PDA

View Full Version : Possibly been cloned?


brido bhoy
02-10-2007, 14:46
Hi all,

Do you think Virgin would be able to tell if I have had my modem cloned by someone? (Im on the XL, 20mb service)

For the past month I have constanly been capped at 5mb (max) between the hours of 4-12pm. I've tested this a few times and have come the conclusion that I have been cloned.

I switch the modem & router off at the wall before I go to bed and it stays off until I come home from work the following day, between 5-6pm. Fire up the modem, and bang nothing more than 5mb, when i would normally have around the 12mb mark before the last 4 weeks or so. My normal speeds after midnight jump right up to 18.5/19mb.

Just seem that I am always being traffic managed, even with going online for the first time that day :mad:

Paul K
02-10-2007, 14:57
They would probably be able to tell if you complain and ask for it to be looked into.

Mr Angry
02-10-2007, 14:59
Hi all,

Do you think Virgin would be able to tell if I have had my modem cloned by someone? (Im on the XL, 20mb service) :mad:

No (http://www.cableforum.co.uk/board/12/33617119-what-if-anything-vm-doing-about.html).

Mrcon
02-10-2007, 14:59
Unluckly, sounds like a clone

UncleBooBoo
02-10-2007, 15:31
Yip sounds like a clone to me too!

Best thing you can do is downgrade to a lower package instead of wasting money on something your never going to get!

Mrcon
02-10-2007, 15:46
Its cheeky that you pay for something that someone else is enjoying!

Chicken
02-10-2007, 16:14
I'd unplug the modem and then phone and say its damaged and claim another with a different MAC.

UncleBooBoo
02-10-2007, 18:18
But then the mac will prob still get re cloned???

Obviously someone in his area is sniffing mac's and trading them! As he subscribes to the top tier he stands a high chance of getting cloned again!

Unless the cable company stand up and make some changes this type of thing is going to continue!

Rather than using macs, VM should look at using usernames and passwords as well as mac's! sort of like adsl!

dev
02-10-2007, 18:21
if its jumping back up at midnight, it shouldnt be STM otherwise it'd jump at 4am surely?

i have found that speed tests with VM can vary wildly day to day and so previous results dont mean you'll get the same the next day.

iglu
02-10-2007, 19:19
It is getting very widespread now. They buy modded modems on ebay and swap MACs from one area to another, on many many forums....

TheNorm
02-10-2007, 19:30
...Obviously someone in his area is sniffing mac's ...

Can this be prevented? A sort of MAC-deodorant, perhaps?

UncleBooBoo
02-10-2007, 19:52
Something needs to be done, I just downloaded a program that sniffs macs and i have just got 38 macs with config files in my area!!! (took me seconds to google program and about ten minutes to get macs!)

I was connected on Saturday and I have probably been cloned and if not I bet my mac is on somebodies list!!!

VM should sit up and do something to make this harder if not impossible, it's crazy how easy this stuff is to do, there must be a way to prevent mac codes from being compromised like this?

And for the record I have deleted the mac's and I do not use a cloned modem neither do I steal any services from VM, I pay for mine!

Toto
02-10-2007, 19:55
Hi all,

Do you think Virgin would be able to tell if I have had my modem cloned by someone? (Im on the XL, 20mb service)

For the past month I have constanly been capped at 5mb (max) between the hours of 4-12pm. I've tested this a few times and have come the conclusion that I have been cloned.

I switch the modem & router off at the wall before I go to bed and it stays off until I come home from work the following day, between 5-6pm. Fire up the modem, and bang nothing more than 5mb, when i would normally have around the 12mb mark before the last 4 weeks or so. My normal speeds after midnight jump right up to 18.5/19mb.

Just seem that I am always being traffic managed, even with going online for the first time that day :mad:

Ahh......now your point about switching off your modem and router is interesting.

STM works at individual uBR level, and you can't have two identical modem MAC addresses on the same uBR getting traffic at the same time (so I've been told). That would seem to suggest its not a cloning issue, but some other VM fault. There again, it could be.

It may be possible of course that at 4 pm, somebody is hitting the thresholds, and your modem then kicks them off, but you then get STM'd. If that is the case, you need to call them as soon as you think you've been reduced, they can see it their end, and then you have something to shout about. I know that doesn't sound like the best thing right now, but you have to start somewhere. Perhaps a VM tech who writes here may contact you via a PM and sort you out.

