1 ACCEPTED SOLUTION
Accepted Solutions
@TK2000 What specific malware did Rogers detect? Was the source IP address, listed on the Rogers malware report, actually the WAN IP address of your modem? If it is different, that would support the theory that this traffic might have originated from a cloned modem.
Did the report indicate that you have an infected device that was actually sending malicious traffic or that you have devices on your network that were responding to network scans which could be used by botnets to launch an attack?
How many devices do you have connected to your home network? Can you trace each MAC address that is connected to your network to a specific device? (You may find the MACVendors Lookup Tool or the Wireshark OUI Lookup Tool helpful to identify the manufacturer of the device.)
For malware the malware case, if you have ruled out your computers and smartphones, other likely culprits are smart TVs, media players or other devices where you can install (potentially infected) apps. Also IoT devices can become infected from the apps that interact with them.
Hopefully, you are not dealing with an actual infection but a network configuration issue, or something that can be fixed through a firmware update.
I have seen quite a few people with this lately on here...
I am wondering if there is one of two things going on here..
A ) That its triggering from another device, not a PC or phone. That there can be a compromised device of another form on the network? Do you have anything else internet connected on the network? Wireless lights, cameras, etc? Many of them have firmware updates (usually available to update through the app for it).
B) That these are triggered from cloned modems.
Now that most people are on unlimited plans.. people are not necessarily watching their usage anymore.
That if someone out there is using a cloned modem, cloning your MAC address, it would look like any usage, etc is all coming from your account. People using these illegal cloned modems, are usually using them for bad purposes. Such as illegal downloading, as well as could be running MAILING, SPAM, VIRUS bots, which would trigger these warnings, on YOUR account.
In these cases.. your best bet would be to swap the modem.
(though not as sure how easy that is right now with covid stuff, etc)
@TK2000 What specific malware did Rogers detect? Was the source IP address, listed on the Rogers malware report, actually the WAN IP address of your modem? If it is different, that would support the theory that this traffic might have originated from a cloned modem.
Did the report indicate that you have an infected device that was actually sending malicious traffic or that you have devices on your network that were responding to network scans which could be used by botnets to launch an attack?
How many devices do you have connected to your home network? Can you trace each MAC address that is connected to your network to a specific device? (You may find the MACVendors Lookup Tool or the Wireshark OUI Lookup Tool helpful to identify the manufacturer of the device.)
For malware the malware case, if you have ruled out your computers and smartphones, other likely culprits are smart TVs, media players or other devices where you can install (potentially infected) apps. Also IoT devices can become infected from the apps that interact with them.
Hopefully, you are not dealing with an actual infection but a network configuration issue, or something that can be fixed through a firmware update.
@TK2000 wrote:
How would I go about initiating a modem swap? Do I just show up at a store? Do I have to go through phone support?
I think that you can swap the CODA modem at your local Rogers store. However, you will first need to call Rogers tech support. They need to generate an order in the system for the swap; the store would then process the swap. (Make sure that you get a receipt for any hardware that you return.) Tech support can probably also arrange for a replacement to get shipped to you.
You should also ask the support tech if they have any way to investigate whether your modem could have been cloned, or if they check to see whether your modem's MAC address is currently active on multiple CMTSs.
@TK2000 wrote:
> data: SOURCE TIME: 2020-08-26 01:02:57Z
Converted to local time in Toronto, that would be 2020-08-25 9:02:57 PM EDT
As for tracking down the cause of these alerts, what you really need is a router/firewall that can do outbound connection logging. You need some way to identify the IP address of the device on your internal network that is making connections to 195.22.26.248. I don't know if your Hitron CODA modem will allow you to do that.
@maximus wrote:
Has anyone else gotten one of these recently? I've gotten a couple, complaining about:
IP: 173.xx.xx.59
PROTOCOL: udp
PORT: 111
HOSTNAME: cpeXXXXXXXXXXXXXXXXad.cpe.net.cable.rogers.com
TAG: portmapper
Here's the thing. My modem is in bridge mode. My public IP reported by my main router (ASUS) is x.x.x.78. No ports open, everything locked down. At first I thought this wasn't my IP, so why are they bothering me?
You are absolutely correct. This is not due to a problem with your router's configuration.
