Getting automatically logged in to others session via WIFI

Question

Recently i got a very strange behavior on our WIFI network: We share a WIFI network with a simple router. One of us pays the bills and he's the one, who got the management account from our ISP. So if i want to log in to watch my mobile bills (the ISP does both, mobile and wired internet stuff; i have my own account) i am logged in automatically with his internet management account, from different devices over the WIFI.

How can this be possible? I can not find useful information about that. As i know from a programmers point of view, simple session management should avoid such a behavior (eg. cookies). Does it mean, that the session management is only server sided and just bound to ip (server, programming issue)?

I think the ISP bound the external IP of our router automatically to this single management account, which would be, in my opinion, a very big issue (watching bills, changing address data and so on.).

Answer 1

After reading Lucas Kauffman's answer, I got in touch with a friend of mine that has worked in the ISP business since the early '90s. Here's what he had to say on the matter:

You'd be surprised how many systems work like that in ISPs, cos they trust all of their internal systems to be secure even if they ain't. A lot of the old control systems and accounting stuff used to be on IBM mainframes, way before PHP or ASP existed. The whole authenticate-by-MAC thing comes from the old days of analog modems over phone lines, where the telco would authenticate you by your phone number or MAC address. Back then it was so rare for users to have more than one computer on a line, cos computers were so expensive and nobody really made consumer switches or routers back then. Even when T3 and IDSN were around a lot of people still just had one box hooked up via a modem, so a MAC seemed like a good idea to save having to deal with doing proper sessions.

A lot of the guys that make the new systems are telco engineers from the old days, or at least the guys that write the specs are and they just get some green college kids to write the code. You tend to get a lot of bleed through from the way stuff was done in the past. It's a big problem and you always see the security consultants making faces when they see that real old-hat stuff.

So, yes it is stupid, but it's primarily due to ignorance of modern home computing and modern security requirements. These guys are the greybeards of the industry, so everyone defers to their judgement.

Answer 2

Yes this can be possible. The website of the ISP automatically detects that you are connecting from a router of it's own network. It thinks that you are the owner of the router and automatically authenticates you as such (credentials are stored on the router).

I have seen this done before and it's just stupid design IMHO. Especially if this works from WiFi as well.

Answer 3

Yes, this is commonly done. However, the usual method is to only display diagnostic information by default - e.g. Quota usage and account number. That way anyone on the local network can do a quota check. For anything else (credit card change, plan change, address change) a login is still required.