Would VM tell you you've been cloned? Possibly not, but it could be a safe bet if they offered to change your modem. :)

Make some noise my friend, you never know what will fall out of the tree if you shake it hard enough.

UncleBooBoo
02-10-2007, 19:58
^^^^^^^^^^^^ Some good advice there! ^^^^^^^^^^^^

Hope you get it sorted! :)

TraxData
02-10-2007, 20:02
Ahh......now your point about switching off your modem and router is interesting.

STM works at individual uBR level, and you can't have two identical modem MAC addresses on the same uBR getting traffic at the same time (so I've been told). That would seem to suggest its not a cloning issue, but some other VM fault. There again, it could be.

It may be possible of course that at 4 pm, somebody is hitting the thresholds, and your modem then kicks them off, but you then get STM'd. If that is the case, you need to call them as soon as you think you've been reduced, they can see it their end, and then you have something to shout about. I know that doesn't sound like the best thing right now, but you have to start somewhere. Perhaps a VM tech who writes here may contact you via a PM and sort you out.

Would VM tell you you've been cloned? Possibly not, but it could be a safe bet if they offered to change your modem. :)

Make some noise my friend, you never know what will fall out of the tree if you shake it hard enough.


One thing i've noticed (from other people) that although having 2 exact same macs on one ubr shouldnt work, it does seem to (for upto 48 hours then boots them off)

It's quite possible for someone to be using your mac during the day and even hitting your threshold before you turn ur modem on then they swap to a different mac.

VM dont care about cloners so its very unlikely they will change your modem/give you a new mac.

bonzoe
02-10-2007, 20:11
The VM fraud dept (if it exists!) should be looking into this AND checking on e-bay. Few of the modems for sale are owned by the sellers - "Moved house, VM didn't want it back"

For sale in job lots of 50!!!

VM wake up

Toto
02-10-2007, 20:11
It's quite possible for someone to be using your mac during the day and even hitting your threshold before you turn ur modem on then they swap to a different mac.

VM dont care about cloners so its very unlikely they will change your modem/give you a new mac.

Which is what I think I said in my third paragraph, or similar?

They don't care about cloners? hmmmmmm :)

TraxData
02-10-2007, 20:13
Which is what I think I said in my third paragraph?

They don't care about cloners? hmmmmmm :)

Sorry i was in a rush lol.

Yep they dont care about cloners as its way too much hassle to try and stop them!

And it's a pretty well known fact they'd rather have someone using a cloned modem while taking out a minimum package with VM than nothing at all!

Toto
02-10-2007, 20:18
Sorry i was in a rush lol.

Yep they dont care about cloners as its way too much hassle to try and stop them!

And it's a pretty well known fact they'd rather have someone using a cloned modem while taking out a minimum package with VM than nothing at all!

OK ;)

antttt
02-10-2007, 23:24
i have a similar problem to you i've been limited to around a download of 300-500kb/s between 4pm-12:30ish for the past few weeks nows, even though im no where near the 3gb limit. the after 12.30ish i can download @ around 2.2mb/s i emailed tech support awhile back and got a speedy response after 4 weeks wait telling me that there no problems in my area, well obviously?! but it didnt answer my question.

Mr Angry
02-10-2007, 23:40
It's all quite hilarious.

The ebay user "i_flip_burgers" seems to have stumbled across a goldmine of NTL/VM modems - so many that he's sold dozens of them.

Who do I invoice at VM for detective work?

iglu
03-10-2007, 12:12
It's all quite hilarious.

The ebay user "i_flip_burgers" seems to have stumbled across a goldmine of NTL/VM modems - so many that he's sold dozens of them.

Who do I invoice at VM for detective work?


:rofl:

The user ilovemyboyk has bulk offer of 40 VM modems on sale....a fiver each. The market is flooded with VM modems...

brido bhoy
03-10-2007, 13:52
Thanks for the suggestions folks.....will see how it pans out over the next week or so then will give VM a shout

Worst case I'll get a clone of my own to use when mine is reduced speed lol

Mr Angry
03-10-2007, 14:04
:rofl:

The user ilovemyboyk has bulk offer of 40 VM modems on sale....a fiver each. The market is flooded with VM modems...

Yes, you'd wonder how they manage to get away with it considering the zero tolerance attitude of the VM fraud dept.:rolleyes:

Mr Angry
03-10-2007, 17:30
:rofl:

The user ilovemyboyk has bulk offer of 40 VM modems on sale....a fiver each. The market is flooded with VM modems...

