Being attacked constantly since upgrading to the new 900 fibre service and using the DECT phones

[countrypaul]

Remember that the advertising is "EE powered by BT", already many (most?) BT routers no longer offer "BT WiFi" but now offer "EE WiFi" - if you have not disabled that yours to will be offering "EE WiFi" just like most others - by offering this it allows you to use "EE WiFi" Hotspots all over the country.   It is highly likely that BT and EE utilise the same pool of IP addresses.

There are in theory 2 to the power 32 (about 4 billion) IP v4 addresses in total, however for practical purposes only about 3. 5 billion can be used.  Large companies and especially ISP have been allocated blocks of these which they then allow their customers access to. Companies that host for example large numbers of web sites will require many of these IP addresses for the web servers (even though one webserver may host multiple websites). This  results in ISPs often not having enough IP addresses for all their customers on occasion so they borrow additional blocks of addresses from other companies.

Anyone can work through all the IP v4 addresses simply by counting from 0 upto 2**32, for simplicity the display of these numbers is broken up into the 4 bytes that make up the 32 bit integer and the value of each byte is displayed separated by a dot.

I don't know why your router did not receive  any attempts to scan it before, perhaps a software upgrade has resulted in some  changes (you can see when the firmware  was last updated through the GUI).

This problem is not new, I remember back in the mid-late 80's computers being probed through X.25 (PSS or IPSS being used back then) and certainly in the early 90's when on TCP/IP.

[Anonymous]

I'm certain whoever it is, is trying to get at me through the phone. I've stopped using the DECT phones and sent them back to BT, but I'm using my landline via one of the adaptors instead, so it's still the same system.

Received a phone call a few minutes ago, I didn't answer as the number was not recognised by myself and no message was left. Looking the number up on Google I cannot find any information, but more than likely some spam call.

Router logs show

10.52.40 SIP (some number starting with p) RECV INVITE

10.52.40 SIP (some number starting with p) SEND 180 INVITE

10.52.40 DoS(Port Scanning): IN=ppp0 OUT= MAC= src=159.192.104.177 DST=My current IP address LEN=60 TOS=0x00 PREC=0x00 TTL=47 ID=41812 DF PROTO=TCP SPT=23235 DPT=2209 WINDOW=0 RES=0x00 URGP=0 MARK=0x8000000

10.53.10 SIP (some number starting with p) RECV CANCEL

10.53.10 DSP (some number starting with p) - CallEnd Underruns 44 PeakUnderruns 21

10.53.10 SIP (some number starting with p) SEND 200 CANCEL

10.53.10 SIP (some number starting with p) SEND 487 INVITE

10.53.10 SIP Error responses sent - Mon Jan 29 10:53:10 2024, INVITE, 487, ip address which I think belongs to BT as it always shows the same one located at Bristol

10.53.10 SIP RECV ACK

10.53.17 SIP RECV NOTIFY

10.53.17 SIP SEND 200 NOTIFY

This has happened quite a few times over the last couple of months, 5 incoming phones calls which I blocked as they were showing spam calls when looked up, port scan exactly the same time and 1 incoming phone call from a friend, port scan exactly the same time. I know people can get your landline numbers marketing etc, any company that has been breached in the past if they had your info. I did answer a call in December as it was showing the same area code I live in so thought it was a relative, I only said hello, realised it was a spam call when they mentioned boilers and loft insulation, put phone down and blocked, but if they were ringing me from a computer and port scanning same time, would the phone show my IP address to them at their end? Just wondering as that is roughly when these attacks started.

[Anonymous]

Could an admin please explain why every time someone rings in to our landline, a port scan starts at exactly the same time? A taxi service rang today automated call just to let us know car was on its way, at exactly the same time a port scan came in from the same Chinese company, which is always the one to attack first when a variation of the IP address I have happens.  We are still worried sick something is happening with the phone line, this is definitely not a one off or coincidence, it has happened loads of times now 😞. Is it possible someone is listening in, I've checked diverts etc are off which it states they are? Would an admin also please erase the IP address I mentioned on the above post, just in case whoever it belongs to is also viewing this forum, thanks

[Anonymous]

Hi.

