A detailed look at the router provided by my ISP • Hacker News Board

Re: A detailed look at the router provided by my ISP

#51

Post by hedora » Thu, Mar 26, 2020, 3:34 PM UTC

LeonM wrote: post #30

In the Netherlands we now have a law where ISPs must allow your own choice of network equipment. This means they must give you the required information on how to connect your own device with their network. I have a fiber connection, which I connected directly to a Ubiquity router through a suitable SFP module. My ISP supplied the information on the fiber type and which VLAN ID's to setup for internet, TV and telephon…

The US has (had?) some network neutrality rules around discriminating against different types of hardware, but AT&T just does it anyway. (They require you to use their DSL modem + router + wifi and it has broken support for adding a second router behind it.)

Re: A detailed look at the router provided by my ISP

#52

Post by Faaak » Thu, Mar 26, 2020, 3:36 PM UTC

Hello71 wrote: post #14

Faaak wrote: post #12

Earlier quoted context omitted.

Depends if they `execve` or run the command inside a shell. I'd bet for (1), but who knows.

redirections aren't parsed by exec....

Indeed, I read the command's template too fast. Well, in this case it's worrysome

Re: A detailed look at the router provided by my ISP

#53

Post by saber6 » Thu, Mar 26, 2020, 3:37 PM UTC

pdonis wrote: post #48

lima wrote: post #40

Earlier quoted context omitted.

Same in Germany! ISPs hate it because it it makes their lives a lot harder - in cable networks, they now have to deal with a zoo of endpoints on a shared medium vs. a small set of standardized devices. As a customer, I like it.

> ISPs hate it because it it makes their lives a lot harder - in cable networks, they now have to deal with a zoo of endpoints on a shared medium vs. a small set of standardized devices. In other words, ISPs hate it because it forces them to actually do their jobs and be ISPs. The Internet itself is "a zoo of endpoints on a shared medium", and ISP stands for Internet Service Provider.

To bolster your point: Honestly they don't need to do much - the infrastructure is already there as a matter of being able to turn people's service up/down/on/off.

There is always a provider-managed CPE device that functions as the service demarcation point. This is the point where your contracted service speed is enforced (shape + egress queue and ingress policing).

You can have literally whatever router (dumb, smart, next-gen, whatever) spewing bits at X rate. The CPE will essentially normalize (police) that bit rate to your contracted speed (upstream scenario).

Re: A detailed look at the router provided by my ISP

#54

Post by jscholes » Thu, Mar 26, 2020, 3:37 PM UTC

Enjoyed this write-up, but most of the exploration seemed to be facilitated by someone having already leaked the CLI root password online. Anyone have suggestions on how you might otherwise obtain that information?

Re: A detailed look at the router provided by my ISP

#55

Post by josephmosby » Thu, Mar 26, 2020, 3:43 PM UTC

pdonis wrote: post #48

lima wrote: post #40

Earlier quoted context omitted.

Same in Germany! ISPs hate it because it it makes their lives a lot harder - in cable networks, they now have to deal with a zoo of endpoints on a shared medium vs. a small set of standardized devices. As a customer, I like it.

> ISPs hate it because it it makes their lives a lot harder - in cable networks, they now have to deal with a zoo of endpoints on a shared medium vs. a small set of standardized devices. In other words, ISPs hate it because it forces them to actually do their jobs and be ISPs. The Internet itself is "a zoo of endpoints on a shared medium", and ISP stands for Internet Service Provider.

It's not the provision of Internet that's the problem, it's the customer service requests.

e.g., AT&T could provide perfect service to the home endpoint, but the customer bought some aftermarket router from their cousin, who had configured it for Verizon. Customer calls AT&T to holler. Tier 1 support doesn't know what that particular router config GUI even looks like, so it gets bumped to T2 or T3. Ultimately to find out that the customer's cousin had hardcoded DNS to some internal Verizon system that's not visible to AT&T.

