Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A detailed look at the router provided by my ISP

0x90.psaux.io

Post reply on HN
Print view View original

131–140 of 184 posts

Re: A detailed look at the router provided by my ISP

#131

Post by Tourus »

0xff00ffee wrote: post #126
jason0597 wrote: post #27

It's funny to think that if you were to report all of your findings to your local newspaper (Turkish newspaper in this case), as to how Turkish ISPs have complete access to your router or how Huawei (China) has an SSH key for your router, people would go absolutely ballistic. But for us it's just another day of expected craziness and we're tired of talking about it

I'm pretty sure my new CenturyLInk fiber router is similar. I tried to create a PPoE connection from my WRT1900 direclty to century link using the same credentials and I couldn't connect to my internet. However, now I am motivated to create a bridge and find out why. For CenturyLink fiber I have two boxes: Box A: the exterior fiber enters this box, the tech said it was a "translator"; and the port 4 ethernet on it go…

> PPoE with my credentials which were somehow hardwired because no one ever told me my username/password

They make it very hard to use your own "Box B", but I've set this up twice now (most recently last week). Get the username and password from CenturyLink (the tech that installs the service has this, or call them). Then, google search "century link vlan 201 wan tag". The trick is you need a router that has this functionality, most basic consumer ones don't.

Unfortunately, even if you follow all directions and it still doesn't work troubleshooting is a nightmare, very little or no help from their customer support.

Re: A detailed look at the router provided by my ISP

#132

Post by AdmiralAsshat »

manifoldgeo wrote: post #127
AdmiralAsshat wrote: post #81

I never thought to nmap my own router until reading this. PORT STATE SERVICE 53/tcp open domain 80/tcp open http 631/tcp open ipp 5000/tcp open upnp 7777/tcp open cbt 20005/tcp open btx Now begins the three-hours-and-counting rabbit hole of trying to figure out what the hell is running on ports 7777 and 20005. Or why UPNP is apparently running, despite UPNP being explicitly disabled on the Netgear router's admin page…

Maybe it's a remote administration port for your ISP. I have a router provided by Froniter, formerly Verizon FiOS, where port 4567 is always open and cannot be closed with a firewall rule from the router's web UI (grayed out). After some googling I found out that it's their maintenance port: https://www.speedguide.net/port.php?port=4567 For a while I had my own OpenWRT router in place of the ISP one, but I think they…

I bought both my modem and my router, so I'd be a little incredulous if my ISP had somehow forced a port open on it.

The 20005 one may be some port that NetGear uses for its USB Printing, I've found some articles that mention it.

It also struck me that I hit it with nmap using the LAN IP, so perhaps these are only open within the network. I probably need to hit the external IP of the router to see what is externally open. ShieldsUP! didn't show anything unusual.[1]

EDIT: Disclosure of a vulnerability regarding port 20005[2], and Netgear confirming that it does affect my router[3], but should have been fixed. I assume the "fix" was fixing the buffer overflow vulnerability, rather than closing the port altogether.

[1] https://www.grc.com/x/ne.dll?bh0bkyd2

[2] https://www.kb.cert.org/vuls/id/177092/

[3] https://kb.netgear.com/28393/NETGEAR-Product-Vulnerability-A...

Re: A detailed look at the router provided by my ISP

#133

Post by JackRabbitSlim »

0xff00ffee wrote: post #126
jason0597 wrote: post #27

It's funny to think that if you were to report all of your findings to your local newspaper (Turkish newspaper in this case), as to how Turkish ISPs have complete access to your router or how Huawei (China) has an SSH key for your router, people would go absolutely ballistic. But for us it's just another day of expected craziness and we're tired of talking about it

I'm pretty sure my new CenturyLInk fiber router is similar. I tried to create a PPoE connection from my WRT1900 direclty to century link using the same credentials and I couldn't connect to my internet. However, now I am motivated to create a bridge and find out why. For CenturyLink fiber I have two boxes: Box A: the exterior fiber enters this box, the tech said it was a "translator"; and the port 4 ethernet on it go…

I had CL fiber. VLAN tagging; The vlan tagging value was so high, OpenWRT didn't support it so I was left with the useless middle box. Your mileage may very.

Re: A detailed look at the router provided by my ISP

#134

Post by pdonis »

kitteh wrote: post #125
pdonis wrote: post #72

Earlier quoted context omitted.

Exactly. I have my own router (and cable modem, for that matter), and I don't call Comcast when one of them breaks; I fix it myself, since I own them.

Problem is you'll eventually reach a point where the problem is deep and requires them to escalate, and if you aren't checking the box of tested customer cpe they'll stop. Example of this is when I found a Comcast backbone link with an incorrect/inconsistent MTU setting. Had to go back channel in the end to someone on the ibone team, but I had no chance in hell of getting that fixed promptly via regular support.

