Comcast Sent 625K Copyright Alerts To ‘Pirating’ Customers

H

HardOCP News

[H] News
Joined
Dec 31, 1969
Messages
0
Wow, 625,000 notices, over seventeen hundred a day, from a single ISP? :eek:

The MPAA, RIAA and five major U.S. Internet providers launched their six-strikes Copyright Alert System last year, and today we can reveal additional details on the scope of the anti-piracy measures. Information obtained by TorrentFreak shows that Comcast has sent over 625,000 anti-piracy warnings to its customers since the program launched.
Click to expand...
 
A couple months ago, I had someone begin hacking into my wireless network and leaching my bandwidth. I'd notice from my DHCP lease list. (I'm a systems admin, and I practice and learn by frequently rebuilding my server that serves out DHCP and DNS. I often will switch between OSes, Windows 2008, 2012, Ubuntu, RedHat, FreeBSD, in order to learn how to do things with each. I know my devices quite well, and I know when someone else is on my network because of all this.) I couldn't locate specifically which other apartment it might be coming from, but I was able to get him to quit by having my network frequently down. I now only turn on my wireless network when I need to connect my tablet to the internet, which isn't all that frequent now. About 2 months after it started and about a week before I encouraged him to quit hacking my wireless, I got one of these notices from Comcast. It's just not fair that I had to get this because some other a--hole was hacking my wireless.
 
How were they hacking into your network? Were you using WEP? I haven't read any WPA/WPA2 hacks that are wide in circulation or easy to do. Would be interested to know.
 
dgingeri said:
A couple months ago, I had someone begin hacking into my wireless network and leaching my bandwidth. I'd notice from my DHCP lease list. (I'm a systems admin, and I practice and learn by frequently rebuilding my server that serves out DHCP and DNS. I often will switch between OSes, Windows 2008, 2012, Ubuntu, RedHat, FreeBSD, in order to learn how to do things with each. I know my devices quite well, and I know when someone else is on my network because of all this.) I couldn't locate specifically which other apartment it might be coming from, but I was able to get him to quit by having my network frequently down. I now only turn on my wireless network when I need to connect my tablet to the internet, which isn't all that frequent now. About 2 months after it started and about a week before I encouraged him to quit hacking my wireless, I got one of these notices from Comcast. It's just not fair that I had to get this because some other a--hole was hacking my wireless.
Click to expand...


A system admin allowing said leecher to sit on your network and use it for piracy? And you cry that it isn't fair you got slapped with a piracy notice?

Change your fucking wireless security and password. I don't feel bad at all for you, infact, you fucking deserve it.
 
I was using WPA2-PSK only. I even turn off WAP. I had a passkey that is 20 characters long, with caps and lower case, but no numbers or special characters. I figured at 20 characters it would be hard to hack. I then changed it to something with 25 characters, caps and lower case, and numbers, but no special characters. My router wouldn't let me put a period in it. The mystery device got on the next day. I'm guessing he must be capturing it from sniffing packets between my tablet and my wireless access point.

I name all my systems after Star Trek ships, so I know when mystery devices appear. My android phone doesn't ever have 802.11n wireless or bluetooth turned on. It drains the battery too quickly. My work phone is the same. My tablet is a WinRT tablet named Yellowstone, so I know when it connects. The only other devices are my main machine and my servers, all with very recognizable names. My main system is Excelsior. My server is SFC. My storage server is DS9. My VM host is UtopiaPlanitia. My HTPC is Voyager. (Yes, no Enterprise. I did that intentionally.) Also, at the time my DHCP server was Windows 2008r2, and I got a very clear list of all DHCP leases and device names. So, when something like BROCK43A (not the right device name, but it's something similar, it had a name and numbers in it, but I can't remember precisely what) appears on my network, I know my wireless has been hacked.

On top of all that, I do not share out any software, movies, or music. The only BitTorrent type traffic that happens from my machines would be from the Blizzard WoW updater. I do plenty of watching shows from Hulu, Amazon, and Netflix, but I doubt they'd be mistaking that traffic for file sharing.
 
