A detailed look at the router provided by my ISP • Hacker News Board

Re: A detailed look at the router provided by my ISP

#31

Post by PascLeRasc » Thu, Mar 26, 2020, 2:55 PM UTC

Slightly off-topic: I'd really like to run screenfetch on my router (Asus RT-N66U), but it doesn't have enough free space to sftp the script to it [1]. Piping the script just freezes up. Does anyone know a good workaround? Has anyone ever tried this?

[1] https://unix.stackexchange.com/questions/510947/how-can-i-ru...

Re: A detailed look at the router provided by my ISP

#32

Post by sph » Thu, Mar 26, 2020, 2:59 PM UTC

Very interesting article.

What about that precompiled .ssh/authorized_keys with user z00163152@HUAWEI-627FB9A3 mentioned in Part 3?

Any reason why a router firmware would permit root access to anyone at all? Definitely sounds like a backdoor to me.

Re: A detailed look at the router provided by my ISP

#33

Post by markus92 » Thu, Mar 26, 2020, 3:02 PM UTC

LeonM wrote: post #30

In the Netherlands we now have a law where ISPs must allow your own choice of network equipment. This means they must give you the required information on how to connect your own device with their network. I have a fiber connection, which I connected directly to a Ubiquity router through a suitable SFP module. My ISP supplied the information on the fiber type and which VLAN ID's to setup for internet, TV and telephon…

It's been more common for DSL too, but I haven't heard of anyone using their own DOCSIS modem for Ziggo though. Have you?

Re: A detailed look at the router provided by my ISP

#34

Post by skoskie » Thu, Mar 26, 2020, 3:05 PM UTC

zeroflow wrote: post #5

...and that's why my ISPs router is running in modem mode with a non-ISP-controlled router from Ubiquiti behind it - which I may replace with a pfSense box in the future. I'm pretty happy that my cable ISP is allowing this mode so I don't have to double-NAT in my setup.

I have been so disappointed with my ubiquiti hardware. That UI is gorgeous, but lacks some real functionality that I need. I can’t block BitTorrent (see forums). And I can’t see a detailed traffic log; only the categories. Plus, those pretty graphs that tell you how much data you’ve used doesn’t give a time frame. I have no idea if it’s a week or a month.

I think pfSense will be my next too.

Re: A detailed look at the router provided by my ISP

#35

Post by davedx » Thu, Mar 26, 2020, 3:09 PM UTC

Fantastic write up from a hacking point of view. I did wonder about this statement though:

"This is very invasive and unacceptable. It may seem necessary to apply security patches published by your ISP but the user should be able to disable it whenever she wants."

Legally, at least in countries where I've lived, the ISP still owns the router. This surprised me a bit when I first found out, but then I got used to the idea, but you should treat any ISP or telecom gear in your house as something that's "rented but still owned and controlled by someone else".

Re: A detailed look at the router provided by my ISP

#36

Post by icedchai » Thu, Mar 26, 2020, 3:13 PM UTC

fulafel wrote: post #26

icedchai wrote: post #16

Earlier quoted context omitted.

...an RFC that was written in 1995, before NAT was really necessary. My view: If it forwards IP between different networks, it's a router.

Nat existed in somewhat wide use in 95, PIX had come out recently. It's not necessary today either.

It existed, but was definitely not in wide use. I worked for several early internet providers during that period (mid to late 90's.) Most folks had public addresses on their desktops. No customer we ever set up wanted NAT. Most didn't even have firewalls, sadly! Some of these were small companies, some of these were large corporations or universities.

And I'd argue NAT actually is necessary if you want IPv4 for home use. We'd be out of addresses otherwise.

Re: A detailed look at the router provided by my ISP

#37

Post by skoskie » Thu, Mar 26, 2020, 3:13 PM UTC

sph wrote: post #32

Very interesting article. What about that precompiled .ssh/authorized_keys with user z00163152@HUAWEI-627FB9A3 mentioned in Part 3? Any reason why a router firmware would permit root access to anyone at all? Definitely sounds like a backdoor to me.

That was the worst part. I would have that bombshell as the lede. And then delete it if possible.

Re: A detailed look at the router provided by my ISP

#38

Post by chrisweekly » Thu, Mar 26, 2020, 3:17 PM UTC

zeroflow wrote: post #5

...and that's why my ISPs router is running in modem mode with a non-ISP-controlled router from Ubiquiti behind it - which I may replace with a pfSense box in the future. I'm pretty happy that my cable ISP is allowing this mode so I don't have to double-NAT in my setup.

I'd be grateful for guidance eg a link to a writeup of recommended hardware and config for a reasonably technical audience, eg "Given a Verizon FIOS G1100, put it in bridge mode and connect hw that supports software X"...

Re: A detailed look at the router provided by my ISP

#39

Post by fulafel » Thu, Mar 26, 2020, 3:21 PM UTC

packet_nerd wrote: post #9

fulafel wrote: post #4

Trivia: Strictly speaking a box that does NAT is not a router in the IP protocol sense, it's a kind of proxy. The router requirements RFC explicitly forbids altering most fields (incl the address field) in the IP header.

The box in people's home's colloquially known as a router actually commonly combines a lot of functions into one: * router * firewall * NAT device * modem * switch * access point * DNS resolver * DHCP server And probably others I'm not thinking of :-)

Adding more functions to a router doesn't make it a non-router. But if it's doing NAT and not routing, then it's a different distinction. But yep it depends on the configuration.

Re: A detailed look at the router provided by my ISP

#40

Post by lima » Thu, Mar 26, 2020, 3:22 PM UTC

LeonM wrote: post #30

In the Netherlands we now have a law where ISPs must allow your own choice of network equipment. This means they must give you the required information on how to connect your own device with their network. I have a fiber connection, which I connected directly to a Ubiquity router through a suitable SFP module. My ISP supplied the information on the fiber type and which VLAN ID's to setup for internet, TV and telephon…

Same in Germany! ISPs hate it because it it makes their lives a lot harder - in cable networks, they now have to deal with a zoo of endpoints on a shared medium vs. a small set of standardized devices.

As a customer, I like it.