Nice payday for him / her.

Sold 40 modems in less than a day (£200.00).
Obviouslythese modems will have no impact whatsoever on the services supplied to paying customers - otherwise VM would, one would imagine, be doing something about the fact that hundreds of their modems are being flogged on ebay every week.

Mr Angry
03-10-2007, 21:22
UPDATE:

"shellbells 2007", who only registered with ebay on August 3rd 2007, (that's two months ago folks) has already sold 135 of the 250 series modems!

How / where does someone "legitimately" come across those types of numbers of modems?

TheNorm
03-10-2007, 21:23
If I understand this thread correctly, I can buy a modem off ebay for £5 and enjoy 20 meg broadband without paying for it? And VM won't do anything about it??

What's the catch?

Mr Angry
03-10-2007, 21:27
If I understand this thread correctly, I can buy a modem off ebay for £5 and enjoy 20 meg broadband without paying for it? And VM won't do anything about it??

What's the catch?


There is "no catch" (pun fully intended).

https://www.cableforum.co.uk/images/local/2007/10/17.gif

UncleBooBoo
03-10-2007, 22:12
Yea and to be honest no wonder these people do it!

Crap speeds in the evening, my broadband is about as stable as Iraq and there is no come backs!

Hell as anyone got a link to one of these modems, or would I have been better off asking my installer for one?

TheNorm
03-10-2007, 22:30
If someone has cloned your modem, and they download illegal material, who will get a knock at the door - you, or the cloner?

UncleBooBoo
03-10-2007, 23:04
Good question!

That means all legal subscribers are at risk of Joe blogs downloading child porn for example from a cloned modem and it's probably the subscriber who does the time!

TraxData
04-10-2007, 00:22
Yea and to be honest no wonder these people do it!

Crap speeds in the evening, my broadband is about as stable as Iraq and there is no come backs!

Hell as anyone got a link to one of these modems, or would I have been better off asking my installer for one?

It's illegal so asking on here wouldnt be the brightest of ideas ;):p:

iglu
04-10-2007, 05:47
It's illegal so asking on here wouldnt be the brightest of ideas ;):p:

He should read the Haynes manual for cloning VM modems first! ;) It's complete with illustrations etc

Two questions:

What is the source of those modems?(as Mr Angry asked). There are plenty of modems for sale but curiously most without a power adaptor. Are they stolen from NTL's warehouses?

Why Ambit/VM 255 allows simple commands like 192.168.100.1/flag? (flag is number/string not given here). Easy cloning comes to mind:D

TraxData
04-10-2007, 06:22
He should read the Haynes manual for cloning VM modems first! ;) It's complete with illustrations etc

Two questions:

What is the source of those modems?(as Mr Angry asked). There are plenty of modems for sale but curiously most without a power adaptor. Are they stolen from NTL's warehouses?

Why Ambit/VM 255 allows simple commands like 192.168.100.1/flag? (flag is number/string not given here). Easy cloning comes to mind:D

I cant give any real reply to your question as it would make this turn into how to hack your modem discussion, and its not allowed :p:

google is your friend though.

As for the source, 99% of the guys selling them on ebay in bulk are VM staff/techs and can easily swipe them etc

iglu
04-10-2007, 07:06
I cant give any real reply to your question as it would make this turn into how to hack your modem discussion, and its not allowed :p:

google is your friend though.

As for the source, 99% of the guys selling them on ebay in bulk are VM staff/techs and can easily swipe them etc

I do have the Haynes manual for modem cloning ;)

Is Ambit going to introduce a new command 192.168.100.1/clone_me_now for the next generation of modems? What I am saying is: why is VM making it easier to clone its modems? Simply, VM is a headless company.

Also, what is the story behind the lack of power adaptors in bulk purchases?

TheNorm
04-10-2007, 09:39
...That means all legal subscribers are at risk...

So if you are hauled into court to defend yourself against the charge of "downloading illegal material", and your lawyer calls Sir Richard Branson to the witness stand...

L: "Tell me, Sir Richard, is it possible that someone impersonated my client's MAC address?"

SRB: "No."

L: "Are you denying that cloning of modems happens in the VM network?"

SRB: "Yes."

L: "No further questions, your honour."

Now that would make an interesting test case!

Mr Angry
04-10-2007, 17:10
As has been pointed out on this thread and others the discussing of "how to" is frowned upon.

