This topic

Being attacked constantly since upgrading to the new 900 fibre service and using the DECT phones

Anonymous — Fri, 26 Jan 2024 16:17:41 GMT

I moved to the new 900 service end of October and have had quite a few issues.

Rang Tech quite a few times since Jan 2024 as thing started getting worse. Basically I am receiving constant DOS attacks day and night, different IP addresses, although I recognise some being the same most days. Looking them up it mentions that some are alleged Cyber security companies which pick up your ISP number as already being blacklisted or involved in fraudulent activities and says they then track you on the net. Anyway DOS UDP Loopback, DOS Floods, loads of TCP and UDP port scans and quite a few DOS spoofing attacks. Had a new Smart Hub as the first one was acting odd, mainly not saving changes made to it, the 2nd one I think is working as it should. Also had 2 engineers out who were amazed at the amount of log entries in the router in such a short time.

I was concerned something had got through to my computer, but having checked for anything nasty with the 2 companies I have always used, things were clear, then tried the Norton which comes with BT that said things were clear, then paid for the best rated one with built in Firewall and that's clear, but I also reformatted and wiped the memory too to be on the safe side. Also thought the new SIP Dect phones could be calling back home to China for updates, as on the rare occasion I have managed to get a new ISP address, within a few minutes, the attackers know the new number (even when router is not plugged in or any computer plugged in), so I thought it may be the phones sending the ISP address out via the WAN they use. It's always a China network which gets it first 😞

I actually think its more than likely the ISP address has been used in something dodgy in the past, so did one engineer and because BT recycle their ISP addresses, I have now ended up with this number. Technical fob you off, will not issue a new number, tell you resetting router with a pin or turn off and on 20 mins later etc will issue new number - NO it does not, it gives you exactly the same or just alters the last 3 digits, which is totally useless since the attackers are attacking the entire range. I would like this to stop, but no one seems remotely bothered. I was concerned too as sometimes there is background noise on these phones, sounds like mumbling, also heard faint music even when the person I am speaking to has no TV or music on in their house, so very odd. I've pulled the batteries out of the phones too, left off for a week, used my mobile instead and still the same. Was even worried mobile may be compromised too, when ringing the 0800800150 BT number was it being diverted to hackers? Not as daft as it sounds, reset mobile which is quite old to factory defaults, says no divert is setup on it, so assuming its safe and computer must be safe as 4 different antivirus companies show it is and also an anti malware company shows its clean. Nothing odd running, no unusual apps, not installed any apps for well over a year, do not visit any dodgy sites, don't click on attachments etc or links, so at a loss what to do. It's got to the point where we daren't do anything on the net, afraid to ring anyone in case someone else is listening in or calls being diverted.

Tech yesterday assuming it was them, gave me a number for the BT Trust and Safety Team, said I need to report it as a Cyber Crime, but I don't know if the number given is legit? There's no info on the internet showing the number given. Any advice really appreciated, as it is getting worse each day. Thanks

Re: Being attacked constantly since upgrading to the new 900 fibre service and using the DECT phones

ptrduffy — Fri, 26 Jan 2024 20:10:39 GMT

Hi @Anonymous

It's quite common to see various DoS attacks in the Hub log - that just shows that the firewall is doing its job. It's extremely unlikely that it's anything to do with you specifically - the available IP address ranges are known to attackers, and they just regularly try all of them to try and find a vulnerability.

Going by what you describe, the firewall is keeping you safe, your home devices remain uncompromised, and you have nothing to worry about.

Re: Being attacked constantly since upgrading to the new 900 fibre service and using the DECT phones

licquorice — Fri, 26 Jan 2024 20:13:38 GMT

Exactly

Re: Being attacked constantly since upgrading to the new 900 fibre service and using the DECT phones

Anonymous — Fri, 26 Jan 2024 21:11:05 GMT

Any idea why my router logs have never shown any DOS attacks in all the previous years I've been with BT? It's only started since moving to this new service. If attacks are the norm, then surely I would have seen something before now and I've checked the logs quite often. Same with the ISP addresses, why do BT recycle them if customers have reported being attacked from these numbers, since whoever it is (obviously more than one), then other customers who have the same ISP address with 3 different numbers at the end, will also be suffering from these same attacks.

