How can I protect against hacking?

[Noradiooff]

Please help, very concerned with hacking

Today is being a very scary day.
First I was on my laptop when I noticed this log:

22/04/2015 18:04:48

The IP address lease 172.18.13.138 for the Network Card with network address 0x00FF8C00B0AC has been denied by the DHCP server 172.18.13.137 (The DHCP Server sent a DHCPNACK message).

IpLeaseDenied

None of my networks have addresses starting with 172.
1) So what's this 172.18.13.138? And also what's this DHCP server 172.18.13.137?
2) I turned off DHCP and assigned ips to everything that connects to my networks.
3) Only my Lumia 520 has been left out as it doesn't have an option to set a static IP. But it has Wi-Fi turned off almost always.
4) At the exact same time in the windows log (18:04:48) my phone got a call from a blocked number. I very rarely recieve calls from blocked numbers, that's waay too much coincidence than I'm prepared to digest.
5) I left home to my job and let the phone scan nearby wifis just to get an idea of a neutral name so I assign my network nothing that draws attention. BUT when I detected a "Silvia 2" a couple blocks from home the phone automatically tried to connect to it. I don't know any Silvia in this city! There are no wifis with this name on my phone. How did it try to connect to it?
6) About an hour ago I took my ohone out of my pocket and the screen was black with the "NOKIA" label on it. That's usually when I'm powering up the device, but instead it just turned off. I tried to turn it back on and nothing. Then I removed the battery and put it back on, now it turned on.
7) After turning it on I got some sms from some months ago. Took me some time to realize the clock was turned back to Feb 6, 2015, 8:41AM. Why this date and time? As far as I know if my date/time settings are reset they would go to some date when the OS was first installed on the phone, or the minimum date the phone handles. It makes no sense going back 2 months.

Please help, what do I do? Throw it in the incinerator right away?

 

[gpobernardo]

Re: Please help, very concerned with hacking

Welcome to Windows Central.

1. It appears to be a private network, usually used in offices, small private networks and even some routers are configured to assign a similar IP address value. I suspect that this could be your mobile network provider. What country are your from? What mobile service provider do you have?
2-3. Facts noted.
4. Most probably just a coincidence.
5. Even my phone detects my neighbor's WiFi networks, and it happens even when I'm stuck in traffic - random WiFi router names appear and my phone tries to connect to them if I don't disable WiFi. Do you have a record of every name of every person in your neighborhood?
6. Fact noted.
7. This happened because you took the battery out, effectively performing a soft reset on your phone. A soft reset always resets that date and time of the device to some prior time, which I'm guessing is relative to the build date of the OS and firmware version installed on your phone, or the first launch time after such versions were installed on your device.

No. There have been no reported issues of hacking in Windows Phone devices. Besides, throwing an electronic device in an incinerator would cause the evolution of toxic Persistent Organic Pollutants (PBDEs, PFOS, PCBs) and atomized heavy metal contaminants that may be released into the atmosphere.:wink:

But if it absolutely bothers you, just perform a factory reset from the phone settings to wipe everything from your phone.

You may want to create a Windows Central account to be able to respond to this thread.

 

[Torcher Death]

Re: Please help, very concerned with hacking

Greetings newbie... Calm down, take a deep breath & lets go over the issues once again..
1) gpobernardo seems about right on this one.
4) Try truecaller, might be just a coincidence. Bad days tend to get worse, cause of paranoia.
5) depending on your wifi settings, it will continually scan & try to connect to networks. Maybe Silvia is a visiting cousin or something...
6 & 7) Happened a couple of times on my 520 as well after battery removal, not sure if its a problem with the specific model, or a general problem. But I hope its not too unusual.

I wouldn't toss it into an incinerator just yet... See if you have any more issues before you attempt it & do remember to take the battery off before burning at the least.

 

[Noradiooff]

Re: Please help, very concerned with hacking

Hmpf, have to register to reply

Thanks guys!

gpobernardo:
1) Yes, I pasted that on IP Lookup and it returned that addresses starting with 10, 172 or 192 are all private.
2) Just clarifying I had done that b4 these events.
4) Wow, big mother of coincidences. I just wish I could get the lottery numbers right
5) My phone absolutely NEVER tried to connect to a network it didn't know. First time on any new network I need to connect manually. That's why I found the fact very strange, it just couldn't behave like that. (EDIT: stretching the acceptable to the extreme: it could have been a glitch on the touchscreen that simulated a touch on that network... but that's a major stretch!)
7) I don't recall this date/time setback occuring b4, but I won't put much stock in my memory regarding this kind of fact. My build creation date is 2014-06-24. If that's not the date of the update I think it (the update) was released in the USA late dec-2014 so it could have arrived here feb-2015... not convinced though.

Torcher Death
4) You got a point there, sometimes weird things just pile up.
5) As I said, my ohone never connects to an unknown network on it's own. Never ever. Really. And since it could never complete a connection to my home's network (after my changes, which included changing SSID), that is also classified as unknown to it.


