Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Recently i got a very strange behavior on our WIFI network: We share a WIFI network with a simple router. One of us pays the bills and he's the one, who got the management account from our ISP. So if i want to log in to watch my mobile bills (the ISP does both, mobile and wired internet stuff; i have my own account) i am logged in automatically with his internet management account, from different devices over the WIFI.

How can this be possible? I can not find useful information about that. As i know from a programmers point of view, simple session management should avoid such a behavior (eg. cookies). Does it mean, that the session management is only server sided and just bound to ip (server, programming issue)?

I think the ISP bound the external IP of our router automatically to this single management account, which would be, in my opinion, a very big issue (watching bills, changing address data and so on.).

share|improve this question

3 Answers 3

up vote 2 down vote accepted

After reading Lucas Kauffman's answer, I got in touch with a friend of mine that has worked in the ISP business since the early '90s. Here's what he had to say on the matter:

You'd be surprised how many systems work like that in ISPs, cos they trust all of their internal systems to be secure even if they ain't. A lot of the old control systems and accounting stuff used to be on IBM mainframes, way before PHP or ASP existed. The whole authenticate-by-MAC thing comes from the old days of analog modems over phone lines, where the telco would authenticate you by your phone number or MAC address. Back then it was so rare for users to have more than one computer on a line, cos computers were so expensive and nobody really made consumer switches or routers back then. Even when T3 and IDSN were around a lot of people still just had one box hooked up via a modem, so a MAC seemed like a good idea to save having to deal with doing proper sessions.

A lot of the guys that make the new systems are telco engineers from the old days, or at least the guys that write the specs are and they just get some green college kids to write the code. You tend to get a lot of bleed through from the way stuff was done in the past. It's a big problem and you always see the security consultants making faces when they see that real old-hat stuff.

So, yes it is stupid, but it's primarily due to ignorance of modern home computing and modern security requirements. These guys are the greybeards of the industry, so everyone defers to their judgement.

share|improve this answer
1  
This is...concerning. –  Lucas Kauffman Nov 7 '12 at 22:15
1  
Sadly the state of most countries' critical telecommunications infrastructure security is pretty terrible. I recently heard a story from a pentester who was tasked with breaking into a large mobile (cellphone) network in the UK, which he managed by picking the lock on a cell tower gate and plugging an ethernet cable into the cabinet's switch. It was on the internal network and implicitly trusted, and they had thousands of these sites nationwide. Apparently they have some mitigations in place now, but it's still scary. –  Polynomial Nov 7 '12 at 22:17

Yes, this is commonly done. However, the usual method is to only display diagnostic information by default - e.g. Quota usage and account number. That way anyone on the local network can do a quota check. For anything else (credit card change, plan change, address change) a login is still required.

share|improve this answer

Yes this can be possible. The website of the ISP automatically detects that you are connecting from a router of it's own network. It thinks that you are the owner of the router and automatically authenticates you as such (credentials are stored on the router).

I have seen this done before and it's just stupid design IMHO. Especially if this works from WiFi as well.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.