Repeat x100K. ISPs job isn't just "provide the Internet," it's also "provide all the troubleshooting for every non-technical customer who just wants to watch Netflix but doesn't even know what a router is"

Re: A detailed look at the router provided by my ISP

#56

Post by msla » Thu, Mar 26, 2020, 3:45 PM UTC

LeonM wrote: post #30

In the Netherlands we now have a law where ISPs must allow your own choice of network equipment. This means they must give you the required information on how to connect your own device with their network. I have a fiber connection, which I connected directly to a Ubiquity router through a suitable SFP module. My ISP supplied the information on the fiber type and which VLAN ID's to setup for internet, TV and telephon…

I have Spectrum cable Internet. I use their modem, but I supply my own router, and they've never given me any trouble. In fact, they recently upgraded my modem (from a Scientific Atlanta 2203C to a Ubee E31U2V1) and they didn't send me a router. The Ubee E31U2V1, like the Scientific Atlanta 2203C before it, only has one Ethernet port, and their official guide to getting the new modem working involved rebooting an external router, so there's no possible way they have a problem with customer-owned routers.

Which works out great for me. I can use OpenWRT with no hassle.

More to the point, I see the cable stuff as "ISP land" in that it's directly interfacing with their internal hardware, and so has to dance to their tune very directly, whereas Ethernet and TCP/IP are common, and so will obey my rules in my home. I don't expect my modem to perform adblocking, which is why my router does it, and I'm not going to be stupid and try to "uncap" my modem to get more speed, so I don't see a point to being able to provide my own cable modem. As long as I can own the router which provides the only path in and out of my LAN, I can do everything I'm capable of doing anyway, as far as I can see.

Re: A detailed look at the router provided by my ISP

#57

Post by CJefferson » Thu, Mar 26, 2020, 3:46 PM UTC

blacksmith_tb wrote: post #49

davedx wrote: post #35

Fantastic write up from a hacking point of view. I did wonder about this statement though: "This is very invasive and unacceptable. It may seem necessary to apply security patches published by your ISP but the user should be able to disable it whenever she wants." Legally, at least in countries where I've lived, the ISP still owns the router. This surprised me a bit when I first found out, but then I got used to the…

True, but I think it's worth comparing it to other utilities in your home - what if your electric company could make all your lightbulbs 20% dimmer without notice? Or if your water heater was remotely administered? ISPs, like mobile telcos, like to claim they must have control over your hardware "for security" but I think the most charitable interpretation is that it's to make their customer service dept. sweat less…

The difference is that non-updated routers can cause global problems. At the very least as an ISP I'd want to say you can look after updates yourself, but we will disable your access to the internet (other than to get the update from us) whenever we try to push an update to you and you reject it.

Re: A detailed look at the router provided by my ISP

#58

Post by p1esk » Thu, Mar 26, 2020, 3:51 PM UTC

jason0597 wrote: post #27

It's funny to think that if you were to report all of your findings to your local newspaper (Turkish newspaper in this case), as to how Turkish ISPs have complete access to your router or how Huawei (China) has an SSH key for your router, people would go absolutely ballistic. But for us it's just another day of expected craziness and we're tired of talking about it

Yeah, no one cares outside of hackernews.

Re: A detailed look at the router provided by my ISP

#59

Post by thinkloop » Thu, Mar 26, 2020, 3:56 PM UTC

LeonM wrote: post #30

In the Netherlands we now have a law where ISPs must allow your own choice of network equipment. This means they must give you the required information on how to connect your own device with their network. I have a fiber connection, which I connected directly to a Ubiquity router through a suitable SFP module. My ISP supplied the information on the fiber type and which VLAN ID's to setup for internet, TV and telephon…

How can you do without the modem? Which ubiquity product is that?

Re: A detailed look at the router provided by my ISP

#60

Post by zamadatix » Thu, Mar 26, 2020, 3:58 PM UTC

fulafel wrote: post #4

Trivia: Strictly speaking a box that does NAT is not a router in the IP protocol sense, it's a kind of proxy. The router requirements RFC explicitly forbids altering most fields (incl the address field) in the IP header.

The NAT RFCs came after the routing RFC and refer to NAT as a router function not as an orthogonal function, boxes that do NAT are referred to as routers in the RFC. This is reflected in the real world where NAT is implemented as part of the routing chain not as a separate module. Remember NAT isn't a box creating 2 sockets and ferrying data between them it is just the translation of fields on top of normal routing functionality.