Stolen PS3 trying to connect to Router??

davidhammers · Feb 10, 2014

Hello everyone.
As you can read from the title I'm in some kind of a trouble here, I've been stolen many things from my apartment and amongst them there was a PS3. Besides the incredible way they've got into my house, there's one another unbelievable things which I sincerely hope is just a bug of my WiFi Router or such.

The console was stolen some days ago, and today, when casually reading the Events Log in my Technicolor TG784n Router, I noticed that a device with the very same PS3 MAC Address was trying to connect to the router, failing to estabilish a connection and resulting in this Event:

LOGIN wireless station [my: ps3:mac:address] can't get authorized.

The operation was done twice yesterday night (7PM circa) and about 15 times today from 11AM to 2PM, when I eventually changed the WiFi password.
The tentatives didn't seemed to follow any particular time pattern, with time spans between one and another almost always different and ranging from 1min to 15min. In 2 occasions the operation was repeated exactly 1 minute after the previous (i.e. 12:24:33 Failed Connection - 12:25:33 Failed Connection).
The console was connected via WiFi to the Router, and I sometimes used it to stream movies from the PC to the Console with PS3MediaServer. I never have configured the console in the Router any differently than my iPhone or Laptop, which means simply renaming the random name the Router assigns into something I can easily recall.

Now, what the f*** is going on?
Is it possible that the router is somehow trying to connect to the console, resulting in a failed connection? (which to me seems unlikely, since nothing similar happens with the laptop i.e.)
Or, should I start to have some doubts on the neighbours?

Thanks everyone, you can't imagine how creepy it is when someone brokes into your house and literally goes into any single corner of your everything. Amongst the stolen things there are two backup HDs which contained the past 6 years of work, and I totally need to find a way to get them back.
Cheers,
David

rolli59 · Feb 10, 2014

The router does not ping devices so it looks like you have a dishonest neighbor.

davidhammers · Feb 10, 2014

But the Console was properly set up to connect to the Router, when it was in my bedroom it totally was connecting automatically. How come it doesn't anymore?

rolli59 · Feb 10, 2014

Any passwords?

davidhammers · Feb 10, 2014

Sorry I don't understand.
The password is required to access the WiFi Network, and I changed it today after seeing the list of failed connections.
But it sounded strange, because the PS3 had the WiFi Key saved and was set to automatically connect to my Network. Why would it fail the connection? And why it stopped trying as soon as I changed the password?

COLGeek · Feb 10, 2014

Unless the PS3 is physically close enough to your wireless router, it can't even try to connect and it certainly can't connect from outside your local network.

You could, however, have someone spoofing a previously known, good MAC address in order to connect to your network (the one used by your stolen PS3). Changing the wireless password will take care of that, if that is the case.

What type of wireless encyrption (WEP, WPA, etc) are you using?

davidhammers · Feb 10, 2014

I'm using a WPA key, and up until today it was the factory default.

What do you mean with spoofing? Is it someone outside the network trying to remotely connect to my router, or someone/something (cameras, mics) inside the WiFi Range?

COLGeek · Feb 10, 2014

They would have to be inside your network. Connection from the outside should not be possible unless you have opened a hole in the firewall allowing external access. If so, close it. I would also recommend changing your router's admin password, in addition to the WPA passphrase.

davidhammers · Feb 11, 2014

I have no idea how to access the advanced Firewall configuration, it's seems I don't have permission from the router's Admin page...
Anyway, I changed both the pwds and the suspicious connections stopped. Do you think I can fully exclude the idea that my console is in the neighbour's apartment now?

COLGeek · Feb 11, 2014

Well, you can't exclude the idea that your neighbor has the PS3. If the device was actually still trying to connect to your network, that would imply that it is still physically in range of your router (or that someone else was using that MAC address).

In your router's logs, are you seeing any other failed connection attempts?

