This topic

Replacement Router Hacked Remote Host

Rum37Tmdf — Mon, 25 Nov 2024 07:10:16 GMT

Hi everyone, first post so sorry if it’s a bit confusing- I have no tech skills whatsoever. Bt said my router was hacked from the logs and sent a replacement. Devices - phones were hacked, phone calls, camera, screen and access to websites. All devices wiped to factory settings in Store, passwords for apple, Microsoft, gmail etc changed on someone’s secure WiFi laptop in another building. Same things happened again within days, can only half the screen, can’t open files. When I changed admin password it logged as http admin instead of just admin. Devices are labelled by their name or unknown and then labelled as host. Last night remote host opened portals I haven’t seen before both external and internal from my sons smart tv. I’ve probably made everything worse restarting the hub and messing about with the settings but I have no idea what to do. My son was reported for hacking school systems in August and had bought usb sticks with prebuilt Kali Linux software. both his and his brothers computers displayed No Operating System Reboot when switched off - pc shop said whole memory gone for pc but laptop, sons phone and the usbs were seized by police. He’s not hacking anymore but he had originally taken the card out of the hub with the passwords etc. how the hell do I get these people out and take my life back?

Re: Replacement Router Hacked Remote Host

Keith_Beddoe — Mon, 25 Nov 2024 07:22:29 GMT

You are the victim of a scam, BT would never contact you to say your router has been hacked. Who set the "replacement" router, as its probably not a BT one.

https://www.bt.com/help/security/scams

This is just a BT customer to customer forum.

I doubt anyone here would be able to help.

Re: Replacement Router Hacked Remote Host

naylor2006 — Mon, 25 Nov 2024 08:08:05 GMT

Even the post looks like a hoax....

Re: Replacement Router Hacked Remote Host

Rum37Tmdf — Mon, 25 Nov 2024 09:44:11 GMT

I phoned them and they went through the technical log. Told me to unplug all devices and unplug router. Sent me a new hub 2 which I received about 4 days later. I spoke to o2, reported to action fraud - had to do a separate report for every device in the house. Cost £170 for pc to have new operating system and memory put back. No one contacted me I contacted them. This is genuine. I need help urgently because I don’t know who else to go to

Re: Replacement Router Hacked Remote Host

Rum37Tmdf — Mon, 25 Nov 2024 09:45:15 GMT

Seriously not a hoax. This is an awful experience that i can’t resolve

Re: Replacement Router Hacked Remote Host

VeteranISPUser — Mon, 25 Nov 2024 10:34:37 GMT

@Rum37Tmdfwrote:
Cost £170 for pc to have new operating system and memory put back.

Hi @Rum37Tmdf I'm afraid that is a classic scam.

Re: Replacement Router Hacked Remote Host

Rum37Tmdf — Mon, 25 Nov 2024 15:00:49 GMT

How can I find out who the remote host is and stop them? They added port rules that opened external and internal ports to my smart tv

Re: Replacement Router Hacked Remote Host

Rum37Tmdf — Mon, 25 Nov 2024 15:07:05 GMT

external ports: any->61000	remote host:	internal ports: 7547	internal client: 192.168.1.114
22:57:08	24 Nov. Port forwarding rule added via TR069. Protocol: TCP	external ports: any->61000	remote host:	internal ports: 7547	internal client: 192.168.1.114
22:57:07	24 Nov. Port forwarding rule added via TR069. Protocol: TCP	external ports: any->61000	remote host:	internal ports: 7547	internal client: 192.168.1.114
22:57:07	24 Nov. Port forwarding rule added via TR069. Protocol: TCP	external ports: any->61000	remote host:	internal ports: 7547	internal client: 192.168.1.114
22:57:07	24 Nov. Port forwarding rule added via TR069. Protocol: TCP	external ports: any->61000	remote host:	internal ports: 7547	internal client: 192.168.1.114
22:57:07	24 Nov. Port forwarding rule added via TR069. Protocol: TCP	external ports: any->61000	remote host:	internal ports: 7547	internal client: 192.168.1.114
22:57:07	24 Nov. Port forwarding rule added via TR069. Protocol: TCP	external ports: any->61000	remote host:	internal ports: 7547	internal client: 192.168.1.114

Re: Replacement Router Hacked Remote Host

gg30340 — Mon, 25 Nov 2024 15:51:30 GMT

Disconnect all your devices from the Internet then carry out a factory reset on all of them and while they are resetting carry out a factory reset on your BT Hub.

If you still have problems after that get your hacker of a son who apparently thinks he is a whiz kid to repair the damage that he has done with his stupid antics and if that doesn't work you will need to employ the services of a computer expert to repair that damage because it really has nothing to do with BT or this forum.

