Repeater injected to my network?

I know this is not that kind of support website but on the other side I found my problem very fascinating so I'll post it anyway.

Yesterday all of my machines disconnected from my home network. It took a while until they could reconnect again. Then everything went back to normal, besides that one of my machines (Windows 7) wouldn't allow me to connect to the Internet. I can access all of my email accounts (imap).

I can access google.com but in most cases the authorization window of my browser pops up and asks for login. It says:

Repeater
Login: admin / PW: 1234

When I quit this dialog the browser will return 401 unauthorized.

When I try to connect to an https://<website>, there is a warning about a corrupt certificate that is only valid for 127.0.0.1 (on Windows and Ubuntu).

There has been no modification to the network by us, and the FritzBox we are using is not acting as a repeater. We don't use repeaters at all.

This is what I tried to fix the problem: - I changed the OS to Ubuntu and I faced the same problem. - I flushed my DNS, added 8.8.8.8... same issues. - I updated my router firmware.

After I switched the usb dongle, everything went back to normal. I thought the dongle was simply broken. Today I came home and guess what.. the same thing is happening again and this time it is not only the same machine as before but also my smartphone.

I did some tracepath. Here's the output on my corrupt machine:

foo@foo-MS-7758:~$ tracepath golem.de
 1?: [LOCALHOST]                                         pmtu 1500
 1:  brw002258164b03.setup                                 4.380ms reached
 1:  brw002258164b03.setup                                15.272ms reached
     Resume: pmtu 1500 hops 1 back 1 

Output on the working machine:

 1?: [LOCALHOST]                                         pmtu 1500
 1:  fritz.box                                            10.208ms 
 1:  fritz.box                                             2.689ms 
 2:  p5DCC4446.dip0.t-ipconnect.de                         2.198ms pmtu 1492
 2:  87.186.224.118                                       19.518ms 
 3:  217.0.77.6                                           23.220ms asymm  4 
 4:  b-ea7-i.B.DE.NET.DTAG.DE                             32.254ms asymm  6 
 5:  dtag1.syseleven.net                                  27.833ms asymm  6 
 6:  ae1-0.blu1-r2.syseleven.net                          28.128ms 
 7:  ae0-0.blu1-r1.syseleven.net                          28.677ms asymm  8 
 8:  176.74.59.148                                        28.629ms reached

Do you have any idea what could cause this and how I can fix it? How could I gather more information to get to the ground of this?

EDIT: DNS is working correctly btw. I can ping any URL and it will give me the correct IP but no answers.

EDIT2: brw002258164b03 is the network name of my brother wireless printer. The Fritzbox seems to route the traffic to the wrong devices or whatever. Also tracepath won't alays return brw002258164b03 but also some microsoft server names etc.

This still doesn't explain why I can access google and golem.de but no other websites (tracepath also returned the brother printers network name when I traced golem.de or google.de).

I removed my computer from the list of network devices and then I connected with a static IP address. I'm excited how this will work out.

Solution 1:

There is a UPNP vulnerability that is being exploited in the wild in a way that causes the authorization popup. Disable UPNP on your router and power cycle it. Then google for "upnp vulnerability" for more info than I could provide.