cancel
Showing results for 
Search instead for 
Did you mean: 

DDOS/DOS Help

ZHackH
Joining in

Hey Ladies and gents. I have been a VM customer for about 13 years... The following is something I'll break down into two sections. The story/Proof and help/advice. Feel free to skip to the advice section if the long read is not for you.

The story/Proof

I've lived at my current address for about 8 years. My neighbour for the last 4. We've always been very polite and neighbourly. Hi and a smile. Most importantly, I've never heard him and his wife. which is ideal given we live in a terraced house. However, when the pandemic hit this guy lost his job and my assumption is that with our current economy things haven't improved. During the first lockdown this guy started to drink. I'd seem him stumbling outside or clearly intoxicated. Eventually, in 2022 he started crashing around his home late at night, shouting screaming etc etc. Politely I'd brought up the subject, not even in a direct way more so "I heard some strange noises" etc. He apologized profusely. But soon after, I'm talking within a few days, I started hearing something rubbing against the wall.

Side note: My living room wall is adjacent to his hallway/entrance and stairs

The sound, sounds exactly like someone rubbing their hands together. My initial thought was that the neighbour was doing painting and decorating, but this was followed by my connection dropping and reconnecting. Like someone turning a light switch on and off. My initial response was new LAN cables and a "new" router from VM. But this bought me a few days and this disconnect followed by an immediate reconnect resumed. The evidence that I this drop and reconnect was actually intentional came from my neighbours wife. He being drunk and his wife frustrated had a blow up where she specifically said "$*&%ing around with the neighbours internet." His drunken response was along the lines of "Who does he think he is." Just riddled with more expletives. None of which he said when we spoke face to face.

I took this info to my VM and they identified the drops but said they don't have the capabilities to stop it and that I would d need to I myself would need to ID the source ETC ETC. Long story short they can't do much without certain legal criteria being met beforehand. I plan to get this too them but obviously my first priority is stopping this attack.

Advice: VM suggested that I can put my router into router mode and use an external router. My research initially took me to VPN routers but eventually led me peplink routers which are built with enhanced security in mind. To be honest, router security beyond a long password that I change periodically, isn't something I am familiar with. However I am eager to learn. My hope is that using a router which is more secure is my first step and that Surf Soho/peplink can assist. I had no idea that VM routers were this vulnerable. But my question is will router mode help.

This is what the hack looks like: https://imgur.com/AwabF8c/embed?ref=https%3A%2F%2F

The above in recorded from my tv while playing a gaming console. I've edited the vid to show one instance but in practice happens several times per minute. On/off. I've been a gamer since the Super Nintendo. Before console were online and I've never experienced anything like that. I didn't even know what a ddos was until I realized it was intentional.I came here because most people suspect that DDOS on me as an individual isn't worthwhile. Assuming that one individual would need a multitude of machines, physically, at his address. Despite the fact that you can purchase DOS attacks online

Please advise.






 

Please help.

 

34 REPLIES 34

goslow
Alessandro Volta

@ZHackH wrote:

Hey Goslow

I did disconnect my router for about 20 minutes this morning. I do that in attempts to change the ip and the only other bit of help I recieved. The network logs do not show any other entries beyond the ones I posted earlier. As for the BQM, the disconnects happened between 11:30 -12:30. I myself took the router offline.

@Andrew
The BQM is tracking my router. I'm using a VPN. The attack as we call it is device specific. It targets the console and knocks me offline. The console is unmoved, untouched apart from a duster. IF you're seeing something one the BQM that doesn't make sense please share. I am using the router / Lan connection with my console.

@client
I'm almost ashamed to say that I don't get what a noise issue is

<snip>

As always I really appreciate the help and guidance. I'm sure this can reach a successful conclusion. So again, thanks.


I am going to have to leave it to others to try and progress this but I'd also query (as per Andrew-G's question at #18 as to what your BQM is measuring). If you turned off your hub for 20 mins this morning there would be a big red solid block showing on the BQM where contact was lost with the VM hub. If you set up the BQM via the console and behind a VPN then you are not recording the connection to the VM hub. If you are using a VPN on the console, that is a further possible issue for consideration in the investigation (though IMHO, this issue is something to do with your VM, or VPN, connection dropping momentarily). The matter of the wall-rubbing neighbour is certainly one of the most unusual issues that I've read on here! Good luck with resolving the problems. I shall certainly be following the topic with interest for further updates and, hopefully, a resolution.

