Threat name ARP Spoofing

Archive
1

Hello,

Just started getting a norton pop up saying my network might not be safe and a suspicious device (IP: 0.0.0.0) is using ARP spoofing to collect all data sent to and from your computer.

I have three options to disconnect and block network, stay connected and block device and ignore. Not sure what I should do.

Can anyone advise what action they would recommend please?

Thanks

2

Thanks

3

All good! I honestly just let it do its thing and haven't been hacked yet so that's a good thing...

4

[...]
Anyway, I also turned wifi on my pc on even though I was connected by ethernet cable. I believe this is the cause of the issue as Norton must have been identifying each connection attempt as a potential ARP Spoofing attack.

Have turned wifi off and so far, the pop-up message hasn't come up again.

 

Thanks...and how's your Norton 360 for Windows v24.x feel otherwise? 

5

Ok. had been ignoring the constant pop-up messages but think I have found the cause. 

A few weeks back my son was having slower speeds connecting over ethernet compared to wifi so I tried connecting his pc by wifi at the same time as having the ethernet connected as comments online suggested the device would choose the faster connection without any issues. Turns out the ethernet cable was dodgy.

Anyway, I also turned wifi on my pc on even though I was connected by ethernet cable. I believe this is the cause of the issue as Norton must have been identifying each connection attempt as a potential ARP Spoofing attack.

Have turned wifi off and so far, the pop-up message hasn't come up again.

6

@zimmy006

Please post progress

7

png_19255_0.png

zimmy006:
Just started getting a norton pop up saying my network might not be safe and a suspicious device (IP: 0.0.0.0) is using ARP spoofing to collect all data sent to and from your computer.

Sorry, first time seeing ARP Spoofing.

fwiw ~

N360 "compromised network", MITM, ARP spoofing
https://community.norton.com/en/forums/n360-compromised-network-mitm-arp-spoofing 18-Aug-2022

You need to be a user with administrator privileges to trust a network Norton identifies as unsafe.

https://support.norton.com/sp/en/us/norton-360-premium/current/solutions/v127924782 17-Oct-2023

Please review: How To - Contact Norton Official Support

8

Norton 360 version is 24.5.9153.843

Virus definitions version is 240606-4

Windows 11 home version 23H2

OS build is 22631.3672

I ran Live update, restarted and have attached screenshot

Cheers

9
zimmy006:

[...] I think it appearing coincided with the new Norton update and look.

Are you Norton 360 for Windows v24.x?  
Please run Norton LiveUpdate + Restart (not Shut down) machine.  
Please post screen shot.  
I've not received v24.x at this time. 

For Norton technical issues please include details:

  • Norton product or service name and version
  • Operating system - version / build 
  • Norton error message / error code / screen shot (mask PII)
  • Steps to reproduce issue
  • DO NOT post any Personally Identifiable Information (PII) such as your email address, product key or phone number

Caveat: I've not seen Spoofing pop-up  

10

Thanks for the response!

Long time Norton user but first time I have seen anything like this.

I have closed it and restarted, and it keeps coming up. I even selected the 2nd option of stay connected but block suspicious device and that didn't seem to stop it from re-appearing.

I have not added any new devices to the network. I think it appearing coincided with the new Norton update and look.

I do not use the secure VPN. Lack of understanding I guess as to what it might affect.

Seems to be flagging on my desktop computer which is wired connection.

Thanks for your suggestion. I'll look into that.

Cheers

11

Hello @zimmy006
Welcome to Norton Community
````````````````````````````````````````````````````

Is Norton pop-up/notice a one time event or repeats?
Did you recently connect/add a new device to your network?
Norton Secure VPN?
Wired or Wireless?

Guess, I'd "block and disconnect network"...for now.   
If you disconnect, you can add network back to trusted networks using Security History.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Flush my DNS cache.
https://www.lifewire.com/flush-and-clear-windows-dns-cache-5095298

Power cycle reset my modem/router. 
https://www.lifewire.com/how-to-properly-restart-a-router-modem-2624570
Note: lifewire.com has ads

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

N360 "compromised network", MITM, ARP spoofing
https://community.norton.com/en/forums/n360-compromised-network-mitm-arp-spoofing 18-Aug-2022

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

A Guide to Spoofing Attacks and How to Prevent Them in 2024
https://www.comparitech.com/net-admin/spoofing-attacks-guide/

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

For Norton technical issues please include details:

  • DO NOT post any Personally Identifiable Information (PII) such as your email address, product key or phone number
  • Norton product or service name and version
  • Operating system - version / build 
  • Norton error message / error code / screen shot (mask PII)
  • Steps to reproduce issue

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Caveat: I've not seen Spoofing pop-up