If only VM could take a similar stance on the sale of what appear to be stolen / flashed modems then their customer base might be forgiven for thinking that a non partisan discussion forum cares more about protecting their VERO, intellectual property rights and services than they themselves appear to.

Go figure.

Chris
04-10-2007, 17:14
Good question!

That means all legal subscribers are at risk of Joe blogs downloading child porn for example from a cloned modem and it's probably the subscriber who does the time!

Given that the police are now pretty well aware that home internet connections are often easily hacked one way or another, I would have thought it unlikely they would go for someone unless they could actually find evidence of indecent images on a hard drive, or a credit card number on the server of a known illegal porn provider, or some other evidence that reliably ties illegal activity to an individual.

Mr Angry
04-10-2007, 18:20
....or some other evidence that reliably ties illegal activity to an individual.

Like "Theft of services"?

In order for them to determine if there are images on a hard drive they firstly have to take the hard drive to study it.

In many cases, where the police are seen carting off your pc and dvd collection, in the minds of colleagues, family and neighbours the damage is done - whether you're guilty or not.

bonzoe
04-10-2007, 20:18
There's obviously a lot of concern about this practice, do any of the mods know of any contacts in VM who would be interested and willing to take up the matter with E-bay?

piggy
04-10-2007, 21:21
@traxdata

As for the source, 99% of the guys selling them on ebay in bulk are VM staff/techs and can easily swipe them etc

possibly true but also bang out of order!!

Mrcon
05-10-2007, 04:02
Wonder why thats why im getting slow speeds?

Sirius
05-10-2007, 08:39
Just had a pm from someone i do not wish to name :). He says that VM support will never admit to the fact that your modem could have been cloned. They will also NEVER admit to the fact that a modem can be cloned.

UncleBooBoo
05-10-2007, 08:46
Just had a pm from someone i do not wish to name :). He says that VM support will never admit to the fact that your modem could have been cloned. They will also NEVER admit to the fact that a modem can be cloned.

Even though you can Google videos of cloned modems and their setup?

Hmm I would rather believe my own eyes than a script reader! :D

Sirius
05-10-2007, 08:56
Even though you can Google videos of cloned modems and their setup?

Hmm I would rather believe my own eyes than a script reader! :D

The pm i received came from someone within Virgin i trust and does not act like a ostrich whenever cloned modems are mentioned.

UncleBooBoo
05-10-2007, 09:10
No offence intended but just because he does not act like an ostrich does not mean the end result is any different!

The sad thing about it is nothing will get done about this and we the end paying user suffer, not to mention we are being put at risk!!

Mr Angry
05-10-2007, 10:04
The only way that something will be done about any aspect of this ridiculous situation is if it is effectively exposed as wanton disregard on the part of VM.

I tend to believe what Sirius says his / her contact has told him / her. I wrote, very recently, to the executive offices of VM citing, as a primary issue, the matter of the proliferation of cloned modems currently in play.

I did not ask for any specifics from a technological point of view, nor did I ask for figures yet every other point in my correspondence was addressed / answered except that pertaining to the issue of cloned modems.

The same goes for the various cable boxes on sale on ebay - Theft of service results in head in the sand defence.

The bottom line is that paying customers are being fleeced by VM and the cloned modem users. I strongly suspect that the number of cloned modem users and their broadband activities have inflated the bandwith usage figures very considerably (how could they not?) and this distortion of the figures played a very large part in VM's decision to introduce traffic management systems whereby paying customers (quite possibly through no fault of their own) are suffering reduced bandwidth to facilitate someone else's theft of service.

In this thread alone we, the customers, have identified ebay sellers flouting the law in instances numbering in the hundreds over the past few days alone - and this only reflects the activities of three or four sellers!!!

VM do not care.

I think it would be a good idea if a sticky thread were opened where we could "name and shame" those ebay sellers who are flouting the law and assisting in the theft / restriction of our services. It would be interesting to see what, if any, action VM would take / threaten against ebay or the sellers as a result of group intelligence gathering.

Mr_love_monkey
05-10-2007, 10:16
ah yes, cloned modems - the elephant at the dinner table that no one wants to talk about - because otherwise they might have to do something about it

Enuff
05-10-2007, 10:21
This has been going on for years now, it's about time something was done about it. Then again, it seems that whatever is done will be undone/hacked soon after!

gaffer_gump
05-10-2007, 12:02
They are doing something, earlier this year I was disconnected for 3 day by ntl, phone in hand and snacks by my side, spiderman jimjams on ready for the usual drawn out 1hr + call I rang..

