Security and Anti-Virus

[x15ks849kljh]

I've just received the 6th in a series of invalid Comcast Notice of Abuse Copyright Infringement notifications.

Initially, not being a torrent user, I thought that I might have a lapse in my wireless securty so I re-secured my network/router.  After that, I scanned all of my ports and not a single one was open.  I then went to the IP address listed in the e-mail and scanned the port listed there.  It was still responding.  When I looked at my router config and checked my IP I realized that, horror of horrors, Comcast has the wrong IP information recorded for my account.

This is unbelievable and unacceptable.  To think that Comcast could be supplying this information to support copyright infringment cases is infuriating.

And this is not the part that is most upsetting.  What is most upsetting is that when you call the phone number listed on the e-mail you get an annoying long-winded voice message.  I tried calling other numbers within Comcast and got forwarded back to that number with the annoying message.

I'm so angry right now that I could cancel my internet service.  But I CAN'T do that as I don't think that would make a difference in the record keeping and Comcast would still be reporting that IP as mine.

I have documenting evidence for anyone who wants to see it.  I've also forwarded that evidence to the EFF.

[USAF_E-8_RET]

Is this the number your tired?

 Comcast Customer Security Assurance Department:

 1 - 888-565-4329

[x15ks849kljh]

Yes.  That's the number that I tried.  Also, the same one that I get forwarded to when I call Comcast customer service.

[USAF_E-8_RET]

I've reported this to the forum admin and hopefully he can reply with someone to call and or he may request more info from you to look into this since the folks who I would think should be able to help sem unreachable.

Please continue to monitor this thread for his response.

[CasperVTX]

I have a similar episode here.  I got mail this morning that said my IP address had been associated with a copyright infringement related to Death Race 2 2010 DVDRip - [CyberPiraten] - which I interepret as someone either posting or viewing a bootlegged video.

Interestingly I never have seen that video, don't host Bit Torrent (or use it) nor can I find ANY evidence of an infected PC out of the four that were on the network overnight.  I have scanned AV, Spyware, MALWARE and searched for copies of Bit Torrent on each computer.  I'm also running a packet sniffer and after 2 hours have seen absolutely NOTHING unusual.

I live down a dirt road and am WAY more than 300 feet from my closest neighbors so my WIFI AP isn't openly accessible.

So, my question is now what? The e-mail says I can respond in writing or via e-mail but there is no e-mail and frankly I want something a little more time sensitive than snail mail in terms of "clearing" my name.

Any ideas or suggestions (and yes I'm calling them tomorrow) - I'm more interested in ideas regarding finding any hidden something that I'm missing.

Tks

[EG]

---

CasperVTX wrote:

I live down a dirt road and am WAY more than 300 feet from my closest neighbors so my WIFI AP isn't openly accessible.

---

O/k but is it secured with WPA2 wireless encryption ?

[x15ks849kljh]

I'm WPA2 with a very strong password. I also scanned my ports using ShieldsUp at GRC.com. CasperVTX, you should do this.

My advice to anyone receiving these notices:
1. Verify your IP address at whatismyipaddress.com
2. Check your router's connection status to see how long you had the lease on your current IP.
3. Scan your ports using ShieldsUp at GRC.com.

It wasn't until doing all of this, and scanning the offending port still open at the offending IP, that I was 100% sure that Comcast was wrong.

Now getting someone to fix it is another story.

[CasperVTX]

It will be today simply because of the outrageous possibility of someone gaining access based on this notice.  However, let me put it this way.  I have walked around my 2 acres of land with a laptop when I established this AP expecting a signal to be possible for 300 feet.  Outside of 30-50 feet beyond my residence (depending on which side of the house I was on) there is ZERO signal from my wireless.  For someone to gain access they would have to be squatting in my yard.  

And while I would appreciate the resilience of someone doing that - I certainly would not expect them to do so to watch a hacked movie.  To say nothing of putting up with the cold, the (shall we say wildlife) and the potential of being seen and meeting a projectile moving at multiple feet per second.

[LoPhatPhuud]

Before you go off the deep end condemning Comcast, remember they are just  the middleman in all this. Some else supplied them with the IP address. Comcast looked it up for the date and time of the supposed violation and sent the letter.