Ok, I'll remember to dispose of the battery in an environmentally acceptable way

I forgot to mention b4, I don't have any virtualization machine and I don't use bluetooth, which is always turned off on both the laptop and the phone.

To me it seems it has indeed been hacked and the medium used was the carrier's signal. I hope I'm wrong, of course.

 

[Noradiooff]

Re: Please help, very concerned with hacking

Just tested since this is an easy one: removed the battery and put it back on, date and time were NOT changed.

 

[gpobernardo]

Re: Please help, very concerned with hacking

TorcherDeath's suggestion in using TrueCaller could be very useful, too, in blocking and at least identifying who's calling you if it is an unknown number and if it is a known number either used for official business or for spamming. Have a look at it here.

Back to #7. If you want, you could try a soft reset now by pressing the volume down button and the power button together until your phone reboots (you should feel it vibrate). Your date and time should be reset to some previous date, at least before it could re-sync itself automatically (so make sure that airplane mode is enabled just before the soft reset).

On #4, that's a possibility, but indeed it's an extreme case of coincidence. Haven't heard much about the touch screen issues in the L520, but I'm certain that it's not as bad as with most L535s (random PIN entered while phone is in pocket, random people being dialed, responding to fingers even without touching the screen, etc.).

Do you have a huge keyboard? The last time I saw the term "ohone" was when I was helping my sister in a play she was writing, and it went something like:

Character 1: Oh no! That ringtone! It's in my ohone! We're all going to die!
Character 2: Ah!!! But, wait, wait... first, what is an ohone?

It was a comedy.

We're all hoping it's not some form of hacking. You may be the first case if that's so... but I'd say that it's still unlikely. Unless you've got the attention of certain three- or four-lettered alphabet soup acronym government organizations.:wink:

 

[Noradiooff]

Re: Please help, very concerned with hacking

I just did what you said: volume down and power button. It went to the screen that asks to slide down to turn off. Later it indeed vibrated and was on a black screen with "NOKIA" on it. After that it just powered itself up and date and time remained correct, they were not changed. And I did set it on airplane mode even b4 you mentioning it. It's gonna stay that way most of the time from now on. At least until I change both device and SIM.

I hope the play went well!

 

[gpobernardo]

Re: Please help, very concerned with hacking

I see. That's interesting; it always resets in my L535 and my L1020. At the very least it's still a camera, somehow.

I think it did, it was almost six years ago and her hands were small; q and w were often mistyped as well as o and p.

At any rate, welcome once again to Windows Central, now that you have an account.

Make sure to check out the forum dedicated to your current phone and the Windows Phone you're planning to replace it with. See you around!

 

[Noradiooff]

Re: Please help, very concerned with hacking

Oh boy, I feel like such a ****** right now.

I just came back home and there was an email from the VPN provider asking me to do some more tests. So I obliged and turned on the VPN, and yes, a popup appeared showing a new connection with the exact same physical address... (00FF8C00B0AC). So I looked into the email I sent them yesterday and the rogue IP (172.18.13.138) was in the screenshot I sent them. (&^$%^#%$^#$%^#&^$%^!

Anyways, seems I've proven Windows Central forums I'm a moron...

Sorry to waste your time.

 

[MDK22]

Re: Please help, very concerned with hacking

I just did what you said: volume down and power button. It went to the screen that asks to slide down to turn off. Later it indeed vibrated and was on a black screen with "NOKIA" on it. After that it just powered itself up and date and time remained correct, they were not changed. And I did set it on airplane mode even b4 you mentioning it. It's gonna stay that way most of the time from now on. At least until I change both device and SIM.

WHY have it if it stays on airplane mode ?

You never mentioned what country / carrier you were on.

I've gotten calls, recently, from a short number code (me & wife within minutes, but in inverse order of our phone #s), never really thought about it much at the time.

There is a setting under WiFi which '... automatically connect to WiFi hotspots provided by my mobile operator ... ', if checked & someone on the same carrier (Sylvia ?) had Internet Sharing ON, that explains that ... or someone spoofed a mobile carrier hotspot.

Windows phone is sandboxed, thus if any nasty tried to get in, it stopped there. Check your Internet Explorer settings, under Advanced, about allowing sites to store files on my phone (delete it).

Other than that, adjust your settings, Hard Reset (if you'd feel better) & enjoy the use of your phone, again.

 

[gpobernardo]

Re: Please help, very concerned with hacking

Oh boy, I feel like such a ****** right now.

I just came back home and there was an email from the VPN provider asking me to do some more tests. So I obliged and turned on the VPN, and yes, a popup appeared showing a new connection with the exact same physical address... (00FF8C00B0AC). So I looked into the email I sent them yesterday and the rogue IP (172.18.13.138) was in the screenshot I sent them. (&^$%^#%$^#$%^#&^$%^!

Anyways, seems I've proven Windows Central forums I'm a moron...

Sorry to waste your time.

Hey, no problem. At least now we're certain that it's not a case of hacking. Information is information.