If his wireless router has WPS, it doesn't matter if his WPA2 passphrase is a paragraph long. It's been well documented that even disabling WPS doesn't stop the exploit. I can crack WPS on a weak signal in less than a day on an old amd x2 machine. Anything less than a router physically without WPS and/or one that uses custom firmware to truly disable it is insecure.
 
Apparently comcast wants to learn another lesson that other ISPs already have. You send those out. I switch ISPs. Nuff said. I hope you enjoy that google and verizon competition, suckers.
 
The Avalon said:
A system admin allowing said leecher to sit on your network and use it for piracy? And you cry that it isn't fair you got slapped with a piracy notice?

Change your fucking wireless security and password. I don't feel bad at all for you, infact, you fucking deserve it.
Click to expand...

I did change that, repeatedly. He'd get back on within a day. That was with the best security available for a home wireless router, WPA2-PSK. My passkey was 20 characters at first, and just grew from there. After the fourth time he hacked in, I gave up on changing my passwkey and just went back to the original. (My second passkey was "Wireless80211gAccess" which was defeated between Saturday afternoon and Sunday morning one weekend. My third was "Resist4nce1sFut1le" which could have been hacked anytime between that Sunday and Saturday two weeks later. Do you think those would have been easy to guess or even get through using a brute force method?) This hacker must have been using automated tools for this access, with as quickly as he was adapting to my changes.

I didn't have the resources I have at work, forcing user level authentication from Cisco based business access points. (I don't even maintain that part of the network, or any security. I manage the software test labs' infrastructure.) So, don't go thinking there's something better I could have done.

Granted, I wasn't checking my DHCP lease lists every day. It was mostly just on weekends. I never just let him sit on my network after finding him there. I also only got hints he was on the network from DHCP leases. If he used a static IP, I wouldn't have been able to notice unless I logged into the wireless router I use as an access point and looked at the device list, which is rather time consuming and annoying to do. I didn't do everything I could have to keep him off, but I did put a reasonable effort into it. Demanding more would have been too time consuming and annoying.

I'm not incompetent at my job. I've done a lot of good work here and many people have complimented my work, and I've survived 6 waves of layoffs and had my duties expand from being an off hours support tech for one remote lab to now being the admin for 4 labs, one of which is remote.
 
arnemetis said:
If his wireless router has WPS, it doesn't matter if his WPA2 passphrase is a paragraph long. It's been well documented that even disabling WPS doesn't stop the exploit. I can crack WPS on a weak signal in less than a day on an old amd x2 machine. Anything less than a router physically without WPS and/or one that uses custom firmware to truly disable it is insecure.
Click to expand...

What is this WPS hack you're talking about? I haven't heard of it. I have a WD N900, which does have WPS, but I turned that off. If that is the vector he used to get it, I'd like to know more about it.
 
Come on, a sysadmin who can't find a perp's MAC address and re-direct all his web to ?
 
So this is cool then. You can pirate your brains out until you get a notice and you are good to go!
Better than them just gathering evidence and then smacking you in the back of the head with it.
 
dgingeri said:
I didn't have the resources I have at work, forcing user level authentication from Cisco based business access points. (I don't even maintain that part of the network, or any security. I manage the software test labs' infrastructure.) So, don't go thinking there's something better I could have done.
Click to expand...

Couldn't you have just setup filtering in your MAC addresses for the router? unless he had a way to spoof and use one of your MAC addresses, there's no way around that.
 
There are devices readily available now for a a couple hundred that can pretty easily hack pretty much any wireless connection, including cell signals and automobile remotes.

So yeah, wireless security is pretty much worthless now until they come up with something significantly different.
 
ashmelev75 said:
Come on, a sysadmin who can't find a perp's MAC address and re-direct all his web to ?
Click to expand...

MAC spoofing is pretty easy to do. Quite a few motherboards even let you change the physical MAC address.

And if they person was connecting through the router, it is even easier since you can change the MAC to whatever you want.

Packet sniff, discover connected MAC, duplicate it, and you are in.
 
dgingeri said:
What is this WPS hack you're talking about? I haven't heard of it. I have a WD N900, which does have WPS, but I turned that off. If that is the vector he used to get it, I'd like to know more about it.
Click to expand...



