Chromecast device trying to join my network

System

This discussion was created from comments split from: Router hijacked.

VABelle

I’m having the same problem with a Chromecast device trying to join my network. It would disguise itself as one of my other devices, using the same name, but IP address would be 10.0.0.1. For the past day I’ve been able to block & remove it every time but last night I could not. The “remove device” was not an option. I finally deleted the Fing app & reinstalled it & was able to remove it but an hour later the Fingbox indicated my network was down. I restarted the modem but when the internet came back on, the Fingbox APPEARED to be connected but the network name was blank. All attempts to reconnect/reset Fingbox failed. I use long, complex passwords, dual verification and Authenticator app along with Fingbox but this attacker is still able to break through. I truly am at my wits end.

VABelle

P.S. I should mention that the device breaking in was also identified as Cimsys, same as the previous poster. Right now I have my entire system disconnected.

VioletChepil

@VABelle - I've just moved this conversation over here so we can isolate/help with your issue. 
Fingbox should be monitoring the device by MAC address. Is the MAC address also changing?
Also, could you try and change your router admin and password?

VABelle

Before the hack, my network (directly connected to Fingbox) was called Sqirrely2.4GHz. After, it became: Networkwifi-020000000000 My cellphone’s IP address is different and my router was no longer 10.0.0.1.

I have factory reset my router and reconnected my devices countless times but it only takes about 24 hours before the hacker is right back in. He has somehow figured out how to get around the Fingbox and takes over. It makes no difference whether the network name is broadcasting or not. It’s possible there are vulnerabilities in my security cameras, smart plugs, Echo Dot, etc. but Comcast & Best Buy keep saying “create a strong password & use dual verification.” I do! They don’t want to hear that hackers are laughing at those of us with IoT in our homes.

VioletChepil

hi @VABelle
Thanks for response. I have some more troubleshooting steps for you.

Blank / unknown network name:
You mentioned that the network name is blank. This happens when location permissions are not fully enabled on Fing App as required by new iOS 13 and Android 10 rules. 

Can you check the app settings and make sure location is set to ALWAYS (for best performance)?
This allows Fing app to read network name etc. on iOS 13 and Android 10. 

Follow these steps:

• Set location permissions to ALWAYS in app settings
• Open Fing App and go to ‘Network’ tab
• Click on the ISP name and it will open the Network page
•  Clear out the Network information such as Address
• Next, to the MAP section, there is a small icon to auto-detect location. Click on the icon 
• Try scanning again - it should work with your usual network name

Let me know if this solves things for you. I've just tested this again and it worked for me when network name was blank. Please let me know. 

Chromecast device
For the chromecast device, can you share a screenshot of it please?
We'd like to investigate this further and need a screen to see it.

Thank you!
Violet

Hronos

@VABelle Hi!,
Just to point it out, the "remove device" feature doesn't block it, just removes it from your list, so the fact that it reaper listed only means it is still on your network (or "in range" at least).
If you block it and then remove it, you actually unblock it again, because FingBox has no information about that device after the remove, hence, it doesn't block it.
I recommend you to, reset all gear again (even your FingBox/App to re-scan your network as a new one), use new and never used passwords and SSID names, and activate the "Automatically block new devices" feature of the FingBox, since the beginning.  And only grant access to devices you identify.
Also, it your router have IP v6 enabled, disable it at once, since FingBox cant block this protocol.  And search if your router has a known issue or vulnerability to patch it or change it.

VABelle

I factory reset my modem, changed network name & password and it was no time at all before the mystery device tried to join the network. This time it is calling itself the router, using same exact id as the actual Xfi router.

Regarding IPV6, there is no way to disable it. Comcast/Xfinity has made it impossible to access the router from a PC or Mac, preferring its customers to control (and I use that term loosely) their settings from the Xfi phone app. I suppose I will end up having to return the Xfi router and buy my own. In that case, advice is needed on best one to buy.

VioletChepil

Thanks @VABelle - could you start up a new thread on Devices/Security asking for this information:
https://community.fing.com/categories/devices
title: Best router to buy? 
Black Friday is coming and I'm sure a lot of community members will be able to share some really great insight on which is the best router to add to your network! 

VioletChepil

And @VABelle a bit more information on removing the device.
Removing a device will only ignore the device and deletes it from the Fing App. It means that you do not want to monitor that particular device but when you re-scan the network and if the device is still connected to that network, it will appear again on the network. Removing a device does not delete the device from the network. 

VABelle

I understand now NOT to remove the mystery device. It is still showing as being blocked. I'm starting a new thread regarding routers compatible with XFi server.