Possible line splicing and internet theift.

[hairystuff]

Hi, this is my first posting for help and I hope it's in the right section, if anyone has any knowledge on the subject it would be much appreciated.

A couple of weeks ago I was getting a lot of drop outs and finally my line went dead on the 11/10/16 now here's the weird thing the fiber and the phone line was dead for nearly 4 days and my usage according to plusnet was 300GB for the period I was offline, I started to poke around at the usage statistics on the members section on plusnets website and found that my internet usage has been incredibly high for the last 3 weeks around 900GB which I can only account for about 120GB of, I know my WiFi hasn't being compromised and I know none of the devices on my network haven't create the traffic because the modem I'm using (HG612 ver B3) shows I have only used so much data and the router tallies up too so I'm at a loss and starting is to think maybe someone has been splicing/piggybacking off my connection between the cabinet and home, I have disabled the automatic TR-069 modem login and have gone the manual route (as I suspect if someone is using spliced in hardware the TR-069 protocols would auto configure the modem for use of my paid service), I have also changed my broadband password as an extra measure.

Even though my line was completely dead Plusnet are adamant I was connected and used all that data during the downtime, I'm not bothered about the data as I'm not on a cap or limit but I am worried if someone has spliced into my phone/land line somewhere.

 

[mjslakeridge]

If you can view detailed usage statistics on your ISP's website down to the day (maybe even by the hour), you could try to repeat the experiment by completely turning off your router for a period of time, and then when you turn it back on look at the usage.

It wouldn't be hard for someone to splice into your phone line if they knew the route it is buried between the main box, usually just outside the subdivision and your house. At least here in the US, that wire is usually a 4 pair conductor.

 

[hairystuff]

Hi, thanks for getting back to me, digging up seems like a lot of work but there are service/manhole covers for communication cables where someone could patch in, there's also distribution points where 4 pair of wires inside a single cable come in and get distributed to each home/apartment (1 pair per line) which is the more probable point of splicing/patching, either way I need to get to the bottom of the issue because my ISP seems to think my fiber connection was actively being used when I had no connection whatsoever, disabling the TR-069 protocol and changing the password seems to have settled the ISP's usage statistics but I'm going to observe it tomorrow and see if it's abnormally high or normal, the only other thing I can do is disconnect everything for a couple of days and see what the ISP statistics say then.

With cable broadband at least the modem was verified via the mac address and serial number before a connection could be made, VDSL and ADSL in conjunction with the use of TR-069 is very insecure if your line has been compromised through splicing with no verification/validation checks of connected equipment.

 

[hairystuff]

Hi, just to update you, I managed to get the problem rectified in the end, from what was explained to me, there was an upgrade done at the BT OpenReach exchange and they managed to duplicate my "Broadband circuit Service ID" to someone else's connection so both modems where fighting for the connection, disabling the TR-069 and changing the password stopped my data from being used but it still didn't remedy the dropouts and disconnections, so the telecoms engineers managed to sort out the problem at the exchange and checked the line from the exchange down to the cabinet and from the cabinet to the distribution/junction box then finally to my home, as a bonus the engineer replaced both my old sockets with the newer ones, I was pretty much blamed for the excess data usage even though my line was dead and disconnected and convincing the service provider was no easy feet until I got the right technician on the phone, but at least it's fixed now.

 

[mjslakeridge]

That is interesting that they could even duplicate your service ID and issue it to someone else. You would think they would have better internal controls than that.

Glad you got it sorted out.

 

[hairystuff]

Thanks for your reply mjslakeridge, I could understand if it was hardware related like a patch panel and 2 lines had gotten crossed accidentally but I'm guessing this would have all been done in some kind of virtual switch with software controls like a VLAN setup but I'm not an expert on that subject just guessing.

 

[jsmithepa]

As long as they are not charging you anything for the brouhaha, you learned ISPs are stupid.

I sincerely think for your residential service, there is a core group at ISP HQ, maybe 1/2 dozen employees who truly knows what's going on and they are too good to talk to you, they are like level-5, and most of the problems revolves levels 1-4 where people have limited knowledge, limited access, their jobs is to run you through the bureaucracy.

Business service is better, specially if you are mid/high corporation, you are assigned an call-me-direct Account Rep, who is able to put you in direct contact with a real engineer if problem not trivial.

 

[hairystuff]

Luckily they they sent an engineer out for free but initially the ISP wanted to charge for the engineer service till I kicked up a fuss and said that I would leave if the issue was not resolved, I have only ever had a top tier tech talk to me twice in the last 10 years of having ADSL/Fiber, the techs were tier 1 and didn't seem to have a clue about the issue and seemed to be running off an automated script.