I have also seen other reports of port 111 being open and active on the Ignite gateway with Bridge Mode enabled: https://www.dslreports.com/forum/r33092465-Internet-Rogers-XB6-Ignite-modem-bridge-mode-leaves-port-...
(This is also yet another reason why I sometimes DETEST the Ignite gateways. I would much rather be using a simple modem rather than a modem/gateway that I have very little actual control over.)
However, I can still connect to my modem from 10.0.0.1 from inside my network to check things out. Alas, it ALSO seems to be getting it's OWN public IP even though there are no devices connected to it (wifi/everything disabled). Sure enough, the modem is getting a second external IP (x.x.x.59) AND I got a port scanner and it is seeing port 111 open..
I turned off bridge mode, made sure firewall was full-on HIGH, everything else DISABLED, back into bridge mode, and boom, port still shows up. Didn't find anything like this on this forum, but found this:
https://forums.redflagdeals.com/rogers-internet-security-message-2385144/6/
Is this really a known firmware issue? Should I ignore the notices? Has anyone ever seen this before?
The Ignite gateways run other services internally, even when Bridge Mode is enabled, so they are still active on the network and will still obtain their own IPv4 and IPv6 addresses. Log into your Ignite gateway, go to "Gateway > Connection > Rogers Network" and double-check the gateway's WAN IPv4 address to see if it matches the one in your alert.
You need to report this to Rogers immediately, either by telephone or by sending a private message to @CommunityHelps
Best of luck with getting this resolved!!
@maximus wrote:
I tried with online chat support and response was "you must have a virus on your computer". Well... (a) fully scanned all machines with BitDefender, (b) report is coming from IP of the the modem (no devices connected) and my router is locked down and no issues on that IP. Best way to escalate?
Did you confirm that the IP address on your security report matches the WAN IPv4 address that the Ignite Gateway obtains with Bridge Mode enabled? If so, you can escalate this issue by sending a private message to @CommunityHelps .
@RogersAndy FYI, I can confirm this. I used PortQry to test my own XB6, with Bridge Mode enabled, and can confirm that it does have an open port (and perhaps an active listener) on UDP port 111. I don't get a response but the connection attempt should have failed with an ICMP Port Unreachable.
Here's a good description of the current state of affairs for this issue. It comes from DSLReports post tonight:
scroll down to Eug's post that he titled: Rogers gives two IPv4 address per internet customer
"
All of us with the Rogers Ignite XB6 in bridge mode get two public WAN IPv4 addresses. Dunno about the other modems.
In bridge mode the modem still gets a unique public WAN IPv4 address, and the router you are using also gets a public WAN IPv4 address. It's not a shared address.
I only realized this when I got an email from Rogers telling me I was violating their terms of service because I had a port open. However, the IP address in the email didn't match my router's WAN IP address. Turns out it was the WAN IP address of my modem, and there was a bug in one specific Rogers' XB6 firmware that left one port open. So basically, they pushed out a firmware that had a major bug which left a port open, and then some other department at Rogers sent us warning letters saying we are a security risk because we had a port open."
So, the left hand issues the firmware while the right hand slaps the customers around for running an open port, over which they have no control as its due to the modem's firmware.
You would think when a large number of customers started to show open port 111, all at the same time, that someone would review the daily results and think that something was afoot. That would be the logical conclusion. This is probably all automated, but, someone should be in charge of (read "responsible for") the system, not the other way around.
@Datalink wrote:
You would think when a large number of customers started to show open port 111, all at the same time, that someone would review the daily results and think that something was afoot. That would be the logical conclusion. This is probably all automated, but, someone should be in charge of (read "responsible for") the system, not the other way around.
I don't know how often these scans are run but I have not received this bogus security alert from Rogers yet so, Rogers has not yet scanned their entire complement of Ignite "bridge mode" customers who, themselves, are only a minute percentage of the overall population. Rogers probably do not have anywhere near enough data to identify a trend, even if they tried to.
What matters now is how quickly Rogers can get this issue fixed, especially since their own security tools flagged it. At this point, I am also seriously considering a switch to Business Internet, or any service that will allow me to use a simple modem. The Ignite gateway has too many annoying quirks, and it frustrates me to no end that I do not really have any control over it or its configuration.
@maximus wrote:
yes, confirmed. Started discussion with @CommunityHelps
Thanks! I also sent them a PM. Hopefully, Rogers can get this fixed soon.
-
11764 views
-
11 Likes
-
-