> you'll eventually reach a point where the problem is deep and requires them to escalate, and if you aren't checking the box of tested customer cpe they'll stop

I've been a Comcast customer for more than 20 years (in two different states) and have never encountered a problem like this, so I expect such problems are extremely rare. Every issue I've had has been of the kind where Comcast's support person can see right away that there's a problem on their end because they can't even see my cable modem's status even though I confirm to them that it's powered up and the cable is connected (and of course I have to go through the dance of rebooting it multiple times before they'll be satisfied). Most of the time they put me on hold for a while and then come back and the problem is fixed (I assume because some tech in the background rebooted or reset something that was borked). Once they had to send a tech to my house and it turned out there was a bad connection in the junction box they had installed outside.

Re: A detailed look at the router provided by my ISP

#135

Post by simplyinfinity »

skizm wrote: post #128

My ISP has a cloud access "feature". If I go to 192.168.1.1 it redirects me to their "router.MYISP.net" site. What's the best way to go about disabling this? Should I just dump the rented router for my own?

asus (and others) have the same feature. In my case it's a simple redirect from the ip of 192.168.1.1 to router.myasus.com which has a dns record of 192.168.1.1. so all it does is do a redirect to a domain.

Re: A detailed look at the router provided by my ISP

#136

Post by jonpurdy »

strbean wrote: post #117
hedora wrote: post #51

Earlier quoted context omitted.

The US has (had?) some network neutrality rules around discriminating against different types of hardware, but AT&T just does it anyway. (They require you to use their DSL modem + router + wifi and it has broken support for adding a second router behind it.)

Dealing with the same thing with AT&T fiber. There was word of a hack involving putting your router behind a switch with the AT&T router after cloning the MAC, then booting them both up and letting your router pick up the DHCP responses along with the AT&T router. Once the AT&T router had done its proprietary handshake, you could disconnect the AT&T router. Unfortunately I had no luck with that - my loose theory is t…

I just moved to SF and got AT&T gigabit fiber in mid-February. I followed this guide and got it working at gigabit speeds (eventually): https://www.reddit.com/r/Ubiquiti/comments/cjw9jt/howto_bypa...

It's been working great since I set it up; highly recommended!

Hardware offloading needs to be enabled and QoS disabled for gigabit speeds (~900Mbps both ways, simultaneous ~500Mbps both ways).

If you send me an email (hn-202003@jonpurdy.com), I can send you my exact configs.

Re: A detailed look at the router provided by my ISP

#137

Post by praptak »

ProZsolt wrote: post #101
praptak wrote: post #28

Earlier quoted context omitted.

The right thing to do in such circumstances is to publish the vulnerability.

But how do you publish it without the liability of getting sued? A person like me who don't work in security still occasionally find some vulnerability. Sometimes you get angry emails from the company even if you just try to warn them.

Getting sued for what? Also, you can publish anonymously.

Sitting on exploits forever only helps attackers and gives false sense of security to dumb companies.

Re: A detailed look at the router provided by my ISP

#138

Post by stevespang »

If you are in Turkey, Egodan's boys are spying on EVERYONE,especially after the attempted coup. Huawei is happy to provide spying through the router to Ergodan's Boogiemen - - in fact, several of them are probably next room over from you watching your screen now . . .

Re: A detailed look at the router provided by my ISP

#139

Post by hestefisk »

My ISP (Internode) provide a ‘modem’ for my NBN hybrid coax / fibre connection. I just put my OPNSense router in front of it and it’s all secure. They provided me with all the config settings, which are a bit more obscure than usual (PPPoE but on a specific vlan tag). Works like a charm and I don’t have to worry about weird government wiretapping or backdoors. My ISP provide an IPv6 range too, which is pretty cool.

Re: A detailed look at the router provided by my ISP

#140

Post by Craighead »

sheep-a wrote: post #46
blakesterz wrote: post #3

Interesting read! There's actually 3 parts to this: Part 2: https://0x90.psaux.io/2020/03/19/Taking-Back-What-Is-Already... And 3: https://0x90.psaux.io/2020/03/22/Taking-Back-What-Is-Already... Summary from the end of Part 3: "So we managed to change passwords for both ssh and telnet, gain access to Root user for the web interface, changed that password too. We changed ACS URL to ours and remove the IP restrictions.…

You forgot this bit of the summary, which I think is more interesting! "Still there is an authorized ssh key left in the firmware but for now it’s enough that we’re keeping the ISP out. Maybe in the future, we can repack the firmware with our configuration and keys and install it on the router. For now, take care!"

Huawei implies Chinese intelligence services left that there
Post reply on HN