Modem reboot attacks

[wheresmycar]

My sons play rocket league and fortnite and claim one of their relatives/friends has their IP address and somehow manages to boot them from the game > which results to Modem reboot with 10-15 mins of wait time before everything is up and running again. I'm not sure what to believe but the other kids at some point previously admitted to doing this. My son also claims it all started when they sent a link to his phone and then compelled him to open it (which he did).

The reboots have occurred several times according to my sons. Today I too witnessed the same with zero access to the net.

Can anyone shed some light on this. Is any of this possible or am I experiencing network problems which are non-related to the above. If possible, how can I resolve this issue going forward. I have already popped the same message to our ISP to get some feedback.

 

[RJARRRPCGP]

This may be related to the same group who's responsible for the "VPN Filter" router malware.

 

[natr0n]

Get an ip address change perhaps... call them up.

 

[wheresmycar]

Get an ip address change perhaps... call them up.

I was just looking online for similar reports in the ISPs online community forum. From what I've read the reboot changes the IP address automatically... not sure if this is correct. Maybe mine remains static for a longer period of time... as it does change occasionally (weekly/monthly - not sure). Might have to take it up with the them as i'm lost at sea with this sort of stuff. I can just about tie my shoe laces let alone wrap my head around the more complex networking stuff

This may be related to the same group who's responsible for the "VPN Filter" router malware.

Sorry have no idea about this sort of stuff.

So it's a common/known issue? I was initially under the impression the kids were being duped

 

[RJARRRPCGP]

Sorry have no idea about this sort of stuff.

That was nasty hack attack stuff from a malicious hacking group. Bad enough that people would be required to replace the router, if not also the motherboard!

 

[jboydgolfer]

maybe a DNS filter could help? im not sure if that filters incoming traffic though

 

[Bill_Bright]

From what I've read the reboot changes the IP address automatically...

Nope. When broadband to the home first came out ~30 years ago, you could get a new IP address assignment just by unplugging power to the modem for 30 minutes to an hour. The IP assignment would "expire" and next time you connected to your IPS, you would be assigned the next available address.

Not any more. Just like phone numbers, the world starting running out of available IP addresses. This is exacerbated by the fact ISPs are only given a block of numbers (think area code) - they don't have the entire pool to drawn from.

While technically, there are over 4 billion possible IP addresses available with the 32-bit IPv4 system, because of how blocks of addresses assigned, the actual number is much smaller. I note there are over 7.7 billion people in the world. Of course, not everyone has their own IP address, but more and more residencies, and places of business do. Many businesses have several (or even many) IP addresses assigned to them.

So ISPs typically still initially assign IP addresses via DHCP, once assigned to your account, it stays assigned unless changed manually by your ISP's tech support.

IPv6 allows for essentially an unlimited number of available addresses, but ISPs are still assigned blocks of numbers and so still semi-permanently assign individual addresses to each account.

@wheresmycar - for sure, the admin password and wifi passphrase should be changed, ASAP.

 

[wheresmycar]

thanks!

- changed admin password for router/modem + wifi passphrases

- requested an IP change with the ISP and informed them of the problem

- also now looking to invest in a router (i'm currently using VM's superhub both in modem and router mode)

Any recommendations for a router? Mesh wifi? I've been looking at options here https://www.techradar.com/uk/news/n...router-9-top-wireless-routers-on-test-1090523 but don't have the foggiest idea what to target... preferably something in the ~£100 region (or more if necessary). In reference to routers and any advice given... i've started a new thread here: https://www.techpowerup.com/forums/...outer-all-advice-would-be-appreciated.281015/

 

[DeathtoGnomes]

thanks!

