Unknown, extraorbitant data usage

[power_8383]

Hello guys,

I'm using BSNL 500GB CUL plan. (Rs. 777)
Couple of days ago, I saw a popup on BSNL portal, saying I have exhausted my allotted high speed GBs i.e. 500gb data.
As soon as I saw that popup, I was in utter shock, because I was out of town for some days, so no one could have used this much of a data.
And secondly, even if I was at home, even then I couldn't have exahausted 500gbs myself.
So, to check what has happened, I headed over to selfcare portal and downloaded the session usage details.

Please see the attached photo.
I have sorted the data usage from high to low.

If you see the first entry, it says I used total of 120gb data on 22nd December. (Download 430mb & Upload 120gb)
The funny part is, I was not at home for the whole day.
And I don't even have 120gb of data to 'upload' to any cloud service. (If you see closely, you can see that my upload usage is far more than the download usage. I never torrent anything.)
So my main question is, WTF IS HAPPENING???

And no, I don't think anyone has hacked my wifi password, as I keep checking the connected devices intermittently.

Should I change my BSNL Fiber account password? (not wifi password)
Is my LCO being mischievous here?
Please help!

 

[shashankb]

Most probably your Wifi password was only compromised and torrents were run . Just an assumption . Use Fing/Network analyzer to identify and block unknown devices .

I dont think LCO would do that

Which Wifi router do you have ?

 

[Adithya]

Yep probably someone seeding on your wifi. Share more info
Which modem/router? Did you leave it on while you were out? Is WPS on on the router? Who knows the passwords to your home network .

While we figure this out,you can try enabling whitelisting on your modem to stop foreign devices.

Also 599 is a better plan in every way. 60mbps @ 3.3TB. I'm a former 777 customer.

 

[vishalrao]

It could also be malware/botnet infected on your ONT or router, so you can try factory reset and reconfigure the connection details to see if that makes any difference.

 

[shashankb]

I have a doubt . If we have a decent Firewall like PFSense , Fortinet or Ubiquiti the malware bot ONT(Bridge mode) is still going to make the requests/attacks right ?

 

[vishalrao]

I guess so yes. Firewall mostly configured to block incoming requests so an infected ont can still send outgoing traffic to upload data for a ddos attack on some target.

 

[power_8383]

Thank you for your replies guys.

My main router is Optilink OP XONT 71110N which is provided by the BSNL/LCO.
And I'm using Tp-Link Archer A6 in an access point mode.

 

[varkey]

@vishalrao If the ONT is in bridge mode, it wouldn't really have a path to the internet right? Unless you add a route on the ONT to go via your main firewall/router and allow your firewall/router to allow forwarding from ONT/CPE zone to the internet.

 

[Sudarshan61]

Most probably your Wifi password was only compromised and torrents were run . Just an assumption . Use Fing/Network analyzer to identify and block unknown devices .

I dont think LCO would do that

Which Wifi router do you have ?

Faced same issue few month back when I noticed unusually high usage per day. It was fixed after changing my BB password (I assume LCO mischief here ). Before doing so I tried looking all the devices on my wifi router and data usage via router which was very less as compared to what BSNL was reporting

 

[vishalrao]

@vishalrao If the ONT is in bridge mode, it wouldn't really have a path to the internet right? Unless you add a route on the ONT to go via your main firewall/router and allow your firewall/router to allow forwarding from ONT/CPE zone to the internet.

Yep you're right. I wrote ont or router in my previous to previous post. But it's probably not likely though possible.