Just found out my network is compromised and Comcast doesn’t know what to do

GeorgeFreeman

I found devices connecting to my network two days ago, I factory reset my modem/router and changed ssid/pw and local admin pw to the device but once I finished the devices were still connected!! A nvidia shield device, lg tv, and a Cisco device. The Cisco device is on my .254 address... what could that device be?! Comcast is sending me a new modem but I’m worried they will do it again... I’m hoping Comcast provisioned someone wrong and somehow we are conflicting. Fing app helped sniff this out and I just bought a Fing box. I’m thinking if it’s an attack that they somehow imaged my modem and have back door access.. I’ve never seen this before. Also MAC address filtering doesn’t help either.. See photo of the Cisco device in Question. Does anyone know what attack is happenIng?

17C3BFB8-2290-4837-AE39-63026E4648E9.jpeg

Livthedream

Its probably not compromised. So the CISCO device is probably your router since CISCO make routers for Comcast. As for the other devices im not sure but chances are some devices are using random mac addresses so Fing is miss identifying them.

GeorgeFreeman

Well.. I know the .1 is my device, the other one is not.. but something is fighting me when trying to manage my device, I log in and sometimes it says password is incorrect for like the first 5 tries and then randomly lets me, then once I navigate it logs me out saying I need to log in again and when I try it says pw is wrong when it’s clearly right, as if another device is interfering with mine and they are both trying to take the request... the .254 address is pingable and my internet has become shitty this week as far as stable connections. Hoping the new modem corrects this issue.

ExperiMentor

Well the device is identified as a Cisco DPC3939, which (if correct) is indeed a residential gateway/router made by Cisco for Comcast. Is that the device you have? It is quite possible that it assigns itself more than 1 internal IP address: eg x.x.x.1 for the gateway, but x.x.x.254 for something else - for example the built-in multimedia server (SAMBA etc), or the VOIP interface would be candidates for having a different IP address.

andrephgroen

Did you perhaps install a set top box from a TV provider, which also happens to hold a DHCP- server? I had this same issue ones and it appeared that the home network suddenly had two DHCP- servers

Which iof course is impossible. Imagine two companies assigning postal codes to each house in your country. That would give a lot of confusion trying to post a letter. Same thing with more than one DHCP- server. They will be in deep conflict with each other trying to assign a different ip addresses to each device.

Try to figure out of you have more than one DHCP- server in your network by accident. Disable one of them.

GeorgeFreeman

Ok makes me feel better. I only used Fing to sniff when I saw other devices after my internet got all weird. I got a new modem and problem solved now. It was just weird that I saw and was able to ping other devices and xfi was showing me them as well on the portal but blocking them didn’t work.

bglay

The Cisco device is your voice gateway

Graybeard

You might check this post to see if your LG TV is what you are seeing.
https://community.fing.com/discussion/5836/lg-tv-webos-creating-open-access-point

GeorgeFreeman

It’s not my tv or nvidia shield or router modem at the end! Problem resolved by swapping modem! Someone def firmware backdoored my last modem.

Pirho

Model DPC3939 DOCSIS 3.0 16x4 Wireless Residential Voice Gateway is. a high-performance home gateway. It combines a cable modem, two-line digital voice. adapter, router, and 802.11n wireless access points in a single device.

max2198

Several Cable Modems has a vulnerability  called Cable Haunt  
https://cablehaunt.com