Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A detailed look at the router provided by my ISP

0x90.psaux.io

Post reply on HN
Print view View original

101–110 of 184 posts

Re: A detailed look at the router provided by my ISP

#101

Post by ProZsolt »

praptak wrote: post #28
non-entity wrote: post #2

A while back, I was playing around with the cable modem / router the ISP gave me because I was curious and an idiot. After screwing around a bit, I managed to find a vulnerability that exposed technician credentials plaintext and they actually worked. Had no idea where to report it though, because the manufacturers contact page could be summed up as fuck you we don't talk directly to consumers . I dont think the vuln…

The right thing to do in such circumstances is to publish the vulnerability.

But how do you publish it without the liability of getting sued? A person like me who don't work in security still occasionally find some vulnerability. Sometimes you get angry emails from the company even if you just try to warn them.

Re: A detailed look at the router provided by my ISP

#102

Post by ProZsolt »

blacksmith_tb wrote: post #49
davedx wrote: post #35

Fantastic write up from a hacking point of view. I did wonder about this statement though: "This is very invasive and unacceptable. It may seem necessary to apply security patches published by your ISP but the user should be able to disable it whenever she wants." Legally, at least in countries where I've lived, the ISP still owns the router. This surprised me a bit when I first found out, but then I got used to the…

True, but I think it's worth comparing it to other utilities in your home - what if your electric company could make all your lightbulbs 20% dimmer without notice? Or if your water heater was remotely administered? ISPs, like mobile telcos, like to claim they must have control over your hardware "for security" but I think the most charitable interpretation is that it's to make their customer service dept. sweat less…

This is why I like separate modems, so there is a clear border between you and the ISP. Sadly currently most of the providers only give you AIOs.

Re: A detailed look at the router provided by my ISP

#103

Post by thallian »

jmiserez wrote: post #92
pdonis wrote: post #90

Earlier quoted context omitted.

> My ISP does Out of curiosity, which ISP do you have?

init7.net. They have a bunch of official guides, but also help with other devices and have debugged issues with new devices. Basically if your device is capable they want to make it work.

Init7 is great, I only had to tick a checkbox saying something like "I know what I am doing" and apart from providing the technical information they left me alone. Only had one problem with them that they resolved very quickly (the fiber cable got damaged somewhere in the basement).

Re: A detailed look at the router provided by my ISP

#104

Post by saagarjha »

ProZsolt wrote: post #101
praptak wrote: post #28

Earlier quoted context omitted.

The right thing to do in such circumstances is to publish the vulnerability.

But how do you publish it without the liability of getting sued? A person like me who don't work in security still occasionally find some vulnerability. Sometimes you get angry emails from the company even if you just try to warn them.

Publish the angry emails too.

Re: A detailed look at the router provided by my ISP

#105

Post by hazeii »

closeparen wrote: post #100
jason0597 wrote: post #27

It's funny to think that if you were to report all of your findings to your local newspaper (Turkish newspaper in this case), as to how Turkish ISPs have complete access to your router or how Huawei (China) has an SSH key for your router, people would go absolutely ballistic. But for us it's just another day of expected craziness and we're tired of talking about it

CPE is just part of the ISP's infrastructure that happens to be in your house. There is no need to trust it. Just put your own router in front of it.

Indeed, I've had a linux box between the router and the local network since the days of dial-up (originally it was the dial-up box, which made and shared the 'net connection). The only reason I've ever had to upgrade the hardware has been because the original setup only had 10MBps NICs.

Re: A detailed look at the router provided by my ISP

#106

Post by mercora »

anticensor wrote: post #97
Someone1234 wrote: post #68

Earlier quoted context omitted.

Turkey isn't in the EU.

IANAL, but Turkcell would lose the case in Turkey too. This is not due to net neutrality regulations (Turkey deliberately lacks it), but due to case law arisen from competition and customer rights regulations. However, telcos work around that too, by "leasing" modems, like telephone divisions did in the past. Does the trick of "leasing" work in the EU too?

in marketing they try hard to make it sound like what you are going to get by renting their device is WiFi not just the ability to turn on WiFi functionality of the CPE. of course everybody wants that but most people don't get that's not something that has to be provided by the ISP. I am not sure if its required, but i have seen often a lower end device (without WiFi accessible) is given for the lifetime of the contract free of charge.

in Germany you have the right to use a compatible device you own yourself. However my ISP Vodafone does not accept lots of modems as compatible and when this regulation started there were basically none you could actually buy. Its not much better now i guess but i distress.

EDIT: reading your comment again the trick you mentioned probably works because its "yours" when you lease it instead of renting it?

Re: A detailed look at the router provided by my ISP

#107

Post by em-bee »

zeroflow wrote: post #25
awelkie wrote: post #19

Earlier quoted context omitted.

If your ISP didn't have that feature, could you just replace the cable modem too? My ISP's router is running EuroDOCSIS 3.0 and I'm wondering if I could replace the router with a modem + router of my own.

Sadly I could not, since the ISP is defining the router as the endpoint of it's network so there is no freedom to choose different models.

practically though what is the difference between having the endpoint in a shaft by the elevator or in your apartment or even down the street? in all scenarios i'd put my own router behind the ISP equipment and run my local network however i want.

the only issue is with getting a public ip address for inbound connections.

here we are not getting public ip addresses anyways, so the point is moot for me. but if you do get one, then all they need to do is configure their router to forward the public ip to yours.

in my case the ISP even installed two routers. one was theirs that i had no access to and one was "ours" that i was able to configure as i liked or replace with my own. both routers had their own wifi, but i don't use the one from the ISP endpoint router

Re: A detailed look at the router provided by my ISP

#108

Post by marcosdumay »

mafuy wrote: post #89

Many people here pointed out a problem: Removing access for the ISP and/or device manufacturer means they cannot fix bugs remotely and automatically. This is bad in situations like when the Mirai malware hit. How about this?: "You can use your own device and we provide all required information, but there will be no advanced support and you have to check for bugfixes yourself monthly." ... now that I wrote it, I see t…

Ok, from the Wikipedia:

> Mirai then identifies vulnerable IoT devices using a table of more than 60 common factory default usernames and passwords

Taking control of the device is exactly the kind of thing that stops that attack.

Re: A detailed look at the router provided by my ISP

#109

Post by hugofloss »

thinkloop wrote: post #59
LeonM wrote: post #30

In the Netherlands we now have a law where ISPs must allow your own choice of network equipment. This means they must give you the required information on how to connect your own device with their network. I have a fiber connection, which I connected directly to a Ubiquity router through a suitable SFP module. My ISP supplied the information on the fiber type and which VLAN ID's to setup for internet, TV and telephon…

How can you do without the modem? Which ubiquity product is that?

I used the Unifi Security Gateway to replace my ISP's modem.

Re: A detailed look at the router provided by my ISP

#110

Post by lxe »

> After looking into folders, I found some interesting files. I won’t go through them here but I want to mention just one of them: [$ cat etc/ssh/authorized_keys]. Maybe an engineer from Huawei (I assume z00163152@HUAWEI-627FB9A3) who owns a specific DSS key, can connect all HG253s routers without needing a password, who knows?

Who knows indeed?!

Post reply on HN