Question: I am staying in Thailand right now on a "long holiday" to do some work on my laptop.

A few weeks I noticed that at the condo where I am staying, sometimes I am redirected to ad sites. I researched it and learned there may be some problem with the wireless router's security (the model, TD-W8961ND, has a known vulnerability). I can find the router at 192.168.1.1 but no passwords work. I believe the attackers may have changed the password. Just yesterday, the attacks got severe and most websites would redirect to a fake site to "upgrade flash player" (malware file).

I tried to get the router replaced but when it came back from the ISP, it still has the same problem. So it looks like the router is still configured to redirect to malicious addresses.

My questions are:

1) What is the likelihood that financial information conducted over SSL could have been affected during this breach? Passwords? I normally don't fall for these traps but since I was using a compromised router for 2 months, it's possible they got me somehow. 

2) I am now using a secure OpenVPN connection and no longer experiencing any problems from my router because my requests are all going to the VPN server first. If I stay connected via VPN, am I still vulnerable to problems exposed to me by this router? (Let's assume there's no way I can actually fix the problem).

3) Or, does anybody know if there's a way to force-reset the router back to admin/admin so I can log in and look at the security settings and patch the vulnerability?

Regards,

Grey

Answer: 
1) As long as your browser has shown a green (or at least not red and with a warning message) `https` in the address bar then you've successfully authenticated to the other end without compromise. It's highly unlikely for the attacker to be able to man-in-the-middle the SSL connection without the private keys of the host server (e.g. your bank) to sign the ssl certificates that the https host has. If he tried to sign certificates, the browser would detect his falsely signed ones.

2) As for VPN, it depends. If you do it over SSH, make sure the presented fingerprint is in fact that of the host you are connecting to. The fingerprint might be cached by your computer already, so if your VPN connection starts automatically, the chances are very high that there is no compromise otherwise the VPN software would throw some alert message at you saying that the fingerprint has changed (indicating a possible man-in-the-middle).

Of course, if you do anything over plain old HTTP, forget about all security.

3) I'm sure there's a way. Just google the make and model of the router.
there is a problem in these routers & it can't be fixed unless the hardware version is 3. it is mentioned in the following link

<http://forum.tp-link.com/showthread.php?75663-Failed-to-upgrade-firmware-of-TD-W8961ND>

in addition to the heartbleed bug it is very dangerous for you to use this router with websites like bank or any work related. because almost everything could be exposed.