There is actually two different issues in your question:
- ISP provided modem/router with no password,
- Customer's page on ISP's website use the source IP as sole authentication.
ISP provided modem/router with no password
You have two possibilities, depending whether you opt to keep the ISP box or replace it altogether.
Solution 1: isolate the ISP box
Consider the modem/router as untrusted, part of ISP's network and not your own, and assume this choice. This is the choice I recommend since it fully complies with any ISP End-User Licence Agreement (EULA) and ensure you can benefit from any of their service or service upgrades now and in the future.
Moreover, it provides a good abstraction layer so changing of ISP or technology (ADSL, cable, fiber) is as simple as replacing the ISP box and affecting it the right IP, with strictly no impact on your own network especially if you do not rely on ISP's DNS servers.
To achive this you may want to take the following actions:
- Disable ISP box's WiFi, and use a WiFi router of your own instead if you need WiFi capabilities,
- Put a device with firewall capabilities (it can be the WiFi router mentioned above, and old computer, etc.) between your wired network and the ISP box with such kind of policy:
- By default all communication between ISP's box IP and your LAN is blocked in every direction (the ISP box has no reason to contact your LAN's computers, and your LAN's computers while they go through the ISP box to access the Internet have usually no reason to contact the box itself),
- One exception to the rule above: a lot of ISP's provide a DNS server in their box, unless you are using an alternative DNS server like OpenDNS or Google Public DNS (or your own!) you may still want to allow your LAN computers to contact the ISP box on the domain (53 tcp/udp) port,
- When needed and only when needed, you can open an access from one of your LAN's computer to the ISP box HTTP (80 tcp) port (for instance) to access the administration interface. Do not forget to disable this access once your are done.
This will basically isolate the ISP box and relegate it to the role of a simple modem. In case you need some more features from your ISP box (television for instance), you can enable the access from the appropriate LAN devices to the ISP box on selected ports (you should find information on which ports to enable on Internet forums). Just be sure to keep administration ports closed by default (these are usually HTTP-80, HTTPS-443 and telnet-23, don't forget this one!) because these are the dangerous ones.
Solution 2: replace the ISP box by an ADSL modem or a router in bridge mode
The good thing is that this solution will give you maximum control over your Internet connection:
- You will be able to handle yourself the QoS of your Internet connection, mitigating bandwidth consuming uploads impact over downloads,
- I've read that ISP use the VPI/VCI parameters to route flows to different networks in their infrastructure (Internet access, phone line VoIP, television video streaming, possibility maintenance stuff, etc.). From a black hat perspective, having the possibility to manually set the VPI/VCI parameters of your modem allows you to explore ISP's network parts not normally accessible (and probably less secured) if you were using the genuine ISP's box.
I say the latter not to encourage you to do illegal stuff, but to make you understand why some ISP impose the use of their own box to their users and forbid custom firmwares. The attitude of ISP regarding this point varies a lot:
- Some ISP's let the user fully free of their action and officially allow user provided material to be connected to their network. They just announce that they provide support only for their own box, for other devices they provide generic ADSL parameters to use and it's up to the end-user to configure everything by himself. This was common in the pre "triple play" era, but nowadays it is sadly (but obviously?) not the way followed by the major ISP's.
- Some ISP officially impose the use of their own boxes, but do not technically restrict anything. You can find the parameters to use for your modem on Internet forums, and it will work. Be conscious, though, that your modem will only provide you Internet access, all other services usually provided by your triple or quadruple play ISP box (phone, television) will not be available with your modem.
Some ISP strongly impose the use of their own boxes:
- First they filter incoming connection request's MAC address and reject the connection if the device MAC does not correspond to the MAC allocated to the subscriber (a common symptom of this is that the box from one subscriber is not be able to connect at another subscriber's home).
- Then from time to time they scan currently connected devices to detect non complying devices (I suppose such scanning can be easily merged in a script checking if your box firmware is up-to-date, except that it will not fail silently if it cannot connect to your box).
If you are detected as having maliciously bypassed the MAC check to connect a non compliant device to your ISP network, your ISP will consider this as a violation of the EULA and will be free to put an immediate term to your subscription (but you should not go in jail for this... unless it turns out that they also discover that you were wandering in their internal VoIP infrastructure following the black hat point above, if so be ready for some trouble...).
Customer's page on ISP's website use the source IP as sole authentication
Funnily enough, the security of home Internet access was one of my assignments in my last years study, and I saw with my own eyes such an awful practice.
Once someone gets access to your WiFi (if it is a stranger having no access to your home, but someone inside your home can do this from your LAN too), he gains access to the detailed phone bill showing every number you called, when and how long, access to the email box, plus any other service the ISP may provide (for instance some offer a web access to your phone voicemail) with the possibility to activate disabled ones... Well, huge security fail, fortunately this ISP eventually changed this to go on a more traditional and secure authentication system (it seems in your case this was optional, in the case I analysed it was not...).