Check Your Dial Up

xane

Fledgling Freddie
Joined
Dec 22, 2003
Messages
1,695
After my father got scammed by having his dial up changed to a premuin rate number I have been very wary of what is going on.

I have broadband, but I still use dial-up for work, imagine my surprize this morning when I started my work session to see a completely different dial up, with a long telephone number and no username/password.

I checked my Network Connections, and sure enough my work dial up had been renamed and in its place was an anonymous dial up with no username or password, a quick check of the number showed it began with 00, an international line, then 423, which is the code for Liechtenstein !

I have no idea how this number got on my machine, I have a pop up blocker and I regularly run a virus checker and Ad-Aware, and I never respond to any of those stupid certification messages.

Advice for today - if you have a dial up, or you know someone who does, check the number and turn off auto-connect just in case.
 

Ch3tan

I aer teh win!!
Joined
Dec 22, 2003
Messages
27,318
xane you really do deserve that column to post your daily mishaps in :/
 

Cyradix

FH is my second home
Joined
Dec 22, 2003
Messages
2,128
This happens to a friend of mine almost every week.
But he knows nothing about pc's and surfs to porn sites.... :D
 

Will

/bin/su
Joined
Dec 17, 2003
Messages
5,259
If you are really worried, you can call your phone provider and get a (probably free) block put on premium rate numbers. Especially good for those with kids. ;)
 

xane

Fledgling Freddie
Joined
Dec 22, 2003
Messages
1,695
This was not a premium rate number, it was an international code.
 

Will

/bin/su
Joined
Dec 17, 2003
Messages
5,259
xane said:
This was not a premium rate number, it was an international code.
Bizarre. If it was an international premium rate, it would still be barred. If it's a straight international call, then what's in it for them?
 

raw

One of Freddy's beloved
Joined
Dec 23, 2003
Messages
302
Never known of that happening, all though i do remember a few years ago one of the directors was on a porn site and signed up to dial in and set all his dialup settings to the free sex one, in the end he confessed in confidence (oops) and brought it to me :D :D
 

xane

Fledgling Freddie
Joined
Dec 22, 2003
Messages
1,695
Okay, an idea.

I checked some Liechtenstein numbers and this one is too long, I suspect the extra digits are for some kind of automated service.

So, I guess that on initial infection the number is redirected to this international one, then next connection it will gain control of the machine and change it again, or install a premium rate redialler on IE.
 

xane

Fledgling Freddie
Joined
Dec 22, 2003
Messages
1,695
Does anyone know where Dial-Up information is actually held on Windows XP, I have searched the registry but can't find it, are the Dial-Up connection settings in some sort of file somewhere ?
 

'Shy

One of Freddy's beloved
Joined
Dec 22, 2003
Messages
1,824
Happened to a guy at work also, except he didn't even notice till his bill came in and there was one telephone call on there priced at something like £54!

He was told by Oftel that it was a virus that downloaded the number and dialled it, and there was nothing they could do about it :(
 

xane

Fledgling Freddie
Joined
Dec 22, 2003
Messages
1,695
Found it, Dial-Up networking settings are all in a file under
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Pbk
in a file called "rasphone.pbk".

This is maintained by an application called rasphone.exe, which is the default application association for .pbk files.

Apparently there is a buffer overflow exploit in the RAS API application files within Windows, which allows you to add potentially damaging information into the rasphone.pbk file, but in my case the original dial-up setting was renamed, so I think it was somne sort of batch file that did it.

I suspect this might be done from Java, or an IE plug in too.
 

SAS

Can't get enough of FH
Joined
Dec 23, 2003
Messages
1,004
In xp you can see the number your dialing so I usually check that before anything connects, but saying that can that be trusted? :/
 

xane

Fledgling Freddie
Joined
Dec 22, 2003
Messages
1,695
SAS said:
In xp you can see the number your dialing so I usually check that before anything connects, but saying that can that be trusted? :/

There are options on the Dial-Up Properties to remove username/password and to "show progress", both of these were unchecked, the result being you wouldn't know.
 

Deadmanwalking

Fledgling Freddie
Joined
Dec 29, 2003
Messages
812
On a slightly related note. As i was reading this (funnily) enough my phone rang. On picking it up i got an automated message with an american accent saying something along the lines of "Sorry to disturb you, this call was designed to be picked up by an answer phone"

Any ideas wtf that is about?
 

Brynn

Can't get enough of FH
Joined
Dec 22, 2003
Messages
3,261
Yea in america they have auto-dialler phones. Where they have a recored message that they play to every number possible in the area code. And they have it designed to go on the answering machine, so their is no human interference answering questions about it, or to possibly hang up on it. So if it gets to the answering machine it can give all its information with out having to have many variables depending on what the human is asking.

Does that make sence?
 

dysfunction

FH is my second home
Joined
Dec 22, 2003
Messages
9,709
Would probably be best to setup up another fake Dial Up account and set that as your default. Then have your real dial up account as just an extra.

Then whoever is changing the number will change the default dial up but your real one will be unaffected...

I've not had this problem but you could see if that tactic works.
 

xane

Fledgling Freddie
Joined
Dec 22, 2003
Messages
1,695
As it happens I do have a few dial-ups, one is my work and another is my regular broadband ISP which I can use if DSL goes down.

It only changed the lowest alphabetically, what is very curious is that it renamed the old one first and left it there !?
 

xane

Fledgling Freddie
Joined
Dec 22, 2003
Messages
1,695
Just to pimp this warning again, because I think it is important everyone checks their dial-ups, and consider those friends and family as well.

I phoned 150 (BT Customer Service) today and got premium rate numbers (090) blocked on my phone, however I enquired about international numbers and I was told the only way to bar them (together with a PIN to unlock it) is to subscribe to an extra service costing £1.50/month.

Premium numbers can still be costed under the ban by using international calls, so maybe what we need is a check against the rasphone.pbk file to ensure it has not been updated.
 

exxxie

Fledgling Freddie
Joined
Dec 22, 2003
Messages
16
Just out of interest xane, what firewall and OS are you running?

Ive never heard of this exploit.. just checked my dialup number and its ok. Going to google to investigate now.
 

Tenko

Fledgling Freddie
Joined
Dec 22, 2003
Messages
279
Ive come across this one but only when researching some special interest websites :p
 

yaruar

Can't get enough of FH
Joined
Dec 22, 2003
Messages
2,617
exxxie said:
Just out of interest xane, what firewall and OS are you running?

Ive never heard of this exploit.. just checked my dialup number and its ok. Going to google to investigate now.

One of the major advantages of dsl, no problems with this scam.

I've seen pop ups a few times trying to redirect my phone line whilst browsing "research" sites. Although I have quite draconion settings for security on ie on my home pc so I can see how some people might get the settings changed with no warning (and there are still a lot of people who automatically click on ok without readong boxes which flash up...
 

RandomBastard

Can't get enough of FH
Joined
Dec 28, 2003
Messages
1,318
using meh router (which ok if your pedantic has an adsl modem in it but thats only 1/6th mine)
 

Users who are viewing this thread

Top Bottom