VPN users unmasked by zero-day vulnerability in Virgin Media routers

Users of ISP modem routers should put them in modem mode and use their own equipment for reliability and security - where possible.

VM ones can be put in modem mode.

In the UK, Virgin Media (The biggest cable provider, I think there maybe a couple of minor regional cable providers still dotted around the country) are the largest cable provider after buying up the smaller regional companies (My regional provider was brought up by Telewest).

Long story short, their was tons of regional providers, they were brought up by one of two players which basically devided the country into being served by either NTL or Telewest, NTL and Telewest then merged becoming NTL:Telewest, who then brought Virgin Mobile (an MVNO in the UK) to become a 4 way provider (TV, Phone, Internet and now Mobile). Virgin Media are now owned by a US conpany, Liberty Global iirc)

Neither NTL nor Telewest allow consumer owned equipment onto their cable internet network, heck I remember Telewest only authing one consumer device mac address to be connected to their modems at the start of their cable internet rollout (so if you wanted to use your own router conencted to the modem, you would either have to give Telewest the mac address of the router or set the mac address of the WAN port to the mac address of the computer that was initially conencted to their network (which was the quickest option, you could never get them to swap it instantly over the phone, but could doing business hours over telewests newsgroups as their engineers would hang out their, which used to be the quickest way to get your line serviced if their was ever an issue), a practice telewest did drop before they merged with NTL. NTL never had such a policy iirc, but I only lived in an NTL area for a couple of years).

Their modem secuirty has never been "great". For the longest time (since creation till only a few years ago) you were able to get free internet if you cloned the mac address of someone elses modem but used it in a differnt area, mac addresses that could be captured by any modem (provisioned or not) connected to the network. So there used to be mac swapping forums where X would scan and log their area can trade with Y who would to the same in theirs (used to be handy when they had "fair usage" trottling enabled, used your download limit for the day, swap your mac and get a new limit, or if you wanted to run a 2nd/3rd/4th modem, but that would be naughty... So I never did such a thing. IIRC: Modem cloning is still possible today, but you need to get the certs from a provisioned modem, so its not as simple as just sniffing mac address from the cable line as other modems register on the network).

Here in the UK, we have always been limited to the modem the cable company provided, which remained their property (both were often uncollected by the company when a customer left, so you could easily find old modems on ebay for pennies on the pound, which just happened to have thier unsigned firmware (and mac addresses) on SPI flash if you wished to tinker with them), which for 99% of the UK was fine, as it was common (and still is) to just used what ever device was issued to you. Atleast with ADSL/VDSL in the UK you are free to use what ever device you wanted (except for Sky, they used to be PITAs about getting the auth details to run your own modem, but once you did and aslong as your modem supported their auth (which isn't the auth used by most of the xDSL providers in the UK) you were free to use your own equipment, just "unsupported" so if you had issues on your line, it was best to connect their modem to the line before calling customer services.

Was going to say, I've only ever used Arris modems and really haven't had any issues with the Surfboard line in ~15 years of using them. They used to be part of Motorola, not sure when that switch happened, but I've used them in some form or another since getting cable internet back in the late 90s or early 2000s. Time flies.

Recently I tried to find a VPN providers who fully supported IPv6. There were only few options and they were much on the expensive side. Of the remaining IPv4 VPNs only few warned you in their docs about switching off IPv6, even fewer switched it off while running, and one I'm aware of switched it off forever in a sneaky way on Windows that involved continuously overwriting registry keys, which on the one hand was laudably paranoid but on the other hand caused endless hours of troubleshooting for me. In a nutshell, if your computer has a IPv6 address as it should have, the software from most commercial VPN providers will leak your IPv6 IP all the time to all websites and make you easy to identify.

I suppose this is well-known to savvy users and sysadmins, but still thought it worth mentioning in the context if this more general router vulnerability. Some of the cheaper VPN services out there are very insecure anyway.

With Optimum (nee Cablevision) they pretend to be BYO accessible, but their compatibility list isn't a guarantee of compatibility (depending on region, different devices are compatible but they would never tell you that on their website), you have to wait on hold for 3 hours to activate the device, and then it still might fail for reasons their support agents can never explain.