Mysterious line drop followed by a call from BT...

I'm hoping someone in the know may be able to shed some light on an incident that has happened in the last two days... and the lack of help that BT can do about it.

Over the last few months we've had some issues with our broadband connection and it dropping for no reason (it has been stable for as long as I can remember!). Tests by BT confirmed that there was a fault. A few weeks ago we had an engineer replace the phone line cable from the pole to the property and to be honest, this has certainly improved things for the better (we get good speeds too 73Mbps down, 20Mbps up - can't complain). All is good.

Then on Thursday morning, our broadband line went down shortly followed by a phone call from someone saying they was from BT. My wife wasn't able to help them and suggested they call my mobile - because they have my details. I didn't receive any calls.

On Friday, I was working from home... and the broadband went down again. The phone rang.. again, appeared to be the same person that called the previous day... the wife passed the phone over to me and I spoke to the lady. She said that she'll pass the call over to her manager to discuss the issues with my broadband going down. I spoke to the gentleman, he wanted to know whether I was sitting next to the computer... alarm bells started to ring. I asked him to confirm he was from BT and what my name was. He gave me the previous owners name (we brought this number with us to the property so he didn't have this number). I caught him out and when confronted with these details, he laughed and hung up the phone.

I've since spoken to BT and reported this... but it appears there is nothing that they can do. Really? A trace on both the calls identifies them as UK numbers - not from India.

So is it feasible that someone outside the UK can gain access to my router and cause it to drop the line? BT investigated when they would have triggered this as part of their tests and there was no evidence that this had happened. I've got the BT hub 6 - is there a bug in the firmware that would allow this to happen? (I don't have external access enabled). Is it feasible that BT have a security whole in their network? This has been raised as a complaint for BT to follow up with BT OR.

Today, I received an email stating that the complaint had been closed. No other details. I called them up. It appears that my complaint was opened and closed the same day. They've done nothing about it. It appears that BT have no way of detecting how they are able to get into their network or router to trigger this line drop. It was suggested that I block the call in case they try again. Really? How about proactively doing something about this...?

So any ideas...?

The numbers the calls originated from are almost always spoofed.
If they sounded foreign, they probably were abroad.

I'm not aware of any way that anyone can force your broadband to drop, unless you have a fault that causes incoming calls to drop sync.
That would affect every call though.

I think the BT hub has logs that should indicate wether the DSL link was broken or if it was just the PPP.

Edited by j0hn83 (Sat 23-Feb-19 21:06:42)

In reply to a post by j0hn83:

The numbers the calls originated from are almost always spoofed.
If they sounded foreign, they probably were abroad.

I'm not aware of any way that anyone can force your broadband to drop, unless you have a fault that causes incoming calls to drop sync.
That would affect every call though.

I think the BT hub has logs that should indicate wether the DSL link was broken or if it was just the PPP.

This is a common scam where a website that a person has been registered to has been hacked and the hackers have not only got hold of personal information including a persons phone number, but also the IP address of where that person has logged in from.

Once they have this information it's simple for someone to set off a DDOS attack on the persons router, then someone phones the person up and tells then they have an issue with their broadband connection and they can fix it for a fee.

It's possible the 2 situations coincidentally happened near each other.

I know that when I had problem with the phone line it turned out to be a fault at the exchange. After fixing it the first time and the phone working again within a couple of days the line went dead. So I called BT again and had to wait a couple of days for the OR appointment. It turns out someone had unplugged it at the exchange. The whole situation happened a couple of times, and in the end an OR engineer called the number and said he was moving the line to a different part of the exchange to stop it happening.

Maybe something like that as happened to you and then during that situation these con people have decided to call, which would confused the whole situation.

I can�t remember the time we lost the connection... so this part of the log file might not be correct...

09:10:39, 22 Feb.
:The LAN DHCP Server is active
09:10:38, 22 Feb.
ptm0.101:VLAN VLAN_DATA connected
09:10:38, 22 Feb.
:connection ATM_TV disconnected.[ERROR_USER_DISCONNECT]
09:10:38, 22 Feb.
:connection ATM_DATA disconnected.[ERROR_USER_DISCONNECT]
09:10:38, 22 Feb.
:VLAN VLAN_DATA disconnected
09:10:38, 22 Feb.
dsl:VDSL link Up: Down Rate=72912Kbps, Up Rate=20000Kbps, SNR Margin Down=0.00dB, SNR Margin Up=3.00dB
09:10:38, 22 Feb.
wl1:A WiFi device <18:B4:30:3C:F0:D3> has successfully connected to SSID (Device/WiFi/SSIDs/SSID[WL_PRIV2G])
09:10:38, 22 Feb.
wl1:A WiFi device <18:B4:30:3A:41:98> has successfully connected to SSID (Device/WiFi/SSIDs/SSID[WL_PRIV2G])
09:10:38, 22 Feb.
wl0:Device <18:B4:30:74:69:86> was disconnected on SSID (Device/WiFi/SSIDs/SSID[WL_PRIV5G])
09:10:34, 22 Feb.
:The LAN DHCP Server is inactive
09:10:34, 22 Feb.
wl1:Device <18:B4:30:3C:F0:D3> was disconnected on SSID (Device/WiFi/SSIDs/SSID[WL_PRIV2G])
09:10:34, 22 Feb.
wl1:Device <18:B4:30:3A:41:98> was disconnected on SSID (Device/WiFi/SSIDs/SSID[WL_PRIV2G])
09:10:29, 22 Feb.
wl1:(6/1) Channel Hopping initiated/Manually initiated
09:10:25, 22 Feb.
:Connection to the Internet has been terminated.(Reboot,Reconfiguration,forced termination)
09:10:15, 22 Feb.
ppp1:Connection to the Internet has been terminated.(Reboot,Reconfiguration,forced termination)
09:10:15, 22 Feb.
ppp1:The DYN ROUTE [81.139.56.100/32 gw ] is deleted
09:10:15, 22 Feb.
ppp1:The DYN ROUTE [81.139.57.100/32 gw ] is deleted
09:10:13, 22 Feb.
ppp1:The WAN DHCPv6 Client Process has successfully been terminated on Vlan 36
09:10:13, 22 Feb.
BR_LAN: Allocated prefix = fdaa:bbcc:ddee::/64 (valid time = 4293967296 / preferred time = 4293967296)
09:10:13, 22 Feb.
BR_LAN: Allocated prefix = fdaa:bbcc:ddee::/64 (valid time = 4293967296 / preferred time = 4293967296)
09:10:11, 22 Feb.
dsl:VDSL Link Down: duration was 2935 seconds
09:09:52, 22 Feb.
eth1:IGMP join received for group 234.55.55.55 on interface eth1
09:09:48, 22 Feb.
wl1:IGMP join received for group 224.0.1.1 on interface wl1
09:09:47, 22 Feb.
wl1:IGMP join received for group 224.0.1.60 on interface wl1

I have had several long conversations with BT over said spoofed scam calls pretending to be from BT.

I have told BT unless they can stop all VoIP Services that don't force a number then BT won't be able to stop it.

I think ALL VoIP Services should be responsible for its clients and should only allow valid numbers in its range or numbers registered to them, all over used numbers should be rejected.

BT response was they are looking into how to stop these, but they cannot force a 3rd party to follow those rules.

I then said well if they fail to follow them, then reject them end of.

BT laughed and said they would love to do that, sadly they cannot.

So BT are very aware of the issue.

Paul.