Re: modem hijacking or internet dumping

Re: modem hijacking or internet dumping
Secure Home | Search | About
Login Password
Register Now! Lost Password?
 Computer Software Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Re: modem hijacking or internet dumping Moe Trin 08-30-2006
Posted by Moe Trin on August 30, 2006, 3:50 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
On Tue, 29 Aug 2006, in the Usenet newsgroup alt.computer.security, in article

>David H. Lipman wrote:
>
>>
>>| Hi, Can modem hijacking happen to someone who uses broadband (not dsl)
>>| and doesnt have a phone line hooked up to their computer? I am a little
>>| new to the topic, any help would be appreciated.
>>
>> Plaese elaboarte on what what you are trying to ask.
>
>I thought the OP was talking about downloading programs that then try to
>place calls via your phone, i.e. highjacking the modem.

My interpretation was that the O/P was concerned about those wonky add-on
"tools" needed to connect to some web sites - that turn out to be mal-ware
that reconfigures the windoze Dial Up Networking setup to replace the
existing (presumably "local") phone number with one in Central Africa (or
some other "friendly" region) and suddenly the dial in to the ISP isn't
a local call any more, and the telephone bill is running $LARGE_NUMBER
of $CURRENCY_UNITS per second.

Where this _MIGHT_ impact a broadband user without a telephone line and
appropriate modem is if the "tool" reconfigures the networking setup,
trying to disable the broadband connection so that the system _has_ to
use the dialin to the foreign country. Not very likely, but possible.
The mal-ware actually should trivially detect that this is a broadband
connection (rather than dialin), and there are much better things it can
be subverted for.

What would be FAR more likely is the installed mal-ware converts this
broadband connected system into a support zombie - serving pr0n or SPAM
to the world at no cost or risk to the bad-guy. If something goes wrong,
the O/P takes the heat, and the bad-guy can't be found. What's new?

To the O/P: The mal-ware is going to go for the broadband connection (DSL
or Cable - doesn't matter) for the same reason you converted to broadband.
Bandwidth. Do you remember how long it took to bring up a single full
screen image from someplace on the net over a telephone line? With cable,
it comes up just like that! Now, think of the poor spammer trying to
deliver that marvelous offer of p*n*s ex**nder pills to every household in
Ohio using that same dialin line. Don't you think the spammer would rather
use your high speed connection to do the same task, especially when there
is no cost to the spammer, and you're the one people want to lynch?

Old guy

Posted by David H. Lipman on August 30, 2006, 7:52 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

| On Tue, 29 Aug 2006, in the Usenet newsgroup alt.computer.security, in article
|
>> David H. Lipman wrote:
>>
>>>
>>|> Hi, Can modem hijacking happen to someone who uses broadband (not dsl)
>>|> and doesnt have a phone line hooked up to their computer? I am a little
>>|> new to the topic, any help would be appreciated.
>>>
>>> Plaese elaboarte on what what you are trying to ask.
>>
>> I thought the OP was talking about downloading programs that then try to
>> place calls via your phone, i.e. highjacking the modem.
|
| My interpretation was that the O/P was concerned about those wonky add-on
| "tools" needed to connect to some web sites - that turn out to be mal-ware
| that reconfigures the windoze Dial Up Networking setup to replace the
| existing (presumably "local") phone number with one in Central Africa (or
| some other "friendly" region) and suddenly the dial in to the ISP isn't
| a local call any more, and the telephone bill is running $LARGE_NUMBER
| of $CURRENCY_UNITS per second.
|
| Where this _MIGHT_ impact a broadband user without a telephone line and
| appropriate modem is if the "tool" reconfigures the networking setup,
| trying to disable the broadband connection so that the system _has_ to
| use the dialin to the foreign country. Not very likely, but possible.
| The mal-ware actually should trivially detect that this is a broadband
| connection (rather than dialin), and there are much better things it can
| be subverted for.
|
| What would be FAR more likely is the installed mal-ware converts this
| broadband connected system into a support zombie - serving pr0n or SPAM
| to the world at no cost or risk to the bad-guy. If something goes wrong,
| the O/P takes the heat, and the bad-guy can't be found. What's new?
|
| To the O/P: The mal-ware is going to go for the broadband connection (DSL
| or Cable - doesn't matter) for the same reason you converted to broadband.
| Bandwidth. Do you remember how long it took to bring up a single full
| screen image from someplace on the net over a telephone line? With cable,
| it comes up just like that! Now, think of the poor spammer trying to
| deliver that marvelous offer of p*n*s ex**nder pills to every household in
| Ohio using that same dialin line. Don't you think the spammer would rather
| use your high speed connection to do the same task, especially when there
| is no cost to the spammer, and you're the one people want to lynch?
|
| Old guy