Could the Comcast lookup make a mistake? Sure, but unlikely. Most likely the error, if  there was one, came from whoever sent Comcast the notice.

[x15ks849kljh]

Going off the deepend?  If the deepend is where the truth lies then yes.

It is not my IP address.  It was not my IP address at the time of the infraction.  If you read my original post you will see that, indeed, the correct IP address was provided to Comcast.  The port at that IP, one that was not and is not mine, was open and continues to be open and down/uploading copyrighted material.  It is Comcast that notified me with a Notice of Abuse.  It is this same faulty information that Comcast will provide to the courts when subpoenad to do so.

We are being falsely accused of copyright infringement.  Something that could cost us reputation and money.  Condem Comcast I will.

This is undoubtedly Comcast's mistake.  Being a Security Expert, I find your blind faith that it is not their mistake disturbing.

I'm sure that you are a fine person and I know nothing about you, but you should have all the facts before commenting on a post that you apparently know nothing about.

[LoPhatPhuud]

In  your original post you did not mention that your IP address at the time of the infraction was not the IP address mentioned in the notice. You do realize that IP addresses are not static, unless you paid for a static address. They can and do change.

Again, I am not defending Comcast. I stated that a mistake was possible, but unlikely. Also, check your router logs. They should show your IP address at the date(s) and times in the notices as well as the sites visited.If there has indeed been a mistake, then the logs are your best evidence.

[x15ks849kljh]

I know that IPs can change.  This is why I have a screenshot of the duration of the IP lease that encompasses the time of the infraction.  You think that it is highly unlikely that Comast has made a mistake yet I have proof that they are wrong in this case.  And it looks like that are wrong in CasperVTXs case.

In the absence of any reply from Comcast, I'm telling my story to all that will listen.

As a Comcast user, you should be concerned.  It could happen to you.

Now my next question is, do you think that they are attributing the data usage at the misidentified IP to my account?  Are they getting the increased speed that I'm paying for?  This raises many questions.

[Barmar]

Usage data is tracked by modem MAC address, which is much more stable than IPs.

[another-user]

i just got two of these my self today. 

normally, id just look at these and go ok, i know what that was.  i wont do that again.

the problem ive had today is that both of them have been blanks.   one had a case number that said Not Applicable, with no detail on infriged items..  No reported date/time with it either.   

the 2nd one has a case number, no date/time, and no detail on infringed items.    no IP listed with either of them either.

im wondeirng if comcast sercurity glitched today and started sending these out at random today.

[CC_Dete]

Hello everyone - I've escalated your concerns to leadership with our security team.

[x15ks849kljh]

Update:

I did finally get a call from Comcast.  I was told that they were just the middlemen and that the offending IP was attributed to me.  Both things that we all already know.  They also told me that the IP is no longer associated with me.  They did not tell me how the wrong IP address was associated with me.  Nor did they tell me what IP address is currently associated with me.  It appears that we're all going to have to be responsible to verify that they have the correct information on file for us.

Comcast, is there anyway that users can find out which IP your records show is associated with us?

[mefoucher]

I have been going through the same thing. The number comcast gives you to call gives you a ridiculous 15 minute speech/explanation and you are never able to speak to a live person, only leave a message and they'll call you back. I received two notices the first gave no information and when comcast finally called me back they said they made a mistake and not to worry about it. Now this morning I get another with actual info as following. 

Copyright work(s) identified in the notification of claimed infringement:

Evidentiary Information:
Notice ID:  255-866467
Title:  Tangled
Title:  Tangled
Protocol:  BitTorrent
IP Address:  24.16.162.143
DNS:  c-24-16-162-143.hsd1.wa.comcast.net
Port ID:  60294
File Name:  Tangled 2010 V2 Encoded XviD CAM
File Size:  800611671
Timestamp:  05 Mar 2011 22:01:32 GMT
URL (if applicable): 
Bay ID:  915fa915a7f223a621b5495f16213a11ad9622f0|800611671

I don't understand what all this means as I am fairly computer illiterate. I do know when I check my network preferences on my MAC and my laptop that is not the IP address that shows yet when I go to myipaddress on the internet it comes up as the one listed above. Can anybody give me some advice/explain? Like I said I'm no computer guy all I ever use it for is email and reading the news. I don't download movies etc. Any help is greatly appreciated!