After giving my details to cs I was transfered to some kind of shhhhh we can't talk loud dept who wanted all my details, mac address, colour / make / model of modem, time with ntl, previous address, everything..

After no explanation they told me as I was the 'correct account holder' my service would be reconnected.

So it looks like the dude who cloned me had to have the hassle of popping onto another forum to gather a new mac and I had as a paying customer the p**s take of having to prove I am who I said I am and having no connection for 3 days, no sorry, no explanation..

Nice going...

eBay here I come lol..

Mr Angry
05-10-2007, 13:18
What colour are your spidey jimjams?

SOSAGES
05-10-2007, 13:22
Red and blue i expect with a spider web pattern...

Hugh
05-10-2007, 13:30
Could be black & white ......
https://www.cableforum.co.uk/images/local/2007/10/34.jpg (http://images.google.co.uk/imgres?imgurl=http://images.buycostumes.com/mgen/merchandiser/17084.jpg&imgrefurl=http://www.buycostumes.com/Category/129/4294966908/results1.aspx&h=1600&w=1600&sz=93&hl=en&start=26&sig2=lG76EBFKw0B8fQT0eMLwjQ&tbnid=nmClAizvGecNaM:&tbnh=150&tbnw=150&ei=MiAGR9m8LouewwGx15TTAw&prev=/images%3Fq%3Dspiderman%2Bvenom%26start%3D18%26ndsp %3D18%26svnum%3D10%26hl%3Den%26safe%3Doff%26rls%3D GGLD,GGLD:2004-25,GGLD:en%26sa%3DN)

gaffer_gump
05-10-2007, 13:47
I refuse to be drawn into divulging the details of my spiderman jimmys although I do have colour battle going on when I wear my bumble bee slippers as well.. :erm:

piggy
05-10-2007, 17:12
I refuse to be drawn into divulging the details of my spiderman jimmys although I do have colour battle going on when I wear my bumble bee slippers as well.. :erm:

to much infomation...now ive got a very strange picture in my head !:p:

Hugh
05-10-2007, 17:33
Like this?
http://content.onestepahead.com/assets/images/product/detail/11661.jpg

or perhaps this?http://www.cableforum.co.uk/board/attachment.php?attachmentid=15048&d=1191598832

iglu
06-10-2007, 09:24
Are the communications between modem and UBR encrypted on VM? I know it's an option on DOCSIS but is it turned on?

iglu
06-10-2007, 12:02
A cloner claims: (from the cloning forum :D)

Wales, Virgin 20Mb x4.

2 via c/s router to my box, 1 to Girlfriends PC and 1 idle as FTP/Mail exchange. All Ambit 250's


Is it possible to plug 4 modems to one connection? Via a signal splitter?

dilli-theclaw
06-10-2007, 12:44
I'd just like to remind everyone that there should be NO talk of how to clone modems.

brido bhoy
06-10-2007, 12:47
A cloner claims: (from the cloning forum :D)



Is it possible to plug 4 modems to one connection? Via a signal splitter?

I dont see why you wouldnt be able to use a splitter to connect many devices to one line. Dont know what/if any effect this would have on signal.

If Im using by broadband, and V+ box to full capacity (ie 2 recordings and watching TV) Im effectively connected 4 times to the line. Just a thought

iglu
06-10-2007, 14:46
I dont see why you wouldnt be able to use a splitter to connect many devices to one line. Dont know what/if any effect this would have on signal.


:shrug: if that's the case, with for 25 quid (5 quid is the going rate for a modded modem) the cloner has a 100Mbs connection with the help of a multi-WAN router! You can get a two-wan router for 25 quid on ebay

TraxData
06-10-2007, 15:09
:shrug: if that's the case, with for 25 quid (5 quid is the going rate for a modded modem) the cloner has a 100Mbs connection with the help of a multi-WAN router! You can get a two-wan router for 25 quid on ebay

Yea you can just use a 4-way splitter.

And no need for a dual wan router either, you can just use wingate to setup a www proxy through the modems so they combine as one.

MovedGoalPosts
06-10-2007, 16:05
We remind everybody we don't allow discussion on this forum of how to obtain services without subscription. Some of the discussion in here is getting rather close to the mark.

This thread has demonstrated that illegal use appears possible, despite Virgin Media's denials. On that basis it is now closed.