How to secure a modem/ wifi router without login?

Question

A friend of mine has a DSL-modem/wifi-router from his ISP. The configuration page of the modem requires no login and no login can be set. It is said that there also exists a superuser but this is only known to ISP-technicans and is not public. Anyone on the network or using attacks like DNS rebinding or viruses can read and write the user configuration of the modem without login.

Only official modems of the ISP are allowed by the ISP so he cannot exchange it. It is the only ISP in the area.

When asking the ISP about it, he said, that wifi encryption is enough and it is because users call the hotline all the time because they forgot the passwords. (By default the ISP also logins you with full access with your contract credentials on his homepage without requesting username/password but using the IP-address as authentification and ignores that users share their wifi-password with friends. We already changed this.)

Is this configuration really secure in practice like the ISP said or what steps can be done to make it secure?

Answer 1

There is actually two different issues in your question:

• ISP provided modem/router with no password,
• Customer's page on ISP's website use the source IP as sole authentication.

ISP provided modem/router with no password

You have two possibilities, depending whether you opt to keep the ISP box or replace it altogether.

Solution 1: isolate the ISP box

Consider the modem/router as untrusted, part of ISP's network and not your own, and assume this choice. This is the choice I recommend since it fully complies with any ISP End-User Licence Agreement (EULA) and ensure you can benefit from any of their service or service upgrades now and in the future.

Moreover, it provides a good abstraction layer so changing of ISP or technology (ADSL, cable, fiber) is as simple as replacing the ISP box and affecting it the right IP, with strictly no impact on your own network especially if you do not rely on ISP's DNS servers.

To achive this you may want to take the following actions:

• Disable ISP box's WiFi, and use a WiFi router of your own instead if you need WiFi capabilities,
• Put a device with firewall capabilities (it can be the WiFi router mentioned above, and old computer, etc.) between your wired network and the ISP box with such kind of policy:
  • By default all communication between ISP's box IP and your LAN is blocked in every direction (the ISP box has no reason to contact your LAN's computers, and your LAN's computers while they go through the ISP box to access the Internet have usually no reason to contact the box itself),
  • One exception to the rule above: a lot of ISP's provide a DNS server in their box, unless you are using an alternative DNS server like OpenDNS or Google Public DNS (or your own!) you may still want to allow your LAN computers to contact the ISP box on the domain (53 tcp/udp) port,
  • When needed and only when needed, you can open an access from one of your LAN's computer to the ISP box HTTP (80 tcp) port (for instance) to access the administration interface. Do not forget to disable this access once your are done.

This will basically isolate the ISP box and relegate it to the role of a simple modem. In case you need some more features from your ISP box (television for instance), you can enable the access from the appropriate LAN devices to the ISP box on selected ports (you should find information on which ports to enable on Internet forums). Just be sure to keep administration ports closed by default (these are usually HTTP-80, HTTPS-443 and telnet-23, don't forget this one!) because these are the dangerous ones.

Solution 2: replace the ISP box by an ADSL modem or a router in bridge mode

The good thing is that this solution will give you maximum control over your Internet connection:

• You will be able to handle yourself the QoS of your Internet connection, mitigating bandwidth consuming uploads impact over downloads,
• I've read that ISP use the VPI/VCI parameters to route flows to different networks in their infrastructure (Internet access, phone line VoIP, television video streaming, possibility maintenance stuff, etc.). From a black hat perspective, having the possibility to manually set the VPI/VCI parameters of your modem allows you to explore ISP's network parts not normally accessible (and probably less secured) if you were using the genuine ISP's box.

I say the latter not to encourage you to do illegal stuff, but to make you understand why some ISP impose the use of their own box to their users and forbid custom firmwares. The attitude of ISP regarding this point varies a lot:

• Some ISP's let the user fully free of their action and officially allow user provided material to be connected to their network. They just announce that they provide support only for their own box, for other devices they provide generic ADSL parameters to use and it's up to the end-user to configure everything by himself. This was common in the pre "triple play" era, but nowadays it is sadly (but obviously?) not the way followed by the major ISP's.
• Some ISP officially impose the use of their own boxes, but do not technically restrict anything. You can find the parameters to use for your modem on Internet forums, and it will work. Be conscious, though, that your modem will only provide you Internet access, all other services usually provided by your triple or quadruple play ISP box (phone, television) will not be available with your modem.

• Some ISP strongly impose the use of their own boxes:

  • First they filter incoming connection request's MAC address and reject the connection if the device MAC does not correspond to the MAC allocated to the subscriber (a common symptom of this is that the box from one subscriber is not be able to connect at another subscriber's home).
  • Then from time to time they scan currently connected devices to detect non complying devices (I suppose such scanning can be easily merged in a script checking if your box firmware is up-to-date, except that it will not fail silently if it cannot connect to your box).

  If you are detected as having maliciously bypassed the MAC check to connect a non compliant device to your ISP network, your ISP will consider this as a violation of the EULA and will be free to put an immediate term to your subscription (but you should not go in jail for this... unless it turns out that they also discover that you were wandering in their internal VoIP infrastructure following the black hat point above, if so be ready for some trouble...).

Customer's page on ISP's website use the source IP as sole authentication

Funnily enough, the security of home Internet access was one of my assignments in my last years study, and I saw with my own eyes such an awful practice.

Once someone gets access to your WiFi (if it is a stranger having no access to your home, but someone inside your home can do this from your LAN too), he gains access to the detailed phone bill showing every number you called, when and how long, access to the email box, plus any other service the ISP may provide (for instance some offer a web access to your phone voicemail) with the possibility to activate disabled ones... Well, huge security fail, fortunately this ISP eventually changed this to go on a more traditional and secure authentication system (it seems in your case this was optional, in the case I analysed it was not...).

Answer 2

A couple of other thoughts to build on what has already been proposed.

If you go down the route of using an additional router on your network have a look at the configuration of the ISP's modem to see if it can be changed to bridge mode...on some devices this alone can make it pretty difficult to access the thing (since it effectively becomes 'invisible' on the network).

I have one ADSL modem that when configured this way requires a physical reset to factory defaults to regain access to it!

Though obviously this may or may not be an option depending on what the ISP checks for...it probably won't be feasible, but if it is it might save you a bundle of complexity.

There is also the remote (pun intended) possibility of command line access (for example SSH), which may bypass the web UI restrictions and allow access to additional functionality. Most ISPs will use a re-badged mainstream device, a quick search of the Internet should identify what the thing is based on and throw up any 'low-risk' options for alternative access. Though check T&Cs to make sure the ISP have not already outlawed 'unauthorised' changes of this type.