[mefoucher]

BTW Comcast people if you're reading these threads how about a number to contact with this issue that doesn't give you a 15 minute condescending recording about "checking with your family about their downloading habits" etc, etc, and gives us the option to press 0 for an operator or to be able to skip this and leave a message???!!!

[USAF_E-8_RET]

@ mefoucher,

I have asked our admin again to ask the Security Team to do something about that lengthy message.  The only folks that can do something about it is that team, our admin, nor us volunteers can do anything about it - no matter how much we agree with you! 

[CasperVTX2]

Unfortunately if you are not familiar with how the protocols work across the internet this may be a bit greek to you.  I am not a network person but I do have degree(s) in computer science and at least understand the basics.  That said - you have to understand that the IP address the "world" sees you as will most likely NOT be the IP address you see within your own "home network."  The reasons are too lengthy to explan but I am betting your internal IP address is a 192.16x.x.xxx or similar.  This is a type of IP called "Class C" and is typically not routable.  

The IP address you see referenced below is actually assigned to COMCAST (do a whois 24.16.162.143 - which interestinly does not return a valid response).  THisi s purportedly the address the world knows you by.  This routes (supposedly) to a server which then through the ISP software processes translates to the MAC address of your modem and sends communications to your modem which in turn returns the communication to the computer that requested the information, link or whatever.  That is routing in a nutshell.

The Protocol in the notice is saying that the "offending" protocol used (and the port 60294) are associated withe the BitTorrent P2P process (google it for information).

So in essence this is saying that someone is filing an infringement against a computer at the IP assigned to you (by COMCAST) for using a filed identified as Tangled 2010 V2 Encoded XviD CAM using the BitTorrent protocols and port 60294.  the time is as shown and the "bay ID" I presume is how COMCAST knows it was "you."

[LCrosby]

I got one of these today.  It is not my IP address and it says I downloaded something I didn't download nor do I have it available for download.  I've never heard of the download, nor have I ever heard of bit torrent.  The phone number seems like a scam-  Phone: (888) 565-4329.

They tell you over and over to press star for more information about the phone number, then they say to reply Y to the text and it will charge you $9.99 a month for 20 look-ups.  What the heck?  I have no clue what it means.  I assumed it was coming in as spam to get folks to call and get stuck with a big cell phone bill until I saw this forum.  Comcast, HELP!!!  I'm tired of this!

[RobW_AA]

Hi LCrosby,

I will have someone from the Customer Security Assurance team give you a call.  Sorry for any inconvenience.

Please send me a PM if you need them to contact you on a phone number not on your account.

Thank you,

Rob W

Comcast

[tcallahan004]

I recently received an email that said I downloaded a movie using bittorrent. I would like to know if that phone # is really for comcast (Phone: (888) 565-4329). I have zero interest in the movie I am accused of stealing - hadn't heard of it until that email showed up. Thanks.

[USAF_E-8_RET]

@ tcallahan004,

Yup, that's a legit Comcast Phone number.  Bottom of the left hand column at this link:  http://security.comcast.net/get-help/contact-comcast-security.aspx

[Dorisdnm]

We have received the same notice, two times within the last week. There is no copyright infringement going on at my home, nor from my computer! We do not even listen to the music we are being accused of downloading. Comcast has a monopoly, and rarely do they resolve anything, unless it is to their advantage. If my service is interrupted, or disconnected, as they have suggested, there will be a huge issue.

Doris/Mike Doty

[Anon24806]

I got one of these today as well.  Sounds pretty fishy to me and I don't have the time to sit and listen to a 15 minute call about something that I didn't do in the first place.

Is it real?  It looks official but so do many other phishing emails that I get.

[ajaxfc]

Similar to everybody else I have received 2 of these e mails this week for the same movie.  I do not file share or use any P2P services.  When reviewing the information I also noticed the offending IP address listed is not mine.  Additionally, the offending IP address listed is different in each incident.  Would this descrepancy not be enough information for Comcast to realize something is not right?