I reset the router this morning with my computer and TV turned off, kept the computer off until 6pm and then checked the logs. I'd been given a brand new IP address, totally different for a change, so things were looking good, until I checked the router logs. At 2pm, there had been one port scan to the new IP address. I recognised the attackers IP number straight away, as it is always the same one which attacks first, whenever the IP address has been altered (based in China). How on earth can someone get a new IP address when my computer is not even turned on. It has also been totally wiped a few weeks ago, memory totally cleared too, nothing found when running scans on it, so as far as I am aware it's safe. I don't think it's a case of the new IP address is already compromised too, otherwise why is it the same IP address that always gets the new number first? I'm convinced the DECT system is sending the IP address out to this China location, or if they know my landline number, is it possible they can pick up my IP address that way via the DECT system? There is something clearly not right here, all I was hoping for was a safe secure connection when moving to this new fibre 900 and it is far from safe 😞  Even seeing port scans in the logs at the same time as incoming calls, that cannot be right and should not be happening. It's as though someone else knows when an incoming call is being received so they can try to listen in, couple of times on outgoing call a scan has started too. Any help/advice would be appreciated please. Thank you 

[ptrduffy]

Hi @Anonymous

The only help/advice anyone here can give you is, as has already been said, not to worry about this.

You say that you got a "brand new IP address" this morning.  That IP address may be new to you, but its existence is already known to anyone in the world who is interested.  It has the form a.b.c.d, where each of the a/b/c/d is a number between 0 and 255 - allowing for some reserved combinations, that means there are roughly 3.7 billion options.

We can do some simple hacker maths.  If I have a computer that can send messages to 100 IP addresses per second (that's slow for a PC), then that one computer can scan 360,000 addresses per hour, or 8,640,000 addresses per day.  At that rate, with only one computer it would take ~428 days to scan every possible IP(v4) address.

But hackers don't limit themselves to one computer - they use botnets, massive networks of compromised computers.  By the same maths as above, a botnet of ~428 computers can scan all IP addresses every day.  Scale that up to 10,000 or 20,000 and you can scan all IP addresses every hour.

The above is true whether your interface has a shiny new IP address that has never been used anywhere before (extremely unlikely), or one that's been recycled from another user.

This is the reason we use firewalls.  They recognise these probes from hackers, log a message to note that they've happened, and then ignore them - as we all do, and as you should too.

I personally have over 35 years experience in networks and computing; there are others on here who will have similar or more experience.  We've seen this happen for decades, and it's not going away any time soon.  Your firewall is doing its job - the log messages you're seeing should be a reassurance to you, not a source for concern.

[Anonymous]

If that's the case then why is it always the same Chinese company/IP that attacks me first, if there are loads of bots on the internet ready to port scan, then surely percentage wise, I'd expect to see another coming in first, but this is never the case.
It just so happens entering this companies name into Google and asking if it is linked to BT too, shows China Mobile International has partnered with BT to launch CMLink in the UK a few years ago. What a surprise, exactly what I had expected.

China Mobile is the damn thing that attacks any new IP address given to me first, before the rest decide to join in. As for these port scans happening at the same time I make a phone call or someone rings in to me, that should definitely NOT be happening. I'm going to report this elsewhere, out of loads of IP addresses I must have received over the years, the router logs have never ever shown DOS attacks until recently. The Firewall is doing its job with regards to my computer, main concern is the actual phone line and if it has been compromised. Too many odd things are happening with calls.

[countrypaul]

@Anonymous  you  asked "How on earth can someone get a new IP address when my computer is not even turned on." - the IP address is given to the Internet facing connection of the router not to your computer. Your computer under normal circumstances will be given an IP address beginning 192.168.1 assigned to the interface on your internal network so normally ethernet or WiFi, the router's interface to your internal equipment will be 192.168.1.254  There is often the assumption that with TCP/IP an IP address is given to a computer when it is actually to an interface on that computer (though most home PCs only have one interface to consider), other networks would assign a network number to a computer (DECnet was an example). 

A router is just a dedicated computer with multiple interfaces, whether they are Ethernet, xDSL, x21, rs232