Xfinity mobile and gateway both hacked

This looks really familiar as far as what I have going on as well my phones been hacked gateway has I know it has when it has switched to a old ID and password randomly while my.phone gets hot and my router hotter yet internet lags bad nothing works then next thing I know phone screen is black won't turn on but it will emergency dial 911 over n over.....I've been told it's an ex girlfriend who's an ace at hacking and if it is or even if it's not what is my next step this needs to stop my pics get all taken from my phone I don't delete them but they vanish I'm sick and tired of it. Also I have a 5g note 20 that no longer picks up 5g since this began.

Responses

flatlander3

Problem Solver

•

1.5K Messages

2 years ago

How do you handle a data breach? Scorched Earth Approach:

The prep: Download an Ubuntu DVD or Memstick image (boot from usb device) -- ubuntu.com. Create the boot disk/usb stick. Boot it with something and make sure it works. Don't install Ubuntu. It runs in computer memory and won't touch your hard drive. If you have backups for your computer gear, great. If not, you need external media like a USB hard drive large enough to store your data -- that's cheap these days. Compromised backups are a risk, so just restore docs and photos, not applications, just reinstall those. Make sure you have an active virus scanner running when you load them back to your wiped gear, even on a Mac.

Yank the power cord on the gateway. Shut the phone off. You are going to the phone store.

The hardware IMEI number in the phone is burned, so it can be cloned/crammed (move the service to some other carrier along with the phone number). Change it out at your carrier's store. Even if it's not hacked, you don't want it calling 911. There can be penalties for that when they tire of you. Do this 1st. Have the carrier just load your contacts. Explain you think it was hacked, and you don't want previous apps or cloud backups if you were doing that nonsense. Never use cloud backup. Do that locally instead. You can re-download apps yourself. You can recover photos from old cloud backups, but use a web browser from a PC. Change your phone carrier password with the phone before you leave the store (my Verizon/apple ID....etc).

When you get home, make a list of every login/password you have for later while still offline. Your web browser(s) have a list if you saved passwords there. Shut everything off. Roku/Firestick/tablets/cable boxes.....everything. Don't turn them back on. You want to prevent other devices infecting your clean ones.

You can factory default your gateway by holding in the WPS button until the lights flash. Or (more better), buy one that isn't managed by an Xfinity phone app on the least secure device you own, and it won't be a phone problem anymore. It has to be an 'approved' modem https://www.xfinity.com/support/articles/list-of-approved-cable-modems , shop around for prices. It shouldn't be getting hot anyway -- hacked or not, and you can swap that out at the Xfinity store if there is one by you, or do it by mail: https://www.xfinity.com/support/articles/returning-your-equipment

Now boot the Ubuntu DVD/USB stick. Create a drop email account with it. Gmail/Protonmail, wherever. Now change your Xfinity.com password, and the recovery email password to your new drop email account. Change the SSID name your gateway is broadcasting. Do this with every other account and enable 2-Factor to your new phone on all of them, especially banking information and any online service with credit card information. Use the recovery email "forgot password" option on web sites to change the password on ALL of them again to make sure that your new drop account works.

One Device at a time: Factory default streaming devices and reconnect them using the new credentials you just set. Tablets are tougher, USB cable them to Ubuntu and move data you want to an external hard drive -- or just factory default those too. Usually the content is somewhere else for a tablet and it's not important. If you don't have backups for PC's, boot them with Ubuntu, and move your docs/photos to an external drive, then reset Windows. On a Mac, it's a special case. You have to install hfsprogs in ubuntu to mount the disk drive and read it. (search online for Mac mount disk).

Remember, we're not trying to reinstall infected apps from cloud backups, or you may just have this problem again.

Best, is to reformat hard drives and reinstall the operating systems instead of resetting them, but you'll need install media for that and make sure you have a license key for the Windows.

Nuke it from orbit. It's the only way to be sure.

Hackedaswellpa

Visitor

•

1 Message

@flatlander3 would it be in your professional opinion that the best option for a Mac, or several for that matter, be the ubantu method as described or DFU at an appointment at the Apple Store, not turning any on until they are cleaned?

Would a cloned display or something similar be resolved with your detailed, resourceful post?

Above all, from the many of us that seem to have fallen victim to this hack, thank you for taking the time to post very a very helpful guide!

2 years ago

flatlander3

Problem Solver

•

1.5K Messages

@Hackedaswellpa For a Mac? You really don't care about anything other than your home directory, and files you saved or created there. You can reload the OS (overwrite the OS) by holding down the command key and "r" at the same time during boot. You can reinstall programs you have a license key for from the store or from the 3rd parties website if you installed a program from a .dmg image.

You can also restore via time machine to an earlier state if you have been diligent about backing up to another drive and know how far back to go before you got compromised. You might end up re-installing, or retaining unwanted browser PUPs (potentially unwanted programs), and other browser hijacks if you restore that way though.

Scorched Earth Paranoid Approach: If I suspect a device, I prefer to start with something that isn't compromised like a Linux boot disk, mount the questionable hard drive, copy what I want to keep to a backup USB drive, then reformat the compromised hard drive after that with something like gparted under linux, then boot with another USB stick that contains the OS installable media. Make sure you install all the OS updates when it comes back up, then add an anti-virus program (even on a mac). Avast has a free one for mac. Then when you load your user content and programs back, a virus scan may pick up the problem if it's in your user data.

A really big part of all of this? DO NOT REUSE PASSWORDS. You want them to be different on sites/services you use. Don't use a previously compromised email account for password recovery for something else. If it's burned, it's burned. Ditch the account, unlink everything else from it, and don't trust that one again. Keep local current backups for important stuff. It's also a good idea for disaster recovery if your hardware dies. Then this is much easier.

This also Might not even be an Xfinity problem at all if you are reusing passwords across multiple sites, and it might be a social media or other phone app or phone OS problem. Free phone apps aren't free. At best, they are data collection tools. At worst they are an attack vector.

2 years ago

CCMichelle

Problem Solver

•

788 Messages

2 years ago

Thanks for taking the time to reach out to us regarding your security concerns. I highly recommend reaching out to our experts on our Security Assurance teams. They are going to be able to ensure that your internet and phone services are secure and are the ultimate experts with this kind of experience. You can reach them directly through their website https://internetsecurity.xfinity.com/help/report-abuse or via phone 1-888-565-4329 during the hours of 8:00am - 12:00am EST, 7 days a week.

Your Home Network

user_8c2161

Xfinity mobile and gateway both hacked

flatlander3

Hackedaswellpa

flatlander3

CCMichelle

New to the Community?