Do I need to contact the Comcast to point this out, or shoudl I just file the e mails away?  Also, how would I get CSA since there is not a email contact listed and it sounds like the phone number is no more than a 15 minute lecture. 

I appreciate any insight anyone can provide me.

Thanks!

[Baric]

One thing to keep in mind is that your public IP address can change, sometimes often. So while the IP listed maybe not be yours NOW, it may have been yours at the time of the claimed infringement.  I'm not saying it is, just that it's possible.

If you're sure neither you nor anyone on with access to your network did this, then you should check your wireless network for intruders like neighbors, etc.  If your wireless network is secured (WEP does not count, it's easily broken), then I would change your wireless password.

As for contacting Comcast, or resolution of the issue, I can't offer anything there, sorry.

[x15ks849kljh]

IP addresses CAN change but rarely do with Comcast.  And it's starting to become evident why.  They probably do not have a mechanism to automatically track when it changes and what it changes to.

[Baric]

I'm pretty sure that's completely untrue (about them being able to track changes).  As for actual IP changes, yeah, the majority of us will have the same IP for a long time, but I know for a fact that it can happen, especially if an area is undergoing some changes like upgrades, expansion, etc.  It's happened here, although not recently.

It's much more likely that the data provided to Comcast is questionable, and even for those that are accurate, it only says their connection was used, not that they did it.  As has been conclusively demonstrated in recent court cases, IP address does not necessarily equate to a person.

[davegreen]

Haven’t got one and hope I don’t. If it were me, and I couldn’t get anywhere with Comcast, and I was sure I wasn’t at fault. I would file a complaint with my states attorney general and consumer protection.

Been there done that on other issues (not Comcast), you would be surprised how helpful companies are when they get an inquiry from an attorney general.

[cox1102]

For educational purposes If comcast warns you of suspected copyright infringement and you believe it is in error, is your information still sent to the proper authorities or are you given the benefit of the doubt until repeat offences establish you as a legitamate offender? I have always wondered how customers are protected from wrongful prosecution in matters such as this.

[LoPhatPhuud]

In simple terms, Comcast will not release subscriber information due to alledged Copyright Infringement without a court order.

See the Comcast/Xfinity Privacy Policy here:

http://www.comcast.com/Corporate/Customers/Policies/CustomerPrivacy.html

The pertinent part is in the third paragraph of the following portion of the Privacy Policy:

When is Comcast required to disclose personally identifiable information and CPNI by law ?

We make every reasonable effort to protect subscriber privacy as described in this notice.  Nevertheless, we may be required by law to disclose personally identifiable information or individually identifiable CPNI about a subscriber.  These disclosures may be made with or without the subscriber’s consent, and with or without notice, in compliance with the terms of valid legal process such as a subpoena, court order, or search warrant.

For subscribers to our cable television service, the Cable Act requires Comcast as a cable operator to disclose personally identifiable information to a third-party or governmental entity in response to a court order.  If the court order is sought by a non-governmental entity, we are required to notify the subscriber of the court order.  If the court order is sought by a governmental entity, the Cable Act requires that the cable subscriber be afforded the opportunity to appear and contest in a court proceeding relevant to the court order any claims made in support of the court order.  At the proceeding, the Cable Act requires the governmental entity to offer clear and convincing evidence that the subject of the information is reasonably suspected of engaging in criminal activity and that the information sought would be material evidence in the case.

For subscribers to our high-speed Internet and phone services, the Cable Act requires Comcast to disclose personally identifiable information and individually identifiable CPNI to a private third party in response to a court order, and we are required to notify the subscriber of the court order.  The Cable Act requires us to disclose personally identifiable information and individually identifiable CPNI about subscribers to high-speed Internet and phone services to a government entity in response to a subpoena, court order, or search warrant, for example.  We are usually prohibited from notifying the subscriber of any disclosure of personally identifiable information to a government entity by the terms of the subpoena, court order, or search warrant.