Malware doesn't care what Internet connectivity you have. It just want's to
launch its
payload which is often Internet related.

It is just that connection to Broadband increases the cahnce of being infected.

Malware will happily infect a DUN connected PC.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm



Posted by spviking on August 30, 2006, 10:24 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Yes Moe trin is correct this is what I was referring to. My Cousin uses
Time Warner's Road Runner here in New York and he got his recent
Verizon phone bill and found 600 dollars worth of calls to Cameroon,
Austria and Madagascar. The phone company told him it was likely modem
hijacking (what Moe Trin described). My cousin does not have his phone
line plugged into his computer at all and we cant figure out how this
malware could have effectively charged his phone bill. Sorry I was so
vague initially.

Thanks again!


David H. Lipman wrote:
>
> | On Tue, 29 Aug 2006, in the Usenet newsgroup alt.computer.security, in
article
> |
> >> David H. Lipman wrote:
> >>
> >>>
> >>|> Hi, Can modem hijacking happen to someone who uses broadband (not dsl)
> >>|> and doesnt have a phone line hooked up to their computer? I am a little
> >>|> new to the topic, any help would be appreciated.
> >>>
> >>> Plaese elaboarte on what what you are trying to ask.
> >>
> >> I thought the OP was talking about downloading programs that then try to
> >> place calls via your phone, i.e. highjacking the modem.
> |
> | My interpretation was that the O/P was concerned about those wonky add-on
> | "tools" needed to connect to some web sites - that turn out to be mal-ware
> | that reconfigures the windoze Dial Up Networking setup to replace the
> | existing (presumably "local") phone number with one in Central Africa (or
> | some other "friendly" region) and suddenly the dial in to the ISP isn't
> | a local call any more, and the telephone bill is running $LARGE_NUMBER
> | of $CURRENCY_UNITS per second.
> |
> | Where this _MIGHT_ impact a broadband user without a telephone line and
> | appropriate modem is if the "tool" reconfigures the networking setup,
> | trying to disable the broadband connection so that the system _has_ to
> | use the dialin to the foreign country. Not very likely, but possible.
> | The mal-ware actually should trivially detect that this is a broadband
> | connection (rather than dialin), and there are much better things it can
> | be subverted for.
> |
> | What would be FAR more likely is the installed mal-ware converts this
> | broadband connected system into a support zombie - serving pr0n or SPAM
> | to the world at no cost or risk to the bad-guy. If something goes wrong,
> | the O/P takes the heat, and the bad-guy can't be found. What's new?
> |
> | To the O/P: The mal-ware is going to go for the broadband connection (DSL
> | or Cable - doesn't matter) for the same reason you converted to broadband.
> | Bandwidth. Do you remember how long it took to bring up a single full
> | screen image from someplace on the net over a telephone line? With cable,
> | it comes up just like that! Now, think of the poor spammer trying to
> | deliver that marvelous offer of p*n*s ex**nder pills to every household in
> | Ohio using that same dialin line. Don't you think the spammer would rather
> | use your high speed connection to do the same task, especially when there
> | is no cost to the spammer, and you're the one people want to lynch?
> |
> | Old guy
>
> Malware doesn't care what Internet connectivity you have. It just want's to
launch its
> payload which is often Internet related.
>
> It is just that connection to Broadband increases the cahnce of being infected.
>
> Malware will happily infect a DUN connected PC.
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> http://www.ik-cs.com/got-a-virus.htm


Posted by David H. Lipman on August 30, 2006, 11:04 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

| Yes Moe trin is correct this is what I was referring to. My Cousin uses
| Time Warner's Road Runner here in New York and he got his recent
| Verizon phone bill and found 600 dollars worth of calls to Cameroon,
| Austria and Madagascar. The phone company told him it was likely modem
| hijacking (what Moe Trin described). My cousin does not have his phone
| line plugged into his computer at all and we cant figure out how this
| malware could have effectively charged his phone bill. Sorry I was so
| vague initially.
|
| Thanks again!
|

Yes. There are Trojan Dialers out there that when installed on a computer will
place 900 or
"off shore" phone calls to pay for services that can cost $40.00 US per phone
call and make
numerous phone calls.

