Being attacked constantly since upgrading to the new 900 fibre service and using the DECT phones

[Anonymous]

I moved to the new 900 service end of October and have had quite a few issues.

Rang Tech quite a few times since Jan 2024 as thing started getting worse. Basically I am receiving constant DOS attacks day and night, different IP addresses, although I recognise some being the same most days. Looking them up it mentions that some are alleged Cyber security companies which pick up your ISP number as already being blacklisted or involved in fraudulent activities and says they then track you on the net. Anyway DOS UDP Loopback, DOS Floods, loads of TCP and UDP port scans and quite a few DOS spoofing attacks. Had a new Smart Hub as the first one was acting odd, mainly not saving changes made to it, the 2nd one I think is working as it should. Also had 2 engineers out who were amazed at the amount of log entries in the router in such a short time.

I was concerned something had got through to my computer, but having checked for anything nasty with the 2 companies I have always used, things were clear, then tried the Norton which comes with BT that said things were clear, then paid for the best rated one with built in Firewall and that's clear, but I also reformatted and wiped the memory too to be on the safe side. Also thought the new SIP Dect phones could be calling back home to China for updates, as on the rare occasion I have managed to get a new ISP address, within a few minutes, the attackers know the new number (even when router is not plugged in or any computer plugged in), so I thought it may be the phones sending the ISP address out via the WAN they use. It's always a China network which gets it first 😞

I actually think its more than likely the ISP address has been used in something dodgy in the past, so did one engineer and because BT recycle their ISP addresses, I have now ended up with this number. Technical fob you off, will not issue a new number, tell you resetting router with a pin or turn off and on 20 mins later etc will issue new number - NO it does not, it gives you exactly the same or just alters the last 3 digits, which is totally useless since the attackers are attacking the entire range. I would like this to stop, but no one seems remotely bothered. I was concerned too as sometimes there is background noise on these phones, sounds like mumbling, also heard faint music even when the person I am speaking to has no TV or music on in their house, so very odd. I've pulled the batteries out of the phones too, left off for a week, used my mobile instead and still the same. Was even worried mobile may be compromised too, when ringing the 0800800150 BT number was it being diverted to hackers? Not as daft as it sounds, reset mobile which is quite old to factory defaults, says no divert is setup on it, so assuming its safe and computer must be safe as 4 different antivirus companies show it is and also an anti malware company shows its clean. Nothing odd running, no unusual apps, not installed any apps for well over a year, do not visit any dodgy sites, don't click on attachments etc or links, so at a loss what to do. It's got to the point where we daren't do anything on the net, afraid to ring anyone in case someone else is listening in or calls being diverted.

Tech yesterday assuming it was them, gave me a number for the BT Trust and Safety Team, said I need to report it as a Cyber Crime, but I don't know if the number given is legit? There's no info on the internet showing the number given. Any advice really appreciated, as it is getting worse each day. Thanks

[ptrduffy]

Hi @Anonymous 

It's quite common to see various DoS attacks in the Hub log - that just shows that the firewall is doing its job.  It's extremely unlikely that it's anything to do with you specifically - the available IP address ranges are known to attackers, and they just regularly try all of them to try and find a vulnerability.

Going by what you describe, the firewall is keeping you safe, your home devices remain uncompromised, and you have nothing to worry about.

[licquorice]

Exactly

[Anonymous]

Any idea why my router logs have never shown any DOS attacks in all the previous years I've been with BT? It's only started since moving to this new service. If attacks are the norm, then surely I would have seen something before now and I've checked the logs quite often. Same with the ISP addresses, why do BT recycle them if customers have reported being attacked from these numbers, since whoever it is (obviously more than one), then other customers who have the same ISP address with 3 different numbers at the end, will also be suffering from these same attacks.

I thought the ISP was supposed to be dynamic, I wouldn't call just altering the last 3 digits when you reset the router dynamic, it's more like a variation of a static address, if you can never get a totally different address which starts with something else :(. BT's answer is move to EE rather than try to sort this by giving me a different number, which quite frankly makes my backside laugh. Turning the router off the amount of times technical has told me to has also reduced the overall speed, both wired and wireless, although I suppose this may go back up in time.

Would an admin please confirm that this BT trust and safety team technical told me to ring is legit phone number wise. Not sure if allowed to post it to a thread, but it starts with 0808 so if you would be kind enough to pm me, if it matches what I have I'll ring it. Personally I don't find what is happening acceptable at all, it's never happened to me in the past, so it shouldn't be happening now. If BT don't sort it, I'll be taking it further. Thank you

[c64z86]

I'm not sure what to answer about the rest, but the number of IPV4 addresses is dwindling and will run out one day, which gives ISPs less room to just issue completely new addresses. (Talking just of your public internet IPV4 address here, which everyone sees on the internet, not addresses like 192.168.1.119 which are private and provided by the router/Smart Hub itself to each device on your home network.)

That's why everything is changing to IPV6, which in theory would allow every device on the planet to have its own personal IP address from the ISPs.

So chances are, the public IPV4 addresses we have now are pretty old and have been used all over the place for all sorts of different reasons. So that IPV4 address has its own "history" that follows it around so to speak.

It is even more so these days.

[TimCurtis]

@Anonymous 

I've PM'd you with the number I was given for Trust & Safety.

[Crimliar]

Every one of our routers will get prodded and poked by malicious actors multiple times daily!  But the attackers will only linger on a specific device if it's vulnerable, or they have some reason to believe a compromised device is connected behind a router.  I'd suspect you may have a compromised device that is attracting attacks!

[rbz5416]

Are you maybe confusing internal private addresses with external public ones? Whenever my connection drops or the modem is rebooted I receive a new IPv4 addresses in a completely different range. I have never seen only the last three digits change.

[ptrduffy]

Any idea why my router logs have never shown any DOS attacks in all the previous years I've been with BT?

No idea, sorry - this is the only unusual aspect to your entire scenario, in my opinion.

Same with the ISP addresses, why do BT recycle them if customers have reported being attacked from these numbers, since whoever it is (obviously more than one), then other customers who have the same ISP address with 3 different numbers at the end, will also be suffering from these same attacks.

There are a limited number of IPv4 addresses available, as others have said.  In total, there are about 3.7 billion public addresses.  Any ISP, such as BT, will only have available to it a small subset of this number, so they absolutely have to "recycle" them.  One of the main jobs of your hub is to take the one address you are given, and share that among all the devices on your home network - as @c64z86 points out, the shift to IPv6 will help with this, as it has many, many more addresses available (but don't hold your breath, it's been ongoing for 20 years or so).

The reason you often only see "3 different numbers at the end" changing when you get a new address is down to the fact that the earlier digits in the address are used by the network to route data to you.

Either way, changing your IP address is unlikely to stop the probes that you're seeing.  All possible addresses are already known to attackers, so they just periodically try addresses to see if the devices at those addresses are vulnerable.  Part of the firewall's job is just to make sure it ignores these probes, so the attacker doesn't see any response and moves on to another address.

What you are seeing is perfectly normal behaviour, and honestly not a cause for concern.

[Anonymous]

Thanks it's the same number so I'll ring them 🙂