Also, have you reported the theft to the authorities/landlord/insurance company?

rolli59 · Feb 11, 2014

COLGeek :

Agreed!

davidhammers · Feb 11, 2014

In the router logs every suspicious connection stopped right after I changed the WiFi Network password the first time.

I do have reported the theft, but I'm quite sure the police is not going to be keen on investigating on a theft worth less than 1.000. I called Sony and reported the console's serial number as stolen, but they said they can only do something in the remote eventuality the future owner will open an Assistance Ticket with the reported serial. On the other hand, Police should contact Sony to request some sort of a log of any access to their servers of my console, then trace the IP and so on, which is very unlikely to happen.

EDIT: thanks everyone by the way, I really need to clarify the situation and eventually update the Police
EDIT2: "If the device was actually still trying to connect to your network, that would imply that it is still physically in range of your router (or that someone else was using that MAC address)." ---> But as said before the console had the WiFi password stored, why would it fail to connect if it was in the router's range?

COLGeek · Feb 11, 2014

It would fail to connect for 2 reasons. 1) You changed the password on the router, or 2) the signal was too weak to establish a good enough connection to establish a link with the network.

davidhammers · Feb 11, 2014

Now it just started happening again, for f***'s sake.
The console MAC address is trying to connect to the router, exactly at 1min of distance one from the other.

I changed both the router pwd and the wifi network pwd, if it was spoofing I should have sorted it and this shouldn't be happening again, right?

EDIT: I tried disabling the password protection for the WiFi Network, and the console stopped failing to connect, it wasn't displayed as connected to the router tho. As soon as I re-enabled the password the error message started to appear again, exactly 2 seconds after the configuration change was saved on the router. What's the god damn deal guys? I'm goin out crazy!
If the point was a password error the console should have been connected for the 5 minutes I left the network unprotected. But if the console wasn't in the area, how come it attempted to reconnect to the router as soon as I changed the configuration?

davidhammers · Feb 11, 2014

Something fishy is definitely going on here, sorry to spam the forum but I'm quite worried.
After a decent amount of failed attempts (15 circa), the DSL went down, in the Event Log different Firewall entries were modified and then service is back up and running with the console attempting and failing to connect. I just don't f*ing get it guys. Here's the log:

Feb 11 21:21:38 LOGIN wireless station [my : ps3 : mac : address] can't get authorized.
Feb 11 21:20:38 FIREWALL event (1 of 1): modified rules
Feb 11 21:20:38 FIREWALL event (1 of 1): created rules
Feb 11 21:20:37 DHCC lease ip-address 10.XXX.XXX.79 bound to intf ipWANVoice
Feb 11 21:20:37 DHCC IP address 10.XXX.XXX.79 (255.255.240.0) set on intf ipWANVoice: ok.
Feb 11 21:20:36 LOGIN wireless station [my : ps3 : mac : address] can't get authorized.
Feb 11 21:20:35 FIREWALL event (1 of 4): deleted rules
Feb 11 21:20:35 GRP Default destination is routed via gateway 10.YY.YYY.1
Feb 11 21:20:35 xDSL linestate up (ITU-T G.992.5; downstream: 22239 kbit/s, upstream: 1157 kbit/s; output Power Down: 18.4 dBm, Up: 12.1 dBm; line Attenuation Down: 17.0 dB, Up: 11.6 dB; snr Margin Down: 6.9 dB, Up: 6.1 dB)
Feb 11 21:20:12 xDSL linestate down
Feb 11 21:19:49 xDSL linestate down
Feb 11 21:19:36 LOGIN wireless station [my : ps3 : mac : address] can't get authorized.
Feb 11 21:19:24 xDSL linestate down
Feb 11 21:19:01 FIREWALL event (1 of 2): modified rules
Feb 11 21:19:01 FIREWALL event (1 of 3): created rules
Feb 11 21:19:01 DHCC IP address 10.XXX.XXX.79 deleted: ok
Feb 11 21:19:01 xDSL linestate down
Feb 11 21:19:01 GRP Default destination is not routed anymore via gateway 10.YY.YYY.1
Feb 11 21:18:34 LOGIN wireless station [my : ps3 : mac : address] can't get authorized.
Feb 11 21:17:30 LOGIN wireless station [my : ps3 : mac : address] can't get authorized.
Feb 11 21:16:52 SNTP Synchronised again to server: 10.XXX.XXX.1
Feb 11 21:16:21 LOGIN wireless station [my : ps3 : mac : address] can't get authorized.
Feb 11 21:15:14 LOGIN wireless station [my : ps3 : mac : address] can't get authorized.
Feb 11 21:14:10 LOGIN wireless station [my : ps3 : mac : address] can't get authorized.
Feb 11 21:13:10 LOGIN wireless station [my : ps3 : mac : address] can't get authorized.
Feb 11 21:12:09 LOGIN wireless station [my : ps3 : mac : address] can't get authorized.
Feb 11 21:11:05 LOGIN wireless station [my : ps3 : mac : address] can't get authorized.
Feb 11 21:10:00 LOGIN wireless station [my : ps3 : mac : address] can't get authorized.

