Oh no! My router’s been hacked!

10 Jan, 2019 by Barry 4 Comments

Or so says a Spark (my telco and Internet provider) technician who phoned me a short while ago. I’ve had several phone calls a day over the last week from a variety of South Island phone numbers, but invariably, either the caller hung up as I answered, or did within a few seconds. Today one of those callers made a successful connection. The call went like this:

Tech: hello sir. I am [name unrecognisable] from Spark technical support.
Me: Hello. What can I do for you?
Tech: We are calling you because there is a problem with your router. Do you understand?
Me: I understand what you are saying. Why do you think it has a problem?
Tech: I’ll show you. Look at the lights on your router. Are any of them blinking?
Me: Just a minute while I go look. It’s in the next room. Hang on a mo. [pause of around 30 seconds] Yes, several lights are flashing.
Tech: Can you tell me which ones are blinking?
Me: Hang on a bit will you, I didn’t note down which ones. I’ll just grab a a pen and paper and be back in a jiffy. [Quietly] Now where’s a pen that works? [short pause, then louder] Got them, Back in a second. [40 seconds of silence] Are you there? The lights that are flashing are Internet, W L A N, L A N 2, L A N 3 and L A N 4.
Tech: OK sir. Do you know what the WLAN light is for?
Me: Please, tell me.
Tech: WLAN stands for “Wireless Local Area Network”. Someone is using your wireless connection without your permission. That blinking light is an alarm saying that the wireless network has been hacked.
Me: Oh dear. How do I fix that?
Tech: That’s why we’ve called sir. I’ll just transfer you over to one of our router specialists who will lead you through some simple steps to solve the problem. Just wait a minute while I transfer you.
[30 second pause]
Tech2: Hello sir, I’m Gerald [or perhaps Gerard?] from the Spark specialist support team. Do you understand why we have called you?
Me: I think it’s because someone is using my wireless router without my permission.
Tech2: That’s right. But I’m here to help you fix that. Someone has hacked the router so that they can do all sorts of things without you knowing about it, and that flashing light is a warning. You should have reported it you know. It will only take a moment to fix if you follow my instructions. Can we go ahead and do that now?
Me: Sure.
Tech2: As you may understand, a router is digital appliance, and as it doesn’t have its own screen or keyboard, we need to communicate with it by using another device such as a computer or laptop. Do you have one of those?
Me: Yes I have a computer.
Tech2: Good Turn it on please.
Me: Just a minute. [Another 30 second pause] Ok it’s on.
Tech2: That’s great. Is it a Mac of a Windows computer?
Me: How do I tell?
Tech2: There should be a brand name or logo on the computer. Can you tell me what it is sir?
Me: It says “Dell”.
Tech2: It’s probably a Windows Computer, but just to be sure, do you see a button with “CTRL” nearest yo you on the extreme left of the keyboard?
Me: Yes.
Tech2: Does the button to the right of it have a Microsoft Windows logo on it?
Me: What does the logo look like?
Tech2: It looks like a wind with four panes of glass.
Me: Yeah. It does look a bit like a window.
Tech2: That confirms it’s a Windows computer. So this is what I want you to do: Hold down that Windows button and hit “R”.
Me: Done that.
Tech2: Did a window pop up?
Me: Yes.
Tech2: OK. Now type in C for Charlie, M for mother, D for Doctor.
[pause while I type s.l.o.w.l.y.]
Me: Done that.
Tech2: now hit Enter and tell me what you see.
Me: Exactly the same as what was there before I pressed Enter.
Tech2: Can you tell me what you had typed?
Me: C for Charlie, M for Mike, D for Delta.
Tech2 [with some hesitation]: Um… That’s right. [pause] And you say nothing happened when you hit enter?
Me: Well, I didn’t exactly hit it, but I did press it firmly.
Tech2: I see. It looks like the hackers have done more than hack you router. We’re going to have to get into this more deeply. But don’t worry, we’ll put an end to those hackers, although we will have to do a bit more at our end first.
Me: I see. What do I do now?
Tech2: We’ll make some preparations, then would it be OK to call you back between 9 and 9:30 tomorrow morning?
Me: Sure, I’ll make sure I’m here.
Tech2: That’s great. I’ll call you back between 9 and 9:30. Goodbye, sir.
Me: Goodbye.

I’m looking forward to tomorrow. What they don’t know:

• For 35 years, I was an engineer for a major international I.T. Company, and for most of that time specialised in networked systems in the banking and retail sector.
• Our home network consists of Linux and Android devices only (plus a Kindle). There isn’t a Windows device in sight, and hasn’t been for more than 10 years.
• I know they are scammers.

If I’m in the mood, I like to string these pricks along for as long as possible. The last few times, I haven’t been, so I’ve asked them to quote my Spark account number, and of course they were unable to do that. I invite them to call me back when they have it, but for obvious reasons they never do.

In (Not) Windows Support Desk I relayed a similar incident, although this time I look forward to my role play as a less than savvy senior Internet user. After all, they are role playing at being support personnel, so it seems only fit and proper that I play an appropriate role for them. I am impressed with their apparent courtesy. Being addressed as “Sir” all the time, might be flattering to some people, but I know it’s simply because they have no idea what my name is. I wonder what term they’ll use when they eventually discover I’m playing with them.

I’m not confident that they will call back tomorrow morning, but I really hope they do. The longer I keep them tied up, the less opportunity that have of doing real harm to someone else. It’ll be my good deed for the day.