- changed admin password for router/modem + wifi passphrases

- requested an IP change with the ISP and informed them of the problem

- also now looking to invest in a router (i'm currently using VM's superhub both in modem and router mode)

Any recommendations for a router? Mesh wifi? I've been looking at options here https://www.techradar.com/uk/news/n...router-9-top-wireless-routers-on-test-1090523 but don't have the foggiest idea what to target... preferably something in the ~£100 region (or more if necessary). In reference to routers and any advice given... i've started a new thread here: https://www.techpowerup.com/forums/...outer-all-advice-would-be-appreciated.281015/

what router do you have now? have you ever updated it?

 

[Bones]

Normally just powering down the modem itself for a couple of hours causes a new IP to be issued by your provider and the old one returned to the pool of available IP's.

The only thing different I can think of is if the provider has a definite assigned (Static) IP to your modem.
Note it has to be the modem you shut off, not the router; Esp if you have a setup with both and most folks do that I know of but can't hurt to power down both if you want. If what you have is a combo of both that makes it more convenient.
It normally goes by the top of the hour when it's timed so if you leave it off for about three hours (Overnight maybe?) that should cause a new IP addy to be issued by the provider.

 

[Bill_Bright]

Normally just powering down the modem itself for a couple of hours causes a new IP to be issued by your provider and the old one returned to the pool of available IP's.

As noted above, that is how it used to work. And that is how DHCP normally works too. So with our home and business LANs (local area networks) - that is, everything on our side of the modem - we can typically totally power off (unplug) our connected devices and get a new IP number assigned by our own (or the corporate) router. This is because LANs typically use 192.168.xxx.xxx address blocks - meaning there can be millions and millions of LANs using the exact same 192.168.1.1 (or 10.0.0.1) "Default Gateway" address and millions and millions of computers all being assigned the same 192.168.1.xxx addresses.

And that works because every modem around the world must have a unique IP address - thus ensuring your computer using 192.168.1.4, for example, does not get the data meant for my computer using 192.168.1.4.

BUT - there is a limited number of unique IP addresses that can be assigned to our modems - and with IPv4, those numbers are running out. Especially when the big providers, only have a very limited number of IP addresses to draw from. And one way to make managing their available numbers easier is to use "sticky DHCP" IP numbers.

Remember, again there is only a limited number of IP addresses available. And our ISPs can't just pick any IP address from the entire pool and assign it to us. They are given a limited block of numbers by the Internet Assigned Numbers Authority (IANA) and they must manage that block of numbers. The big ISPs may have millions of subscribers, and thus a lot of IP addresses to keep track of.

So powering off the modem for a couple hours, or even many days to get a new IP address assignment, typically does not work that way any more for the IPs addresses assigned to our modems by our ISPs. You have to call them up and ask them to unstick it and hope they don't give you a hard time.

So "in theory", yes you can power off and get a new IP address. But "in practice", it does not work that way anymore.

*****

As a side note - for fun, pay attention to IP addresses shown on TV and in the movies. Remember, there are only 256 possible numbers (0 through 255) in each octet of an IP address. So for IPv4 addresses, the largest possible address is 255.255.255.255. Yet on TV and in the movies, you will often see numbers like 384.20.563.746. LOL

 

[wheresmycar]

what router do you have now? have you ever updated it?

I'm not sure if phrasing this correctly but both my router and modem are built into one... it's the packaged device given to us by the ISP > Virgin Media Super Hub 3.0. I believe updates are done automatically and initiated from the ISP.

Normally just powering down the modem itself for a couple of hours causes a new IP to be issued by your provider and the old one returned to the pool of available IP's.

The only thing different I can think of is if the provider has a definite assigned (Static) IP to your modem.
Note it has to be the modem you shut off, not the router; Esp if you have a setup with both and most folks do that I know of but can't hurt to power down both if you want. If what you have is a combo of both that makes it more convenient.
It normally goes by the top of the hour when it's timed so if you leave it off for about three hours (Overnight maybe?) that should cause a new IP addy to be issued by the provider.

Powered it off for around 4 hours. Same IP address.

I'll try the all-nighter option next. It's odd the IP address does change every couple of months or so. Not sure in what circumstances that occurs or it may be automated at the ISP end.