Noise is interference of the signal that reduced the ability of the service to work well.
Typically this is caused by damaged cables & loose connections.

Hi goslow. Don't leave just yet, please.

I set up the BQM as requested. My router isn't using a VPN. I have a VPN on my laptop and no other device. I find it interesting that despite turning off my router for 20 minutes the BQM doesn't reflect that. Should I turn off my VPN?

Also, what do you recommend I do with the next disconnect? Bring the same info you've asked for but asap instead of hours later.

Hey Client. Thanks for the clarification. I appreciate it.

goslow
Alessandro Volta

@ZHackH wrote:

Hi goslow. Don't leave just yet, please.

I set up the BQM as requested. My router isn't using a VPN. I have a VPN on my laptop and no other device. I find it interesting that despite turning off my router for 20 minutes the BQM doesn't reflect that. Should I turn off my VPN?

Also, what do you recommend I do with the next disconnect? Bring the same info you've asked for but asap instead of hours later.

Hey Client. Thanks for the clarification. I appreciate it.


If you have a VPN running on your laptop and you set up the BQM on the laptop via the VPN then when you set up the BQM, the IP address will not be the public IP address of your hub but (I am guessing) the IP address of the VPN server?

So using your laptop, turn off the VPN. Then use the whatismyip link and find the public IP address for your VM connection and then set up a new BQM with that. That way you'll be monitoring the VM hub.

(You refer to a router but, for clarity, are you just using a VM hub alone and do not have a third-party router in the mix as well?)

goslow

I'm finally getting it.

Should I use the consoles IP address, since it's that device that's being attacked and use that in conjunction?

 

Thanks.

goslow
Alessandro Volta

@ZHackH wrote:

goslow

I'm finally getting it.

Should I use the consoles IP address, since it's that device that's being attacked and use that in conjunction?

Thanks.


No, set up the BQM to monitor your VM hub's public IP address. All we are interested in at the moment is monitoring the connection to the VM hub. Put all thoughts of hackers, DDOS and wall-rubbing neighbours out of your mind for the time being. You can come back to those if an ordinary explanation doesn't present itself.

The aim is to match a drop in the BQM for the VM hub, with a time you experience a problem on your console and also see if anything is recorded at the same time in the network log of the VM hub. If the three things happen together you might get a clue as to the cause of your issue.

Hi ZHackH,

Thanks for using the forums to get this issue with your connection looked into, I am sorry if this has been causing some frustration. I would be more than happy to look into this for you.

I think Goslow is right in saying lets just focus on the connection side of things, see whether it can be explained by the usual suspected faults and then I can resolve them for you. 

However, if I cannot find any reasonable fault, or I do and get it resolved on my side but you still experience the issue, then I would need to leave you in the capable hands of the community as we can't offer support with DDOS attacks 😞 

The first thing I want you to do is follow some simple advice - 

  • Can you log into your Online Account and perform a diagnostic test to see if it detects any issues?
  • How is your Console connected to the Hub? WIFI or wired? (Sorry if this is already mentioned, there was a lot of info to read through on this thread!)
  • Are the symptoms you're experiencing slow speeds or full drops in connection, where the Hub shows failure lights too? 

That should be enough for me to go off for now, we'll continue after you've done those steps.

Thanks,

Megan_L

Here is my router after the drops knocks today.

Betweeen 9 and 10/11pm

Screenshot 2023-01-23 230144.png

Hope this helps.

I would suggest this is nothing to do with the neighbour and the upstream channel on 16QAM is set there intentionally.

I reckon at some point you've joined a voice chat or something that's given some moron your IP address. This very rarely changes on VM so they can keep using this to interrupt your gaming. 

I would be looking at your competitors on the game, not your neighbour. He has no way of knowing what you're doing even if he were tapping the signal from outside.

@goslow any thoughts on the graph/chart?

Hey ipfreely. I only game with friends and never with randoms. I mainly play single player games, I haven't actually had any disruption to my online gaming in terms of interruptions, because of single player games. Whoever is behind it simply made me aware they could do it.