I thought the ISP was supposed to be dynamic, I wouldn't call just altering the last 3 digits when you reset the router dynamic, it's more like a variation of a static address, if you can never get a totally different address which starts with something else :(. BT's answer is move to EE rather than try to sort this by giving me a different number, which quite frankly makes my backside laugh. Turning the router off the amount of times technical has told me to has also reduced the overall speed, both wired and wireless, although I suppose this may go back up in time.

Would an admin please confirm that this BT trust and safety team technical told me to ring is legit phone number wise. Not sure if allowed to post it to a thread, but it starts with 0808 so if you would be kind enough to pm me, if it matches what I have I'll ring it. Personally I don't find what is happening acceptable at all, it's never happened to me in the past, so it shouldn't be happening now. If BT don't sort it, I'll be taking it further. Thank you

Re: Being attacked constantly since upgrading to the new 900 fibre service and using the DECT phones

c64z86 — Fri, 26 Jan 2024 21:29:46 GMT

I'm not sure what to answer about the rest, but the number of IPV4 addresses is dwindling and will run out one day, which gives ISPs less room to just issue completely new addresses. (Talking just of your public internet IPV4 address here, which everyone sees on the internet, not addresses like 192.168.1.119 which are private and provided by the router/Smart Hub itself to each device on your home network.)

That's why everything is changing to IPV6, which in theory would allow every device on the planet to have its own personal IP address from the ISPs.

So chances are, the public IPV4 addresses we have now are pretty old and have been used all over the place for all sorts of different reasons. So that IPV4 address has its own "history" that follows it around so to speak.

It is even more so these days.

Re: Being attacked constantly since upgrading to the new 900 fibre service and using the DECT phones

TimCurtis — Sat, 27 Jan 2024 10:07:40 GMT

@Anonymous

I've PM'd you with the number I was given for Trust & Safety.

Re: Being attacked constantly since upgrading to the new 900 fibre service and using the DECT phones

Crimliar — Sat, 27 Jan 2024 10:11:51 GMT

Every one of our routers will get prodded and poked by malicious actors multiple times daily! But the attackers will only linger on a specific device if it's vulnerable, or they have some reason to believe a compromised device is connected behind a router. I'd suspect you may have a compromised device that is attracting attacks!

Re: Being attacked constantly since upgrading to the new 900 fibre service and using the DECT phones

Anonymous — Sat, 27 Jan 2024 10:45:52 GMT

Are you maybe confusing internal private addresses with external public ones? Whenever my connection drops or the modem is rebooted I receive a new IPv4 addresses in a completely different range. I have never seen only the last three digits change.

Re: Being attacked constantly since upgrading to the new 900 fibre service and using the DECT phones

ptrduffy — Sat, 27 Jan 2024 11:54:20 GMT

Any idea why my router logs have never shown any DOS attacks in all the previous years I've been with BT?

No idea, sorry - this is the only unusual aspect to your entire scenario, in my opinion.

Same with the ISP addresses, why do BT recycle them if customers have reported being attacked from these numbers, since whoever it is (obviously more than one), then other customers who have the same ISP address with 3 different numbers at the end, will also be suffering from these same attacks.

There are a limited number of IPv4 addresses available, as others have said. In total, there are about 3.7 billion public addresses. Any ISP, such as BT, will only have available to it a small subset of this number, so they absolutely have to "recycle" them. One of the main jobs of your hub is to take the one address you are given, and share that among all the devices on your home network - as @c64z86 points out, the shift to IPv6 will help with this, as it has many, many more addresses available (but don't hold your breath, it's been ongoing for 20 years or so).