COLGeek · Feb 11, 2014

Go into your router and block that MAC address from accessing your network. Also, is your network broadcasting its SSID? If so, change the SSID and stop broadcasting it. Will make it harder to find your network.

It sounds like the PS3 is still within range of your network.

davidhammers · Feb 11, 2014

I can't block the MAC addresses on my router :/
Besides, shouldn't I try to get my router closer to the neighbours apartment and see if the console gets hooked up with the router (of course without any pwd required to access the network)?

COLGeek · Feb 11, 2014

That is up to you. I would also recommend you change your PSN password as well, BTW.

rolli59 · Feb 11, 2014

I would report it to the police being this close, presuming you reported the theft in the first place.

davidhammers · Feb 11, 2014

I did a first report, but after calling Sony and reading how does the procedure works I kind of lost hope.
First off I'm quite sure the police is not going to be keen on investigating on a theft worth less than 1.000. I called Sony and reported the console's serial number as stolen, but they said they can only do something in the remote eventuality the future owner will open an Assistance Ticket with the reported serial. On the other hand, Police should contact Sony to request some sort of a log of any access to their servers of my console, then trace the IP and so on, which is very unlikely to happen.

But what do you mean with 'being this close' ??
Are you confirming COLGeek hypotesis that the console is in my router's WiFi range, thus it's in my neighbours apartment?

rolli59 · Feb 11, 2014

Yes from my first reply! Since it has to be in range to try to connect.

COLGeek · Feb 11, 2014

The IP trace (if connected) would be back to your router. What makes you suspect your neighbor, by the way?

davidhammers · Feb 12, 2014

Well I just recently moved into this apartment, who knows if the previous residents ever gave a copy of the keys to the neighbours? And who knows if they kept/copied it? I unfortunately haven't been informed by the owner that the key wasn't changed in years, and being sure this was the most obvious thing a landlord would do when changing residents, I've never worried about it.
Besides, I've been away one full week and the apartment was robbed the very first night, because I have friends that have seen the living room light left on less than 24h after I left.
So it can either be a close friend (even more creepy) or someone who has clearly seen me running out of home with my luggage at 7.30AM and thought that I would have spent at least one night away.

Not to mention this so much looks like a childish robbery...
I have 5k+ of Audio Hardware in the studio, they didn't even touched any of it, but went searching thoroughly into any single envelope or copybook.
They stole a pair of crappy clearly damaged headphones (which were connected to an Allen&Heat Mixer they didn't touched), a Zippo lighter, and all this kind of cheap stuff while they could have gotten so much more. On the very same table they used to search for cash through the evenlopes I had in the drawers, there were two drum machines, a midi keyboard and another usb controller. They didn't even bothered moving the papers and cables covering the devices to see what they were...

