»
 

Go Back   ResellerRatings Store Ratings > ResellerRatings Forums > Tech Support

Reply
 
LinkBack Thread Tools Display Modes
Old 06-05-2003, 12:55 AM   #1 (permalink)
Registered User
 
Join Date: Jun 2003
Posts: 5
ParTyBoy is on a distinguished road
TechIMO network gurus and sys admins I need your help..

So i get a call today from a friend of mine who has cable modem service with GCI here in town... He starts telling me that he's been charged an excessive bandwidth usage fee of $140($20 per gig over) for going 7gigs over the data transfer limit of 5gigs allocated to him in his monthly $39.99 service package.. http://www.gci.com/promos/hypernet/hypernet_yhn6.htm

(Yes I know GCI has a fawking monopoly and is ripping people off for what they offer, but let's try to stay on track with comments ok? )

So anyways I hear this and I know it's a bunch of BS because a lot of things don't add up... See my friend barely knows anything about computers much less more than just surfing online.. He also doesn't play games online... His comp is one of those $500-600 Hewlet packard prebuilt machines with integrated graphics, etc.. His machine still has the pre-installed OS, desktop background, with all the garbage shortcuts, programs that come with it... He installed kazaa once over a year ago then when he had problems he deleted the program directory instead of uninstalling the program and then couldn't install it again... So basically he hasn't been using P2P... Unfortunately, I'm betting print/file sharing is enabled and he has no security either in the form of a firewall, trojan defense suite or anti-virus running.... Also about a month and a half ago my friend tells me his monitor isn't working.. Never got a chance to go over to his house to look at it because i was lazy This is all of what i know from the past....


So around 6:40pm i stop by his house and he calls up GCI... The main reason I stopped by is because i knew he personally couldn't have used that much data... He works a 10 hour day usually then goes to play tennis or work out at the athletic club then stops by a friends house and 6-7 of us play halo matches for about 3-4 hours while getting f'd up... This is 4-5 days a week... He doesn't use mIRC or any p2p program since kazaa stopped working on his comp last year, etc.. Basically he's as far away from a power user as could be...

I arrive and check out his computer while he's talking to tech support.. Granted he has no idea what to say to the guy other than he got a $140 charge... Try to power up the monitor and the physical lcd display won't intialize or show any signs of power ... the button led does light up though.. check power connection plugged to surge protector & monitor to serial port, both are plugged in snug... The machine was off I looked at cable modem and it looked active.... Fired up the machine and sure enough the OS ran because the windows wav file played... still the monitor would not run....

At this point his mother tells me that new neighbors moved in around january and last month my friend's dad noticed the neighbor spliced their outside cable line and ran it into the neighbor's house... Both my friend and the neighbors units are side by side with no zero lot line because they live in condos.... there is no seperation distance between either unit.... Turns out the neighbor used to work for some cable company... My friend's dad called up GCI and they came over and disconnected the line back in april... Suddenly this starts sounding that much more fishy to me... I look out the window from the 2nd story into the backyard and sure enough there's a cable line runing off their short 5"x5" fence running 3" off the ground/in the air over 30 feet to the telecom box.... Looks like the neighbors hooked the cable back up after GCI disconnected it because if i understand correctly lines are buried when installed and further the condo association wouldn't take nicely to a cable stretching 30 feet in the air if they knew about it...

Now here's where I need help or a better understanding about stealing cable... My friend has a cable modem with a MAC address that distinguishes his signal as authentic... My question is that even though my friends signal is established as legit is there anyway the neighbor could be tapping into my friends computer easily and using his bandwidth due to his print/file sharing options not being restricted....

I talked with the tech support guy and explained the situation, everything above... and how things just don't add up... I asked the tech for a readout on the data transfer stats... supposedly the month in question my friend uploaded over 6gigs of data, while downloading 4gigs.. In addition i asked for long term stats... and get this...


In the summer/fall months last year my friend average 1gig of data transfer per month uploading/downloading..... THen all of a sudden in January (when the neighbors moved in) his data transfer jumped to over 7 gigs and progressively increased to 12gigs per month by the end of April... Then suddenly the usage dropped off May 6th.... Guess what ? The Cable guy who lived next door moved out early may....

Talk about a red Herring....... Well the tech guy sounded nice but unfortunately, they seem like they could careless what happened as long as they get money out of this.... I'm trying to find a way to get him out of it because i know he didn't use the data...

TechIMO i need your help... I know this is my first post here and got reffered from another board... Any Ideas??


:Cliffnotes: Friend got charged $140 for excessive data transfer (7gigs) and there's a 99% chance either the neighbor stole his cable or his machine got hacked... Need help to get him out of charge with his ISP>...