Reaver implements a brute force attack against Wifi Protected Setup (WPS) registrar PINs in order to recover WPA/WPA2 passphrases, as described in http://sviehb.files.wordpress.com/2011/12/viehboeck_wps.pdf.


Reaver has been designed to be a robust and practical attack against WPS, and has been tested against a wide variety of access points and WPS implementations.


On average Reaver will recover the target AP's plain text WPA/WPA2 passphrase in 4-10 hours, depending on the AP. In practice, it will generally take half this time to guess the correct WPS pin and recover the passphrase.
Click to expand...


https://code.google.com/p/reaver-wps/
 
cyclone3d said:
There are devices readily available now for a a couple hundred that can pretty easily hack pretty much any wireless connection, including cell signals and automobile remotes.

So yeah, wireless security is pretty much worthless now until they come up with something significantly different.
Click to expand...

Pretty sure if someone is just a regular residential user with a "couple hundred" to spend on said device, they don't need to steal someone else's internet.
 
J Macker said:
Couldn't you have just setup filtering in your MAC addresses for the router? unless he had a way to spoof and use one of your MAC addresses, there's no way around that.
Click to expand...


airmon-ng to find their mac address then


Code: 
# ip link set dev interface down


Code: 
# ip link set dev interface address XX:XX:XX:XX:XX:XX


Code: 
# ip link set dev interface up
 
cyclone3d said:
MAC spoofing is pretty easy to do. Quite a few motherboards even let you change the physical MAC address.

And if they person was connecting through the router, it is even easier since you can change the MAC to whatever you want.

Packet sniff, discover connected MAC, duplicate it, and you are in.
Click to expand...

Windows even has a MAC address setting for any NIC. It's really easy to spoof a MAC. I learned that way back in the 802.11b days. I tried MAC filtering on my first wireless router, until I heard how easy it was to circumvent. I quickly abandoned it for just using a server as a router and not using wireless. I'd be without it today if my tablet didn't need it. I hate wireless. It's so incredibly insecure.
 
The Avalon said:
Pretty sure if someone is just a regular residential user with a "couple hundred" to spend on said device, they don't need to steal someone else's internet.
Click to expand...

Oh, they probably use someone else's "couple hundred." How do you think they get it? It's invest-steal-reinvest-profit.
 
J Macker said:
Couldn't you have just setup filtering in your MAC addresses for the router? unless he had a way to spoof and use one of your MAC addresses, there's no way around that.
Click to expand...

mac address filter does nothing for someone who wants to get in, period (see airmon-ng)

or go download Kali linux, i could have your mac address in seconds and those of every device broadcasting a signal, ican also show you what mac is associate to what AP / Wireless device by running one command

airmon-ng mon0

done...
 
dgingeri said:
Good lord, those designers really dropped the ball with WPS. That's just incredibly stupid.

Well, off to shop for an access point that doesn't support WPS. I should probably just upgrade to 802.11ac since I'm at it.
Click to expand...

Get a device that supports DD-WRT. Install a version of DD-WRT that does not include WPS support.
 
Anyone know of a 802.11ac router without WPS? I've looked at 5 of them from Asus, TrendNet, Netgear, Buffalo, and Cisco, and they all have WPS.
 
Cyraxx said:
Apparently comcast wants to learn another lesson that other ISPs already have. You send those out. I switch ISPs. Nuff said. I hope you enjoy that google and verizon competition, suckers.
Click to expand...

When your only other choice is a crappy 3Mbps AT&T DSL line, makes switching providers less of a choice.
 
dgingeri said:
Anyone know of a 802.11ac router without WPS? I've looked at 5 of them from Asus, TrendNet, Netgear, Buffalo, and Cisco, and they all have WPS.
Click to expand...

You should just use the 5ghz for your wifi and turn off 2.4ghz if dude keeps hacking you. The range of 5ghz sucks and I really doubt any neighbors would be able to get a consistent speed unless they are directly next to you... Then you will know who the fk is stealing your internet if they keep doing it.
 
sok0 said:
You should just use the 5ghz for your wifi and turn off 2.4ghz if dude keeps hacking you. The range of 5ghz sucks and I really doubt any neighbors would be able to get a consistent speed unless they are directly next to you... Then you will know who the fk is stealing your internet if they keep doing it.
Click to expand...