Re: Replacement Router Hacked Remote Host

WSH — Mon, 25 Nov 2024 16:44:30 GMT

And when you factory reset the Smart Hub, I wouldn’t use the password on the back again. Use something else, at least 15 characters long, numbers, upper/lower case and symbols.

Port rule to close port 80

Rum37Tmdf — Wed, 27 Nov 2024 21:43:30 GMT

My bt hub 2 has ports 53, 80, and 443 open. I want to close port 80. I’ve never made a port forwarding rule before. I don’t know if they are internal or external. If I create a new rule for 53, and a new rule for 443 will that automatically close port 80? Thank you in advance

Re: Port rule to close port 80

licquorice — Wed, 27 Nov 2024 22:31:14 GMT

Why are those ports open? Have you forwarded them? Are you running a web server and DNS server on a machine.

Port forwarding simply opens ports to a particular machine, you can't set a port forwarding rule to close a port. Unless there is a rule opening the ports or UPnP opening them they will be closed.

Edit: just seen your previous posts.

You need to have serious talk with your son who is clearly to blame.

Re: Port rule to close port 80

Rum37Tmdf — Wed, 27 Nov 2024 22:39:27 GMT

I just thought they opened themselves when someone is using online gaming. Apparently port 80 is set to open automatically as bts default port but I read that port 443 is a secured alternative. I didn’t know the port forwarding rules in my router log had been manually added by a person. Apparently to play multiplayer games on ps5 with friends you have to have ports open dependent on the game. My son now has no phone or laptop just the console with a child profile so shouldn’t be able to configure anything? I just need someone to tell me what I should set on the router - I’m the only person with the WiFi and admin passwords

Re: Port rule to close port 80

licquorice — Wed, 27 Nov 2024 22:49:45 GMT

Port 80 is the Http port, port 443 is Https to access a web server and port 53 is DNS.

How are you discovering the ports are open?

With UPnP enabled, ports are opened and closed as required automatically.

You can either disable UPnP and prevent him playing multiplayer games or leave it enabled and allow the games to open the required port.

Re: Port rule to close port 80

naylor2006 — Thu, 28 Nov 2024 08:36:57 GMT

You may find that even with UPNP disabled that games still work, I dont have it enabled and FC25, CS2, GTA and Tony Hawk all work without an issue.

Probably best to switch it off in most circumstances and then if a game doesnt work just look up what ports it needs open and then just open those alone pointing to the relevant internal IP address. I would delete any manual entries to start with, that table you posted looks like nearly all external ports are open pointing to one internal point and IP....although I could be misinterpreting what that table is illustrating.

Re: Port rule to close port 80

licquorice — Thu, 28 Nov 2024 15:46:53 GMT

Not sure what's going on here, I suspect he is hosting a game so this requires ports to be open. But ports 80 and 443 suggest he is running a web server. Port 53 is normally used for DNS so not sure what that is all about.

Re: Replacement Router Hacked Remote Host

Davidhoney — Sun, 20 Apr 2025 13:05:50 GMT

hey, really sorry you're dealing with all that — sounds overwhelming, especially if you’re not super into tech stuff. honestly, even for people who are, this would be a lot to sort through.

first off, you’re not alone in this — things can get messy fast when devices get compromised, and even more so when you’ve got someone in the house who used to mess around with hacking tools. sounds like your son might’ve had good intentions at first but things got out of hand.

a few things helped when i went through something similar:

i reset everything from scratch but made sure to do it in the right order: changed all important passwords first on a trusted device/network (not your home WiFi).

called BT and asked them to fully reset the network access and any remote management options on their end.

disabled UPnP and remote access on the router completely — these can open doors people don’t realize are there.

i kept only essential devices on the network for a while. phones, laptops — just the basics.

also — don’t feel bad for messing around in the settings. most of us do that when we’re trying to take control back. if you’re unsure, BT can walk you through locking down the router settings again.

you can get your digital life back — might take a little patience, but you’re already doing the right thing by asking questions and not ignoring it. funny enough, i had a similar issue once while setting up some online learning stuff at schoologylausd.com — thought it was a WiFi bug at first but turned out to be deeper network config stuff.

happy to walk you through anything if you want — just reply back.

Re: Replacement Router Hacked Remote Host

Davidhoney — Sun, 20 Apr 2025 13:09:15 GMT

totally hear you — that sounds beyond stressful,

Re: Replacement Router Hacked Remote Host

gg30340 — Sun, 20 Apr 2025 13:16:57 GMT

This thread is over six months old so hopefully the problem has been sorted by now.