positive. What they did to fix it was adjust the code to stop that false detection. I'm not sure what more you want to be told, as a security company is not going to give you information about any specific changes to code they make to their proprietary software.

They might have fixed the notification in one particular scenario, but it can't be considered "fixed" until they tell us what was wrong, in general terms, and what they did to fix it.

What you can infer from the fact that the update to NMS fixed that detection is that it was a false positive. What they did to fix it was adjust the code to stop that false detection. I'm not sure what more you want to be told, as a security company is not going to give you information about any specific changes to code they make to their proprietary software.

 

We haven't received any information from Norton Regarding this. People are still having the problem. They might have fixed the notification in one particular scenario, but it can't be considered "fixed" until they tell us what was wrong, in general terms, and what they did to fix it. The bottom line is, we all want to know if the "Arp Spoofing" was legit, or was a Norton error. It makes a big difference. Glad the warnings went away for you though....

FrankUK:

All, I had this problem but it looks like an update to the Mobile Security App has resolved the issue (or at least it has stopped the warning message appearing - Norton may simply have 'undone' what they did to cause the problem).

I got this when using a Samsung S7 or Samsung tablet on a WiFi extender (TPlink TL-WPA4220) which had never caused an issue in the past.  The app update (now on 4.0.1.4038) has stopped it happening on both devices so HOPEFULLY all is now well again.

 

 

 

All, I had this problem but it looks like an update to the Mobile Security App has resolved the issue (or at least it has stopped the warning message appearing - Norton may simply have 'undone' what they did to cause the problem).

I got this when using a Samsung S7 or Samsung tablet on a WiFi extender (TPlink TL-WPA4220) which had never caused an issue in the past.  The app update (now on 4.0.1.4038) has stopped it happening on both devices so HOPEFULLY all is now well again.

I have the same problem on my Android Galaxy S7 and S8+ devices.  This happened immediately after implementing a new mesh WiFi using a new Asus RT-AC88U router and my existing Asus RT-AC68U as a mesh node.  I created a completely new WiFi SID configured with 'Dual-Band Smart Connect' which is a single SID for both 2.4 and 5 Ghz frequencies.  The node is connected to the primary router with an Ethernet backhaul.

This message only pops up when the phone is using the mesh node.  If I go back to the primary WiFi zone, and re-open Norton, it usually hangs the app.  Once it comes back (or the phone is rebooted) and I am in the primary WiFi zone, it reverts to the message that the WiFi zone is safe.

Been experiencing this issue for a few days, since replacing our router temporarily (replacing Ubiquiti USG with an Asus TM-AC1900 due to some firmware issues).  Like some others in this thread, we're running a second router (Netgear AC1450) as a media bridge.  WiFi is handled by a Ubiquiti Unifi AP.  Topology is:

CenturyLink modem / router in transparent bridge mode (dhcp, wifi disabled) > Asus TM AC1900 (router) > Unfi AP (wifi) > Netgear AC1450 (media bridge).

Interestingly, the issue wasn't exhibiting with the previous configuration:

CenturyLink modem / router in transparent bridge mode (dhcp, wifi disabled) > Ubiquiti USG (router) > Unfi AP (wifi) > Asus TM AC1900 (media bridge).

The two differences are different router and different media bridge device.

Until Ubiquiti resolves the USG firmware issue, I'm stuck with this temporary configuration.  For now, I've uninstalled Norton Mobile from our phones, as a temporary fix.  Fortunately it doesn't appear to be impacting our Windows devices (laptops, desktops).  Will watch this thread and hope Norton gets this false positive addressed.

Thanks, but when I tap the three dots I only have "Mark as Home" and "Wi-Fi Settings". I can turn off all notifications for the app but I really like it to stop checking the wi-fi.

rhtsoft

When you see the message, tap the three dots at the top right. Then look for an ignore for now option and tap that.

 

In the meantime, is there a way to suppress the warning and leave the wi-fi turned on? My old Samsung S5 (android 4.4) alerts me every 10 minutes with the warning.