BT Internet using monthly Gb download in a day

[jacktar]

Hi Folks, A friend received an email from BT advising him that he was almost up to his monthly limit of 10Gb ( his usual monthly download is around 1.5Gb )
Phone call to BT allowed access to check his router etc. and showed him onscreen that a wireless device named ETHO was connected and his download was now over 20Gb, up 10Gb since Friday.
The router had been switched off from Friday until he phoned them on Monday,so how could an unknown device even connect during this time?
When he informed the BT caller of this, he was told it could be done through the mains wiring !!!!!!!!!! ( I don't think )
So the router was switched off, he has no powerline modules in system, oh! and the telephone line was also unplugged from the Fri - Mon as well.
I have googled ETHO but not found anything, there are no kids in the house and neighbours have checked out ok as well.
Bit of a mystery then or is BT at it

Your views much appreciated JT

[gem]

Are you sure that the email was ACTUALLY from BT?

Did he phone the number on the email or a number he had looked up?

[jacktar]

Are you sure that the email was ACTUALLY from BT?

Did he phone the number on the email or a number he had looked up?

Originally Posted by gem

Hi Gem, yes... seemingly BT emails you when you have used 30%, 50% and 90% of your download monthly data.... or similar % not exactly sure as I am NOT a BT customer.
The conversation with the BT adviser was instigated by my friend on the official BT helpline although he did say the advisors 1st language was not English... if you know what I mean.
So NO internet connection ( due to router switched off and phoneline unpluggged ) and gets bill for extra 10Gb download..... something very strange there in my opinion
Will find out more over weekend as he was told to monitor his download via his BT usage meter online...... Something not adding up here.

JT

[centaur]

Is it possible to either clone a router, or could the manufacturing process have allowed such a thing I wonder ?

Is it actually a BT supplied router ?

Is there anyone else in the house with access to this router ?

It's a bit worrying.

[jacktar]

Is it possible to either clone a router, or could the manufacturing process have allowed such a thing I wonder ?

Is it actually a BT supplied router ? Yes a home hub I think

Is there anyone else in the house with access to this router ?Only his wife who accesses via smartphone for recepies on a Sat morning

It's a bit worrying.

Originally Posted by centaur

Yeah! I am an engineer and can't see how his internet could be accessed when router is switched off

Hi Centaur, yes you may have valid points re cloning etc.
I will see how his monitoring and download volume goes over the weekend.
I will show him how to access his wireless router pages and see if this ETHOS shows up again................ very strange cheers JT

[centaur]

Has he tried changing his password to see if that's been hacked ?

Something with a difficult mix of upper/lower case and odd characters should do the trick.

One other thought, could it be that the smartphone is somehow remaining connected and using the bandwidth ?

[jacktar]

Yep I changed the password for him last week.

Things are getting out of hand on the Internet now, Smart TV's sending data back to manfacturer and perhaps I should ask my friend if he has purchased a new FRIDGE recently see here:

http://www.bbc.co.uk/news/technology-25780908

http://www.proofpoint.com/

I am all for new technology but do we really need all this

JT

[centaur]

So, might it actually be the 'smartphone' remaining connected to the internet and using the bandwidth ?

[jacktar]

So, might it actually be the 'smartphone' remaining connected to the internet and using the bandwidth ?

Originally Posted by centaur

Sorry, checked this as well, she switches her phone off when she's finished her recepies.
Really only uses it for emergencies when out & about.
Am dropping by in the next day or two to see how things are going.

JT

[centaur]

This is almost certain to be a daft question, but has a full A/V and antimalware scan been run, including the boot sector ?

I'm agog to know how this turns out !

[jacktar]

I'm agog to know how this turns out !

Originally Posted by centaur

Yes ME too.
Latest update:

Phoned BT again and they helped change router login details & wireless key.
Computer came up clean with Malwarebytes and Avast found minor threats, might even been false positives

BT asked friend to inform Police even, but local station said if he wanted a crime no. the National squad would take over rather than the local force
He also said it would most likely result in his computer being taken away for inspection .... He didn't go down this line.....

He checked his BT online usage meter over the next 3 days and it only showed a few Mb (he's not a big user) Every thing seemed fine.... Yesterday I connected my Windows phone and it showed up in the router page fine, no other wireless devices attached. His wife has had her phone switched off for over a week now!!!!

THEN... this morning he phoned me to say that a wireless device (eth0) had shown up in his router wireless page. He disconnected the mains & telephone from his router at this point.... he had to go out.

So if the passwords were changed can a hacker or whoever crack the new ones in a matter of days???? Maybe cloning is a possibility Centaur !!
I think a change of router here is needed to start with ...... to be continued

JT

[centaur]

Any more news ?

I take it the eth0 refers to an Ethernet connection, which looks impossible unless there is a clone of the router somewhere, and within wifi distance as well !

[centaur]

It's been a while since any more news, but I came across This report about a virus which can infect a wifi access point or router, and it struck me that it might be something like this which could be the culprit ?

[jacktar]

It's been a while since any more news, but I came across This report about a virus which can infect a wifi access point or router, and it struck me that it might be something like this which could be the culprit ?

Originally Posted by centaur

Thanks for that Centaur, there has been big developments regarding my friends situation and Police investigations are ongoing.

He has shut is wifi connection down so no longer getting hit with big download bills.
His wife has unlimited data download on her phone so doesn't need wifi anyway.

All I can say at the moment that software called Co*pa**y ( I don't want to advertise it ) although Google finds it quite easily was involved by 3rd parties.

I also came across this

http://www.computerworlduk.com/news/...ntwrkng;link_2

I will post when I know a bit more

JT

[jacktar]

Friend's neighbour has now been hit with 10Gig download warning email from BT.... looking like spotty teenagers 4 doors up are pretty good at hacking passwords etc. More info to follow when I know


JT

[Behemoth]

Friend's neighbour has now been hit with 10Gig download warning email from BT.... looking like spotty teenagers 4 doors up are pretty good at hacking passwords etc. More info to follow when I know


JT

Originally Posted by jacktar

I suspect they are using some form of Linux to do that then, there is something out there called BackTrack which can do that.

[Sdavid]

Keep us updated on what is going on over there. This seems incredibly frustrating to have to deal with. Plus now I am extremely interested in how they actually managed to abuse this much bandwidth like that. Are BT actually going to hold your mate accountable for the usage or no?