[cox1102]

Thank you for the clarification. The legal rhetoric was a little murky and hard to understand. I now feel a lot safer trusting my information to Comcast to act as my ISP. I thought to ask because of a number of horror stories of wrongful accusations or honest mistakes that turned into legal troubles and termination of service that have been floating around.

As mentioned before, my questions are asked for educational purposes. When reading a "Terms of Use" page, it's a little difficult to get a straight answer. Thank you for your help.

[blueberryboomer]

I have recieved 3 of these in the last week. I planned on calling as it must be a mistake. I have recieved 2 of them for movies and another today for some rap music. What is up...

[LoPhatPhuud]

Mistakes are possible. The copyright holder notifies Comcast based on the IP address of downloader. Comcast then looks up the IP to find out who it was assigned to on the date and time of the purported infrigement. There are multiples places for errors, and the system is far from perfect.

If you have a wireless network, make sure that it is secure to prevent unauthorized access.

[infopug]

Hmm This is starting to occur a lot recently. Here's what I recommend for those in this situation:

First, Make sure the email came from comcast. Phishers are getting smarter and can change the From: field. To check who the email is really from if you use xfinity connect for email, right click the email in question and click view source and Look at Received:. If the Email is from Comcast, It should say something like mailgate.comcastonline.com. If it doesn't then the email is probably fake. **Note Mail from Comcast Employees will have comcast.com in the Received field.**

If the email is Genuine, I recommend seeking help from the Comcast Twitter Team if you want to talk to Someone from Comcast about this. There is a twitter stream for @comcastcares on the main page of the Forum.

If the email isn't Genuine, Delete it

Keep in mind though, Mistakes do happen

[rbenn1]

I've received four of these false claims, including two this week. I've never downloaded a movie. I have a cable modem, not a wireless router. I live alone and no one else has access to my computer. I've spent the last few weeks setting up a new email account elsewhere and transferring all the online bill paying information for myself and my elderly father. It's been a pain, since I have had the Comcast email for 10 years.

I am now ready to call Comcast and cancel my internet service. I'm not a computer expert and I don't have the time or money to spend proving I am not a criminal, nor should I have to. The 888 number is useless. I am at the end of my rope with Comcast.

[khondker]

There must be something very wrong in your system. This is the 4th time I received a copyright infringement notice from comcast! I have, NEVER, EVER, downloaded ANY copyrighted stuff, that's all I can swear about, unless, somebody is hacking through the 'security' barriers YOU have set in place, because I do not have any other than what you provide me. 

Please, look after this matter. 

I have a load of software, all licensed, because I consider it unethical to get them otherwise. Why would I care to download some stupid 'akon' or something's music, I never even heard the name of?!!!

Please, please, address the matter, or I have to look for another ISP.

It's embarrassing, humiliating, -something you are doing this to a long time customer.

[khondker]

Yeah. I've called that number, and spoke to someone without a clue or crumb of help.

[USAF_E-8_RET]

@ khondker,

Are you on a wireless setup??  if so could someone be using your connection for their pleasure?

I am not well versed in all the security requireed for wireless - but I can suggest you at least do the following to get an idea if someone may be piggybacking your wiresless.

Go to the top of this page and under Customers, click Manage my Account > Sign-in >close the eco-bill popup if you get it > select users and setings > close to the top in the middle of the page you'll see High-Speed Internet Data Useage, with a graph showing your current useage and below it will be a link for View Details.  Please click it and it will show your useage history for the current month and graph of your useage the last three months.  Is there any large jumps?  Perhaps indicating that someone is stealing your wi-fi bandwidth?

Let us know and I'll get someone much smarter than I am in this area to assist you.

[zeike]

I don't want to get in the middle of all this but about a week ago I found a bookmark at the bottom of favorites and am sure it said Bit Torrent ! never been there, don't know what it is. so I went to the web site and never seen it before, so I closed it and deleted the bookmark. I don't know how the bookmark got there and I have a router, use xp and keep it updated.in everyway.

[khondker]

Thanks much.

I have done as you advised me, but the volume of bytes an alleged piggybacker is using wouldn't be large enough to impact the graph, but enough for comcast to omigosh about. 