What I'm thinking is that the son of my neighbours found the keys and thought it might have been his chance to be a bad boy, but didn't wanted to hit me so hard. The options are:
- if you know me you know what to steal in my house, and it's not a PS3 I'm talking about
- if you don't know me and simply want to make some cash, you make sure to steal every single piece of electronic before touching the souvenirs
- if you're a stupid kid who casually happens to have the keys you try to break in, and once you made it you simply go for the things you like best and could use in your own bedroom, right?
- if you're a so-called-friend and just want to do me something bad, you fake a robbery stealing only cheap stuff that I particularly cared for (I had a 1tb HD connected to the console, and they're both gone. needless to say the HD contained pretty much all of my past 5 years of music work and that is, after all, the only thing I really want back)

Massive thanks to both of you guys for the help here!

COLGeek · Feb 12, 2014

Have you discussed any of this with your landlord? I would advise you to not accuse or confront anyone, just to be on the safe side.

BTW, where are you located (geographically)? You can answer via PM if you don't want to post.

davidhammers · Feb 15, 2014

Things just keep getting weirder and worse.

Two days ago, as soon as I saw new failed attempts live on the Log, I unplugged the router and moved it closer to the neighbour's apartment, also restoring the WiFi password to the one stored on the PS3. Needless to say the console connected. Note that the router was plugged to the power ONLY, no internet connection whatsoever.
Now for as much thrilled as I was to finally see it connected, I decided to wait and go report the fact to the cops the morning after, and so did I.
They told me to wait until the PS3 was connected again and then call them, so they could have had the excuse to look into the neighbours house. No luck yet, the console still haven't tried.

Anyway, the thing is that yesterday morning, about 12 hours after the console estabilished the connection, and I plugged the Router back into my apartment with the new WiFi password, something happened. I noticed a Telnet connection in the Log, nothing substantially happened right away and everything worked great until 7PM, when I went back on the router's log to check out for news, and there was a ipVoiceWAN (or such) service restart. No big deal, I seen it many times and never thought of it as harmful, but don't ask me why I just thought of restarting the router.
Once the device booted and the light stopped flashing red I tried to connect, but SUPRISE! None of my devices was able to get connected on WiFi, so I took a dusty ethernet cable and plugged my laptop to the router. It turned out to be double suprise! At my first visit to the router login page I typed user and pwd, but after clicking OK the page returned blank, like a refresh. Tried again and the password was wrong :/

So went through an Hard Reset of the router, which now has this event amongst the others in the Boot Log:
[ANTI_SPOOFD] (err) llist_getobject_at for ENV.ANTI_SPOOFD's value failed

After seeing this I unplugged the phone cable right away and tried to access an internet page. The address bar went bananas and displayed something like this (sorry I haven't copied it) instead of simply trying to load and then displaying the 'No Internet Connection' message.

http://192.168.1.254/someshithere;&otherstuff;&origIP=192.168.1.67&event=DNSpoofd=198.18.1.10&otherstuffhere&evenmore

What's this damn 198.18.1.10 and where does it come from???
Is it me getting way too paranoic, or something worse than losing all my files is really happening?
Could it be that, in the short while I kept my network opened for the PS3, the thief connected instead another device spoofing with the console MAC address to gain access to the router and edit the settings? I mean, is this whole thing really all connected (from apartment robbery to MITM attack) or it's just the worst week of my life and it's two different xxx I'm talking about?
Or, hopefully, am I just freaking out a little bit to see problems where they do not exist? And this whole thing is just me messing up with the router because constantly opening and editing the config, unplugging frequently from the power, and stuff like that?

Again thanks a lot everyone! When (if) I'll get back my stuff you definitely will be the most thanked for!

Stolen PS3 trying to connect to Router??

Honorable

Titan

Honorable

Titan

Honorable

Cybernaut

Honorable

Cybernaut

Honorable

Cybernaut

Titan

Honorable

Cybernaut

Honorable

Honorable

Cybernaut

Honorable

Cybernaut

Titan

Honorable

Titan

Cybernaut

Honorable

Cybernaut

Honorable

Share this page