 

[Bill_Bright]

I'll try the all-nighter option next. It's odd the IP address does change every couple of months or so.

That's not likely. ISPs have no technical reason to change IP assignments. They often refresh, but not change. Even when there is a security issue, they don't like to change because then what happens to that address? They don't want to pass the security risk to another customer.

 

[Night]

So ISPs typically still initially assign IP addresses via DHCP, once assigned to your account, it stays assigned unless changed manually by your ISP's tech support.

Not entirely correct.

To request a new IP, log in to your router as admin, under Network > WAN settings (or similar), Release WAN Lease, then Renew WAN Lease, you should be assigned with a different IP now. It could depend on your ISP though.

 

[Hachi_Roku256563]

Nope. When broadband to the home first came out ~30 years ago, you could get a new IP address assignment just by unplugging power to the modem for 30 minutes to an hour. The IP assignment would "expire" and next time you connected to your IPS, you would be assigned the next available address.

Not any more. Just like phone numbers, the world starting running out of available IP addresses. This is exacerbated by the fact ISPs are only given a block of numbers (think area code) - they don't have the entire pool to drawn from.

While technically, there are over 4 billion possible IP addresses available with the 32-bit IPv4 system, because of how blocks of addresses assigned, the actual number is much smaller. I note there are over 7.7 billion people in the world. Of course, not everyone has their own IP address, but more and more residencies, and places of business do. Many businesses have several (or even many) IP addresses assigned to them.

So ISPs typically still initially assign IP addresses via DHCP, once assigned to your account, it stays assigned unless changed manually by your ISP's tech support.

IPv6 allows for essentially an unlimited number of available addresses, but ISPs are still assigned blocks of numbers and so still semi-permanently assign individual addresses to each account.

@wheresmycar - for sure, the admin password and wifi passphrase should be changed, ASAP.

Unless it is specifically dynamic ours changes monthly swapping between IPS available IPS I assume their other customers are the same

 

[Bill_Bright]

Not entirely correct.
It could depend on your ISP though.

Gee whiz. That's why I said "typically" instead of "always".

And yes, your method is how one can typically get a new IP address - but for most, good luck with that. As I said above, "not likely" (and that does not mean "will not") going to happen. If you are tied to a corporate or university type network, that will probably work. But ISPs don't have an unlimited number of addresses and they cannot draw from the entire poll. In fact, they have a relatively small block of numbers assigned to them, and the world is running out.

I certainly cannot speak for all ISP as there are over 2500 in the US alone. But I know Cox Communications, ComCast and few others use DHCP to assign IP addresses to the MAC address of your gateway device - typically the modem. It is still dynamic (as opposed to static), but "sticky". If you power off your modem, even for a couple days, odds are, you will get the same IP address because their network will see that same MAC address.

ours changes monthly

Why? Why would they do that? There is no technical reason or advantage for changing IPs on a regular basis. That would add to the expense of managing their assigned numbers.

See for yourself. Use What's My IP Address? and record your IP. Set a calendar appointment for 1 month and see if it changed.

For sure, I am NOT saying you cannot get a new IP address if you want. And maybe for some ISPs, it is as simple as unplugging your modem for a few minutes, or requesting one through the router's admin menu. But these days, that is not "typical".

Now if that does not work for you, can try changing your MAC address. Many devices let you assign your own. In other cases, you may have to swap in a different device.

Now for the record, if your ISP changes your IP addresses every month, or if your ISP gives you a new number if you simply unplug your modem for a couple minutes, or request one through your router menu, then fine! I am not arguing that point. I am just saying that is not typically these days.

This may illustrate the issue - How to force Comcast IP address to change

 

[Hachi_Roku256563]

and

It has already done it this month lol it means you can't track up by IP because my republic assigns you ones that could be everywhere

 

[Bill_Bright]

because my republic assigns you ones that could be everywhere

This comment tells us everything we need to know.

Have a good day.