ParTyBoy is offline   Reply With Quote
Old 06-05-2003, 01:04 AM   #2 (permalink)
Registered User
 
Micro Bean's Avatar
 
Join Date: Feb 2003
Location: Worcester, MA
Posts: 344
Micro Bean is on a distinguished road
Ekkkkk Darn those stealers!! Well only thing I can think of is have a tech come out and test the lines. And if they are stealing then they are in big trouble Cable theft is no joke sad to say. This has happened to someone in near where I lived before all they did was tape in and added a cable modem to that line and they were all set but unfortunatley they got caught cause they sent a auditor out and they got fined big time
__________________
Dodge :)
Micro Bean is offline   Reply With Quote
Old 06-05-2003, 01:11 AM   #3 (permalink)
Banned
 
Siliconjunkie's Avatar
 
Join Date: Feb 2003
Location: Houston, TX
Posts: 1,595
Siliconjunkie is on a distinguished road
Send a message via AIM to Siliconjunkie
I don't know how GCI does it, but with RR it is all based on the MAC address of the modem. So even if the thief was using his drop they would have to use another modem, which would not make it appear as him.

Does he have wireless? If not, physically trace each wire from modem to PC and make sure that nothing has been added. Beyond that I would be looking for a virus, perhaps an IRC bot or mass mailer. Alot of the file sharing bots you see on the "bad" IRC channels are rooted/hacked boxes. This is the more likely case than someone "borrowing" his connection. Ask the ISP if they can tell you anything more about the traffic, destination/source port would be nice since that would be the 1st step in identifying what the traffic was/is.

In the mean time, tell him to shut it down when not using it.
Siliconjunkie is offline   Reply With Quote
Old 06-05-2003, 01:13 AM   #4 (permalink)
Registered User
 
Join Date: Oct 2001
Location: TOO close to Wash DC
Posts: 7,956
vass0922 is on a distinguished road
Install a software firewall on his box and watch what tries to connect
__________________
<< Insert exceedingly large and overly verbose message of how 1337 you are here including full specs of every vehicle you've ever driven and PC you've owned >>
vass0922 is offline   Reply With Quote
Old 06-05-2003, 01:18 AM   #5 (permalink)
Banned
 
Siliconjunkie's Avatar
 
Join Date: Feb 2003
Location: Houston, TX
Posts: 1,595
Siliconjunkie is on a distinguished road
Send a message via AIM to Siliconjunkie
Vass's suggestion is a good one as well, also if he was an IRC bot look for a hidden dir somewhere with a bunch of files in it that you dont recognize.
Siliconjunkie is offline   Reply With Quote
Old 06-05-2003, 02:35 AM   #6 (permalink)
Registered User
 
Agent_Embryo's Avatar
 
Join Date: Oct 2001
Location: Sweden
Posts: 1,260
Agent_Embryo is on a distinguished road
Send a message via ICQ to Agent_Embryo
That sucks in a major way. I would think this could and should be reported to the police. The was most likely stealing cable. A MAC adress can be spoofed, as can an IP. This is very serious. I say turn to the police or a lawyer or something.

Hope this turns out ok for your friend.

/AE
Agent_Embryo is offline   Reply With Quote
Old 06-05-2003, 02:45 AM   #7 (permalink)
Banned
 
Siliconjunkie's Avatar
 
Join Date: Feb 2003
Location: Houston, TX
Posts: 1,595
Siliconjunkie is on a distinguished road
Send a message via AIM to Siliconjunkie
The same MAC address on the same segment of cable would cause all kinds of problems. The person would also have to be able to spoof the MAC address on the modem, not on the router/PC. They would probably also notice multiple IPs issued to 1 MAC. While it is possible to spoof a MAC address it wouldnt work well in this scenario.
Siliconjunkie is offline   Reply With Quote
Old 06-05-2003, 02:54 AM   #8 (permalink)
Registered User
 
Agent_Embryo's Avatar
 
Join Date: Oct 2001
Location: Sweden
Posts: 1,260
Agent_Embryo is on a distinguished road
Send a message via ICQ to Agent_Embryo


I only said it was possible.
Agent_Embryo is offline   Reply With Quote
Old 06-05-2003, 05:07 AM   #9 (permalink)
Registered User
 
Join Date: Jun 2003
Posts: 5
ParTyBoy is on a distinguished road
Quote:
Originally posted by Siliconjunkie
Vass's suggestion is a good one as well, also if he was an IRC bot look for a hidden dir somewhere with a bunch of files in it that you dont recognize.
Remember I said he doesn't use irc he barely knows how to surf let alone use commands he didn't get a spam bug more than likely...
ParTyBoy is offline   Reply With Quote
Old 06-05-2003, 05:16 AM   #10 (permalink)
Banned
 
Siliconjunkie's Avatar
 
Join Date: Feb 2003
Location: Houston, TX
Posts: 1,595
Siliconjunkie is on a distinguished road
Send a message via AIM to Siliconjunkie
He wouldnt have to have installed IRC. Without going into details, basically they install IRC bots via things like Code Red/Nimda or other vulnerabilities. And, this would explain the sudden huge bandwidth usage.

They would get their bot installed, it would connect to an IRC server somewhere and join a channel, then they would upload the files to it and it would start offering and people start downloading. This is quite common really.
Siliconjunkie is offline   Reply With Quote
Reply




Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On


Most Active Discussions

Recent Discussions

All times are GMT -6. The time now is 04:03 AM.