Some router hardware, like the AC66U with Merlin's firmware, allow the user to control wifi antenna broadcast power
 
The Avalon said:
A system admin allowing said leecher to sit on your network and use it for piracy? And you cry that it isn't fair you got slapped with a piracy notice?

Change your fucking wireless security and password. I don't feel bad at all for you, infact, you fucking deserve it.
Click to expand...

Good lord, full blown nerd rage. Chill out
 
Another reason i don't miss Comcrap. But I know the day will come when AT&T (my only choice for Internet) will do the same. Just like they started capping Internet BW that Comcrap started. :(
 
The Avalon said:
Pretty sure if someone is just a regular residential user with a "couple hundred" to spend on said device, they don't need to steal someone else's internet.
Click to expand...

Hrmm, couple hundred to be able to NOT pay for ISP vs pay for ISP at $30-$70+ per month.

Pays itself off pretty quickly now doesn't it?
 
This is all pretty much nonsense, anyway. I'm on Comcast and I've gotten some of these "copyright infringement notices" before. None of them say anything about having to take any action, or that you are on "X out of 6 strikes" or whatever, so there is really no clear course of action for you or Comcast after receiving one. I am pretty sure Comcast just blindly sends them out just to appease the MPAA/RIAA or whatever, and then just does nothing.

Interestingly, I don't think I've ever actually received one for movies or music, only for TV shows and very rarely even at that.
 
EDIT: And actually, if I go to my Comcast login page, there are no Copyright notices shown in thier system. So, again, nonsense.
 
Yeah, unless it's a letter from an attorney, it's a scare tactic. And even if it were from an attorney, there are so many Copyright trolls these days looking to make a quick buck, it's better to pay no mind
 
beowulf7 said:
Another reason i don't miss Comcrap. But I know the day will come when AT&T (my only choice for Internet) will do the same. Just like they started capping Internet BW that Comcrap started. :(
Click to expand...
Newsflash, ATT was one of the first companies to sign on voluntarily to the program and participate. Seriously.
 
jmilcher said:
Exactly.

I know more about wireless security and securing networks than this guy.

If you were my sys admin you'd be fired for incompetence.
Click to expand...

For one, I'm not the wireless or security guy. I'm a server guy. you wouldn't get past my servers. Second, I'm stuck with a home router for a wireless access point, which apparently has a huge security hole that I didn't even know about until today.

Third, I have been through 6 waves of layoffs in my company without getting laid off. They're expanded my responsibilities to include what others were doing, so apparently I'm doing quite well. My responsibilities started at being the secondary guy there for off hours support for a remote test lab and have expanded to being responsible for 3 software test labs at my location and now one more remotely in California. I designed most of the network infrastructure in the test labs, which has specifically excluded wireless. If I was an admin at a place that requested wireless access, I would do my best to oppose it. Wireless sucks. It's massively insecure and unreliable.

Finally, how the heck would you route someone's MAC address to somewhere else? Maybe you have something in your magic bag of tricks, but there are no functions like that in Windows routing or Linux routing (iptables, blech, took way to long to learn what I do know about that crappy program) that I have ever seen. I've seen some functions in Windows routing for specific IP addresses, but it is clunky to work with, and just a change in IP address would get around it. Even if there were a way to redirect someone by MAC address, that's an easy thing to change, too. Morons.
 
Cyraxx said:
Apparently comcast wants to learn another lesson that other ISPs already have. You send those out. I switch ISPs. Nuff said. I hope you enjoy that google and verizon competition, suckers.
Click to expand...

The problem with that in the states is that typically, there are NO other options.
 
Forget the issue of if dgingeri is competent enough to secure his wireless. Comcast sent the notices assuming it was him doing the tor traffic. Seems to me, they'll send one of these 'infringement notices' out just soon as they'll fart in the wind.

And they are both relevant. You smelling a fart near me in a public space doesn't mean I let it go. But they treat these IP addresses as proof that it was my ass.
 
You must log in or register to reply here.
Back
Top