I do use a wireless broadband router that connects me to the laptop at home, other than the desktop I use mainly. 

I also have a 3g/4g modem that connects me to my laptop outside home. 

Should I consider disconnecting the wireless router, and connect the cable directly to my desktop?

----

When I use wireless connection, it always shows a number of users in the neighborhood, all of which show 'locked'; which means, I cannot use their lines without a pass word. My modem to them, too, should show up as locked. If so, how is anybody being able to get access to my line without my password? 

[USAF_E-8_RET]

@ khondker,

I have asked a Connection Expert ( goes by EG) to assist you.

[EG]

You are not using just WEP wireless security encryption on your router are you ?

[khondker]

Not sure. This is the router I got from Comcast. Now, in the process of finding out, I can't find it's ID (starts with SMC etc) on my desktop, but from laptop I can connect.

If I should not be using this, what should I? And how could I change it to more secured one?

[EG]

WPA is better, And WPA2 is far more secure than is WEP.

[tdiddy]

I received a notice of infringement for an IP I've never had and for a movie I've never downloaded. Calling the number in the email isn't getting me anywhere, and I'd really like to get this cleared up and find out why Comcast thinks the IP address belongs to me. Business class support just directed me to the same phone number.

The email was also sent to a secondary email address on my account - I upgraded from residential to business class earlier this year and had the residential email moved over to my business class account as a secondary email address so I could keep using it. The infringement email came to my old residential email address. Is it possible Comcast somehow thinks this old residential email is tied to someone else's modem?

Thanks

[drea922]

I got a similar notice today and it indicated infringement last night and also occurred 4 days ago tho I did not get a notice 4 days ago.  I do not use bittorrent and never heard of the avi it said it downloaded and it is not on my computer.Oddly 3 days ago Teleblend had me manually change my IP addresses for the devices due to my problems getting VOIP and Internet to work at same time suddenly. The time frame is suspicious. 

I HAVE been experiencing loss of VOIP and internet during this week. I finally took my router completely down thinking this was faulty I discovered that AVG had been detecting a rootkit iq5, and another virus in HP Games directory. It is set to remove but apparently it did not or it kept coming back.  I am working on cleaning the registry of those now and I have no idea if this allowed my system to be hacked or not. It is ODD that teleblend changed the IP address about the same time they claim I downloaded this Bittorrent AVI file. But, that is not the IP address I show now. Is there any way for me to actually see what the IP address was last week?? 

I discovered just today that I had been infected by rootkit 3 days ago on a nightly scan but AVG apparently did not remove it. I manually removed and it returned so I have deleted the entire HP Games folder it was residing it. Working on manual removal in registry now. I have no idea if this is behind our issues, but it looks surely probable. 

These were the viruses avg kept findng and had not successfully gotten rid of.
win32.nrgnbot.rtk
w3i.iq5.fraud

That annoying message you get when you call seemed to indicate this could be ignored after securing your system, etc.  SHould I still snail mail a response on this? It is scary to get one of these emails.

I do know that the only other time I have been infected was having my email hacked from the Comcast site. I know it was the Comcast site because it only sent fake emails out to the 2 people that were in that address book, not the hundreds on my own computer. This happened twice and both times caused interruption of my internet service and massive password changes...

[AGhelp]

I just noticed I received this notice to from a movie supposedly on bittorrent. I got these e-mails through an account I don't normally use or access. Checked it after recieving a letter at home.

Seems to be a pattern for the bittorrent site. Afterwards, I also got a letter about a DNS changer bot. Wondering if it's related. I did not download. I've made all recommended changes comcast has you do to scrub for DNS changer bot. I am worried about the infringement, I dont even recognize the movie name and know I didnt download it.

If the DNS bot inherently can control your computer or the router so to speak, it would appear these instances may be related. They also seem to be from the same website "bittorrent".

I had also recieved a phishing email stating they were comcast around the same time. Can all of this be related?

Also, some of my problems occurred while "internet was down in our area and comcast was aware of the issue". Had refreshed ours several times to, yet it's all a coincidence when you ask.

Will the fix and encription secure our home network and how do you report that the information is incorrect?