The term "modem hijacking" is non-standard.
Trojan Dialers is the terminology. Those that call 900 number porn content are
known as
Porn Dialers.

Now in relation to your original post. Once infected by a Dialer it doesn't
make a
difference if you are on Broadband or a Dial-Up (DUN) connection. However if
you use DUN,
it will own dial out when you are not using the DUN connection. If you are on
Broadband you
would need a traditional Plain Old Telephone System (POTS) modem (such as a
FAX/modem).
Cable modems and DSL modems are not traditional modems and can't make telephobne
calls.

Good article on Dialers.
http://anti-spyware-review.toptenreviews.com/spyware/trojan-horse-dialers.html

Now if a computer with Broadband has no POTS modem or it has one and NO
telephone line is
connected to the modem then a Trojan Dialer is a Red Herring and look to people
using the
telephone and not at malware on the PC.

HTH

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm



Posted by Rick Merrill on August 31, 2006, 3:12 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
David H. Lipman wrote:

>
> | Yes Moe trin is correct this is what I was referring to. My Cousin uses
> | Time Warner's Road Runner here in New York and he got his recent
> | Verizon phone bill and found 600 dollars worth of calls to Cameroon,
> | Austria and Madagascar. The phone company told him it was likely modem
> | hijacking (what Moe Trin described). My cousin does not have his phone
> | line plugged into his computer at all and we cant figure out how this
> | malware could have effectively charged his phone bill. Sorry I was so
> | vague initially.
> |
> | Thanks again!
> |
>
> Yes. There are Trojan Dialers out there that when installed on a computer
will place 900 or
> "off shore" phone calls to pay for services that can cost $40.00 US per phone
call and make
> numerous phone calls.
>
> The term "modem hijacking" is non-standard.
> Trojan Dialers is the terminology. Those that call 900 number porn content
are known as
> Porn Dialers.
>
> Now in relation to your original post. Once infected by a Dialer it doesn't
make a
> difference if you are on Broadband or a Dial-Up (DUN) connection. However if
you use DUN,
> it will own dial out when you are not using the DUN connection. If you are on
Broadband you
> would need a traditional Plain Old Telephone System (POTS) modem (such as a
FAX/modem).
> Cable modems and DSL modems are not traditional modems and can't make
telephobne calls.
>
> Good article on Dialers.
> http://anti-spyware-review.toptenreviews.com/spyware/trojan-horse-dialers.html
>
> Now if a computer with Broadband has no POTS modem or it has one and NO
telephone line is
> connected to the modem then a Trojan Dialer is a Red Herring and look to
people using the
> telephone and not at malware on the PC.
>
> HTH
>

Are there Trojan dialers that have hijacked VoIP on a computer?


Similar ThreadsPosted
Modem hijacking/internet dumping November 1, 2005, 8:25 pm
Re: Update on Modem hijacking/internet dumping November 24, 2005, 12:55 pm
Re: Update on Modem hijacking/internet dumping November 24, 2005, 6:08 pm
DSL Modem w/ Verizon December 11, 2006, 7:20 pm
(help from Tokyo) dumpsec problems while dumping user and group information February 20, 2007, 7:55 am
CDMA wireless phone/modem config problem ..... please help... TQ September 10, 2008, 3:45 pm
Hijacking October 5, 2006, 10:33 am
A Hijacking Problem June 23, 2006, 11:17 am
Internet Threats for Internet or online (home) Users March 6, 2006, 12:36 pm
Toolbar Hijacking attempt in progress February 25, 2006, 4:18 pm

The site map in XML format XML site map

Contact Us | Privacy Policy