The reason you often only see "3 different numbers at the end" changing when you get a new address is down to the fact that the earlier digits in the address are used by the network to route data to you.

Either way, changing your IP address is unlikely to stop the probes that you're seeing. All possible addresses are already known to attackers, so they just periodically try addresses to see if the devices at those addresses are vulnerable. Part of the firewall's job is just to make sure it ignores these probes, so the attacker doesn't see any response and moves on to another address.

What you are seeing is perfectly normal behaviour, and honestly not a cause for concern.

Re: Being attacked constantly since upgrading to the new 900 fibre service and using the DECT phones

Anonymous — Sat, 27 Jan 2024 12:08:19 GMT

Thanks it's the same number so I'll ring them 🙂

Re: Being attacked constantly since upgrading to the new 900 fibre service and using the DECT phones

Anonymous — Sat, 27 Jan 2024 12:19:35 GMT

Sorry with putting ISP, it's the number that's issued for internet use IP address.

I can reset the router with a pin and it gives the same number out or just alters the last 3 digits, same if I turn router off for a hour, unplug from mains and then put it back on. Would just be nice to receive a totally new number to see if these attacks stop, although even a number with it being used by someone before could have the same thing happening to it.

I only have 2 devices, computer and new TV. The TV's internet has been totally turned off for the last 2 weeks so it's impossible for that to send out or receive any data and installing an anti virus from the play store says it is clear. As mentioned 5 different highly rated anti virus companies software said my computer was totally clear, but I still reformatted it to be on the safe side and also reset the memory to make sure nothing nasty was stored in there, so I can't think of anything else to do my side that I haven't done already. Changed all passwords etc.. Just concerned if it is safe to turn the internet back on my TV, I've stopped using the 2 DECT phones BT sent out to me as I was convinced it was those sending the IP address back somewhere (or if they have Mac addresses could someone track you down through those phones). I'm using my old landline via the adaptor now instead. Is it possible for someone to track you down via a Mac address? I've not installed anything new, not clicked on dodgy links or e-mails, but if someone has your computers Mac address, is that why they keep getting the IP addresses allocated? It could be something simple as its just a case that the IP addresses BT give out to me were already being attacked, but I am worried sick with regards to safety, as I'm sure anyone else would be in the same situation 😞

Re: Being attacked constantly since upgrading to the new 900 fibre service and using the DECT phones

countrypaul — Sat, 27 Jan 2024 13:48:50 GMT

Dect phones do not use IP to communicate they use Dect . Dect phones also do not have Ethernet MAC addresses as they use Dect to communicate to the base station. If you plug a dect phone base station into the SH2 it is using the old telephone system means of communicating with the SH2 - again no ip address and no MAC address.

Only the SH2 has a MAC address (on FTTP) if you are using the telephone connected via the SH2 either by Dect of the phone socket on the SH2. The connection from the SH2 to the ONT is ethernet so the SH2 will have a MAC address to communicate with the ONT.

MAC addresses are not normally sent outside of the ethernet they are on so there would be no point in trying to trace a MAC address from your own ethernet. If you connect to a public WiFi system then your MAC address could be available to others which is why more recent operating systems allow MAC randomisation.

Re: Being attacked constantly since upgrading to the new 900 fibre service and using the DECT phones

Crimliar — Sat, 27 Jan 2024 19:37:13 GMT

If the OP wants to know for sure if they have a compromised device, then the way to test this would be to power down ALL devices that connect to the router. Then reboot the router, and power up individual devices one at a time with maybe a (suggestion) 5 minute interval, with the connected PC being last. The use the logs to see when the DoS attack takes place.

