Has our router been breached?

[Lupin-2]

Hello.  I've just joined the VM Community and would be really grateful for some help.

We have a VM Superhub 2.  A week ago our internet security company informed us that an "unknown device" had connected to our system.  Its IP address is 82.34.144.1 and the name alongside it is Cadant Inc, which is a US modem manufacturer.  When we rang Virgin to ask about this IP, they said it was not one of theirs and were unable to shed any light on the matter.  However, a Google search shows that it is a Virgin Media IP address.  

Further research on the internet shows that Cadant Inc was bought out in ‘01/02 by a company called Arris, and that Arris do work with Virgin Media.  Nevertheless it is very odd that this “unknown device” should suddenly connect to our router or network.  We are anxious to know how and why this could have happened.  And more than anything, we are worried about a possible security breach if our router has been breached.  Is it an indication of malicious activity?

If anyone else has had the same or a similar experience recently, we would be very glad to hear from you.  Or if anyone knows what this could be about and could offer reassurance or guidance on what we should do about it, we would be extremely grateful.

[用心棒]

Are you able to name the security company involved and/or:

• their relationship with you, for example customer
• the circumstance under which they contacted you
• how they determined an unknown device connected to your LAN

I'm a Very Insightful Person, I'm here to share knowledge, I don't work for Virgin Media. Learn more
Have I helped? Click Mark as Helpful Answer or use Kudos to say thanks

[Lupin-2]

Sure, and thanks for getting back so quickly.
1. Our internet security company is ESET. We have been their customer for many years.
2. I was working online and noticed a pop-up message arrive on-screen telling me that an "unknown device" had connected to our system.
3. I don't know how they determined that an unknown device had connected to our LAN but on the "Connected Home Monitor" screen in the software's Tools section, I can see (on a kind of sonar view) the IP address and name of the unknown device.

[newapollo]

Hi Lupin-2,

the ip address quoted is a dynamic ip address with Virgin, so Virgin could check who it's assigned to.

As a matter of interest have you checked to see if it's actually your IP address? https://whatismyipaddress.com/

It may be a new device that you've bought that connected to the internet, or possibly somebody connecting to your VM guest network if you have it turned on

[Lupin-2]

Hi Dave.

Thanks very much for your speedy reply.  When we asked Virgin about the IP address, they said it was not one of theirs.  This is part of the mystery, because a Google search shows that it IS a VM address.  We can't understand why they deny this.

We know our own IP address (we checked) and it's not the one in question.  We haven't bought any new devices or connected any new devices to our internet since early December.

I didn't know you could turn OFF a guest network (and we haven't had any guests for many months).  Do you mean it could be a guest from a while back who might have been passing through our area and connected to our network?

How would we turn off the guest network, please?

Lupin

[-tony-]

a quick search confirms this is a VM address - said to be in Hornsey N8 london - who did you speak to who said it was not VM - whoever it was seems to have no idea - offshore maybe - that would sound about right

as to the rest of your questions - i have no idea what would be interesting is to know where you are based - the 2 locations might be relevant 

https://www.proxydocker.com/en/iplookup/82.34.144.1

[newapollo]

Hi again Lupin_2,

I doubt you have Guest network turned on if you aren't sure how to turn it off, however the picture below shows where to find it in your router settings. If it's on just endure there's a tick in the Disable guest network security button if you want to turn it off.

I have mine on so the nephews, nieces etc can use my connection when they come round without me having to set them up.

If you've signed up to share Virgin Media wifi hotspots then anybody who's with VM can connect using your connection if they are close by. This doesn't interfere with your own connection or security. They can't see what you are doing or connect to any of your devices.

The Virgin Media Connect app gives Virgin Fibre and Virgin Mobile customers free access to 20m WiFi hotspots in the UK and abroad

EDIT -  forgot to enclose the picture - sorry 

Wifi Hotspots 

BT do the same for their users.

[Lupin-2]

Hi Tony.

Thanks for your message and for the link.  Not sure where the VM staffer was located but he had an Indian accent.  Very possibly offshore.

Hornsey N8 (north London) is indeed very close to us, but we don't know anyone there.

Lupin

[newapollo]

Hi again Lupin_2,

IP addresses aren't exact however the lookup I did  shows the one you posted as being near to Haringey, Tottenham (N15 area)

When I check my own IP address it lists me as being located in a postcode 1/2 a mile away, so I guess that's close enough, however it used to have me listed as being 4 miles away 😛

[Lupin-2]

Great message.  Thanks very much, Dave.  We'll check our router settings.

I don't think we've ever signed up to share Virgin Media wifi hotspots.  My better half uses the Virgin Mobile network.  Does that mean he necessarily has the Virgin Media Connect app?  He has the WiFi hotspots option permanently switched off, but it's weird that if any other Virgin Mobile user in our area could use our connection, no one has in 5 years until now!

Lupin