21–30 of 97 posts
For context. This is Virgin Media which demands your passwords (including e-mail passwords) must be no longer than 10 characters, must begin with a letter, not a number and cannot include any special characters. Security is not their priority.
If you’re in modem only mode, block HTTP traffic to 192.168.100.1 outbound from your firewall just to be sure.
Seems relatively low impact, but still pretty bad. Not surprising from VM given the quality of their firmware.
If it allows some local addresses/hosts to be accessed, some information is always bound to leak I'd argue.
Earlier quoted context omitted.
I think generally you don't get a choice when it comes to DOCSIS equipment. You can't just connect up your own (or at least no to Virgin Media's network)
You can take those routers and use it as a modem only. Then put your own router in front of it.
> I'm guessing a workaround is to use a 3rd party router and block traffic to 192.168.100.1 which is the IP of the management UI when in modem only mode, presumably the external IP can still be retrieved in modem only mode
> If it's still active in modem-only mode, it essentially precludes use of these routers entirely for any sensitive comms.
> The web interface is still available in bridge mode with Liberty Global's Arris modems, yes.
> Just tried it on my device in modem-mode and it does indeed still expose the snmpGet endpoint. As suggested above, i've firewalled all traffic to 192.168.100.1 on my own firewall.
[1] https://www.reddit.com/r/netsec/comments/pnzs0n/silently_unm...
This appears to use API endpoints that are available if the modem is in ISP mode and acting as the Wi-Fi, etc. Does this also affect the router when used in modem mode?
> Just tried it on my device in modem-mode and it does indeed still expose the snmpGet endpoint. As suggested above, i've firewalled all traffic to 192.168.100.1 on my own firewall.
[1] https://www.reddit.com/r/netsec/comments/pnzs0n/silently_unm...
IMO the safest way to access a VPN is from a VM which is restricted to that VPN. Like whonix, but using a VPN instead of Tor.
In theory, deep integration into the OS (like Tails does for Tor) could work, but is much easier to get wrong, especially if you want direct network access for other applications.
(Only talking about VPNs used for hiding your IP. Tunneling into a company network via VPN is a very different use-case)
Nobody should use ISP provided equipment for anything security sensitive, ever. ISPs don't care about security at all, aside from "security" as a sales term, and aside from when they're getting a bad name because of egregious failures. ARRIS shouldn't be given a year embargo, either. They're the same company who've known since 2016 about hardware issues which cannot be corrected in software in the Intel PUMA chipsets…
Yeah, avoid ARRIS whenever you can. Their modems make cable internet a dreadful experience, which it shouldn't have been. Here's the list with modems affected by the hardware bug you mentioned: https://www.badmodems.com/
[1]https://approvedmodemlist.com/intel-puma-6-modem-list-chipse...
Earlier quoted context omitted.
It's still not really modem-only mode. They do routing in there, mainly for their management layer.
I must admit, I don’t know much about networking. But do you have some more information there? My German cable router is in modem-mode, and I’d be interested in knowing what kind of routing it still does.
Also, in many cases there is a specific that the "modem" listens on, serving a web interface that allows switching back to "router" mode. This also wouldn't be possible with a "pure" modem (as it shouldn't have any concept of the IP layer).
I would consider the router untrusted when using a VPN, so blaming it for the attack seems misplaced. I'd go even one step further, and say that unprivileged applications using the VPN should have no way of discovering your real IP. Applications not using the VPN shouldn't be able to discover the VPN IP, at minimum not use/leak it by accident (e.g. via webrtc). IMO the safest way to access a VPN is from a VM which is…
Nobody should use ISP provided equipment for anything security sensitive, ever. ISPs don't care about security at all, aside from "security" as a sales term, and aside from when they're getting a bad name because of egregious failures. ARRIS shouldn't be given a year embargo, either. They're the same company who've known since 2016 about hardware issues which cannot be corrected in software in the Intel PUMA chipsets…
Correct, but in this case, it sounds like you didn't need to use the ISP router as your VPN gateway. If I understand the DNS rebinding attack reference correctly, you could be running the VPN software on your desktop/laptop and still have your IP revealed by your ISP router.
Mediocre home appliances or (as in this case) ISP CPEs can easily deanonymize you.