Re: Being attacked constantly since upgrading to the new 900 fibre service and using the DECT phones

Anonymous — Sun, 28 Jan 2024 13:33:09 GMT

I have tried that, but since the router keeps giving me either the exact same number, or the same with the last 3 digits altered, the attackers are going for the entire range. I have rang technical loads of times and also this safety and fraud team (total waste of time as the bloke didn't want to know at all). The only way to rule things out would be to get a totally different IP address that starts with a different set of numbers, hopefully that way the IP address has not already been compromised and already under attack in the past, but having tried desperately for the last couple of months to try to get a new number, nothing has worked. Not sure if moving to a different package already offered to me would give a new IP address? If it does then that's the only sensible option, as otherwise BT basically are not remotely interested in these cyber attacks or whatever you want to call them. Had another 70 port scans middle of the night 1am, 3am, 6am, 4 UDP loopbacks (China yet again early morning), 3 DOS spoofing and one said Flood after it, then another UDP port scan 1pm.

Re: Being attacked constantly since upgrading to the new 900 fibre service and using the DECT phones

c64z86 — Sun, 28 Jan 2024 13:43:01 GMT

With entirely new IPV4 addresses being extremely rare these days, the chances are slim that you will get one which has not been attacked in the past.

Even if you did get a new one, it will shortly be compromised. Just going out into the internet puts a big target on your back for anyone willing to exploit the vulnerabilities of your network and accounts. Even my Steam account gets attacked a few times a year and I don't have any friends on it.

There are a lot more nefarious people and technologies being used for bad things on the internet than there were even 5 years ago.

Re: Being attacked constantly since upgrading to the new 900 fibre service and using the DECT phones

Crimliar — Sun, 28 Jan 2024 13:44:37 GMT

And the idea was that by looking at the time you could tell if a compromised device is calling back home!
On the other side of things, this time yesterday I set up improved firewall reporting on my third-party router. In around one day my router has been probed 900 times, and so far as I'm aware, nothing got through!

Re: Being attacked constantly since upgrading to the new 900 fibre service and using the DECT phones

Crimliar — Sun, 28 Jan 2024 14:23:53 GMT

Addendum to my previous post!
A couple of hundred of those probes are from (low security) sites where in part I verify my identity using personal domain names and their associated IPs - not something many on here will be doing! And yes it does mean there are a couple of vectors that if corrupted can prevent me from accessing those sites (until the corruption is fixed).

Re: Being attacked constantly since upgrading to the new 900 fibre service and using the DECT phones

steephill — Sun, 28 Jan 2024 15:14:08 GMT

You will just be wasting your time and energy trying to get a different IP address. The port scanning you are seeing isn't personal to you or even just to a range of BT addresses, the bots doing this are probing every IP address on the internet looking for weaknesses. Your router is doing its job in stopping these scans getting through and there is nothing more you, BT or any other ISP can do to stop whoever is initiating these port scans.

Re: Being attacked constantly since upgrading to the new 900 fibre service and using the DECT phones

Anonymous — Sun, 28 Jan 2024 21:33:39 GMT

I see where you are coming from saying the bots doing this are probing every IP address on the internet looking for weaknesses. Just checking my router logs again, this new service went active back end of October 2023 and the DOS scans started on 22nd December and have continued everyday and night since.

Surely if bots scan addresses everyday, I would expect to have seen log entries prior to this December date and not have a good month and half plus free of no attacks at all, unless the IP address at the time given to me had never been under attack before and the last 2 different ones had been in the past, so I then picked these up when BT recycled them to me.

I can move to EE which was a choice given to me, not sure if that would make a difference at all, but I suppose it's worth a try :). Thanks for all the replies, if others are seeing similar scans in your routers as mentioned, I'm assuming it's a case of live with it and hope for the best.

Re: Being attacked constantly since upgrading to the new 900 fibre service and using the DECT phones

licquorice — Sun, 28 Jan 2024 21:38:48 GMT

The only way to stop ports scans is to not connect to the internet.

ALL IP addresses are regularly port scanned, you can't avoid it.

Just accept that it is going to happen and is why you have a firewall.