I have a very weird problem I’ve never stumbled on before and struggled to find any discussions about similar situations when searching online. I have a Computer Science degree and a professional background in Cyber Security Consultancy but have been in a different industry for the last few years, and my role was never particularly technical. Approaching a professional contact about this feels a bit weird so I thought I’d come here first.
I am currently living with my spouse’s parents in the UK. They use Virgin as their ISP. They have a Hub 3 and their WiFi SSID and password are the factory defaults – the SSID is `VM` followed by several digits, and the WPA2 password is a random series of characters, and the details can be found on a sticker on the bottom of the router.
We now have so many people living in this house that the Hub3 was really struggling with the number of connections, so I bought a high-end router with the intention of putting the Hub3 in modem mode and connecting up the new device to handle all the WiFi routing.
I began to do all this, but then noticed that my phone still had a weak connection to the Virgin router, which was powered off.
I used a WiFi analyser app to determine where in the house got the best signal with this mystery access point, and found that the back of the house, and most specifically my in-laws’ bedroom has a very strong signal. The signal is also much stronger on one side of their bedroom than the other.
My in-laws are adamant that there is no secondary access point in their house. Moreover, the main socket into the house is all hooked up to the Hub 3 router. Moreover, their bedroom was recently redecorated and so nothing has lived in there for very long and been long-forgotten. Also, no such device is visible. The conclusion is clear – the internet connection is coming from the OTHER SIDE OF THE WALL, in the neighbouring house.
Moreover, the access point is a Talk Talk router – NOT Virgin!!! It should not have an SSID that begins with VM, but an SSID that begins with TalkTalk.
I did a WHOIS lookup on my public IP address while connected and found that it was indeed a Talk Talk internet connection.
This access point has working internet, but is secured with our SSID and WPA2 password. What gives?!?!
The house next door is a rented multiple occupancy house, so it constantly has new people moving in and out. I have no idea how long this spoofing has been going on for, but my in-laws reckon they’ve had this Hub 3, and therefore these credentials, for somewhere around 2.5 years.
Here’s an imgur album with some (redacted for privacy) screenshots of my investigations: https://imgur.com/a/oxgpZ3j
Here are my sky-high theories so far.
Step 1: Some time ago, someone in that house with no money for their own Internet connection obtained my in-laws’ WiFi credentials. Either brute force, or some sophisticated packet sniffing, or more likely, they somehow overheard the details or saw the sticker through the living room window.
INNOCENT EXPLANATION:
Step 2: They begin to piggyback off the Internet. They also give the credentials to other residents, who may or may not realise this is their neighbour’s internet and therefore illegal.
Step 3: The original thief moves out. The credentials continue to be shared throughout the house.
Step 4: Eventually the landlord or someone establishes a legitimate Talk Talk internet connection. The person setting it up asks what the name and password should be. It is concluded that to ensure that everyone’s devices remain connected, they should use these existing credentials that have been passed around for a while.
Step 5: The two houses continue on obliviously alongside each other not realising they share network credentials.
MALICIOUS EXPLANATION:
Step 2: Someone is trying to perform man-in-the-middle attacks on us? and/or LAN attacks on our devices?! In order to steal bank details or something even more nefarious like a comprehensive identity fraud campaign?! Eek!
So my questions are:
- What do you think is happening here?!?!?!
- What should I do next? Continue to investigate? How? Or report it? To who? The police? My in-laws don’t want hostile relationships with their neighbours and especially not because of some simple misunderstanding. They are rather friendly with one of the occupants, so perhaps they should talk to him? But if there is something nefarious going on in that house, I don’t want to tip them off that I’ve caught them before the authorities can gather the evidence they need to prosecute.
