8

A friend of mine has a DSL-modem/wifi-router from his ISP. The configuration page of the modem requires no login and no login can be set. It is said that there also exists a superuser but this is only known to ISP-technicans and is not public. Anyone on the network or using attacks like DNS rebinding or viruses can read and write the user configuration of the modem without login.

Only official modems of the ISP are allowed by the ISP so he cannot exchange it. It is the only ISP in the area.

When asking the ISP about it, he said, that wifi encryption is enough and it is because users call the hotline all the time because they forgot the passwords. (By default the ISP also logins you with full access with your contract credentials on his homepage without requesting username/password but using the IP-address as authentification and ignores that users share their wifi-password with friends. We already changed this.)

Is this configuration really secure in practice like the ISP said or what steps can be done to make it secure?

  • 1
    What functionality is on the modem configuration page? And what is on the ISP page? – paj28 Dec 13 '15 at 15:52
  • @paj28 modem: mainly ISP-credentials(same as email and ISP-credentials), port-forwarding, wifi-setup, (dis)connecting internet, reset, DynDNS ISP page: cancel their service, order new services, change services, order new smartphones and make other purchases – H. Idden Dec 13 '15 at 15:59
  • Why don't you simply enable MAC filtering/whitelisting on the modem, that can add some security. – Krishna Pandey Dec 13 '15 at 19:16
  • @AndréBorie Didn't know that you can exchange them that easily. Anything else to consider when buying except if it is Annex A or Annex B? – H. Idden Dec 13 '15 at 19:57
  • 1
    @WhiteWinterWolf OpenWRT would be still better than the default firmware but nothing beats a lightweight Linux/BSD without any web interface nor superfluous services. – André Borie Dec 14 '15 at 14:42
8

There is actually two different issues in your question:

  • ISP provided modem/router with no password,
  • Customer's page on ISP's website use the source IP as sole authentication.

ISP provided modem/router with no password

You have two possibilities, depending whether you opt to keep the ISP box or replace it altogether.

Solution 1: isolate the ISP box

Consider the modem/router as untrusted, part of ISP's network and not your own, and assume this choice. This is the choice I recommend since it fully complies with any ISP End-User Licence Agreement (EULA) and ensure you can benefit from any of their service or service upgrades now and in the future.

Moreover, it provides a good abstraction layer so changing of ISP or technology (ADSL, cable, fiber) is as simple as replacing the ISP box and affecting it the right IP, with strictly no impact on your own network especially if you do not rely on ISP's DNS servers.

To achive this you may want to take the following actions:

  • Disable ISP box's WiFi, and use a WiFi router of your own instead if you need WiFi capabilities,
  • Put a device with firewall capabilities (it can be the WiFi router mentioned above, and old computer, etc.) between your wired network and the ISP box with such kind of policy:
    • By default all communication between ISP's box IP and your LAN is blocked in every direction (the ISP box has no reason to contact your LAN's computers, and your LAN's computers while they go through the ISP box to access the Internet have usually no reason to contact the box itself),
    • One exception to the rule above: a lot of ISP's provide a DNS server in their box, unless you are using an alternative DNS server like OpenDNS or Google Public DNS (or your own!) you may still want to allow your LAN computers to contact the ISP box on the domain (53 tcp/udp) port,
    • When needed and only when needed, you can open an access from one of your LAN's computer to the ISP box HTTP (80 tcp) port (for instance) to access the administration interface. Do not forget to disable this access once your are done.

This will basically isolate the ISP box and relegate it to the role of a simple modem. In case you need some more features from your ISP box (television for instance), you can enable the access from the appropriate LAN devices to the ISP box on selected ports (you should find information on which ports to enable on Internet forums). Just be sure to keep administration ports closed by default (these are usually HTTP-80, HTTPS-443 and telnet-23, don't forget this one!) because these are the dangerous ones.

Solution 2: replace the ISP box by an ADSL modem or a router in bridge mode

The good thing is that this solution will give you maximum control over your Internet connection:

  • You will be able to handle yourself the QoS of your Internet connection, mitigating bandwidth consuming uploads impact over downloads,
  • I've read that ISP use the VPI/VCI parameters to route flows to different networks in their infrastructure (Internet access, phone line VoIP, television video streaming, possibility maintenance stuff, etc.). From a black hat perspective, having the possibility to manually set the VPI/VCI parameters of your modem allows you to explore ISP's network parts not normally accessible (and probably less secured) if you were using the genuine ISP's box.

I say the latter not to encourage you to do illegal stuff, but to make you understand why some ISP impose the use of their own box to their users and forbid custom firmwares. The attitude of ISP regarding this point varies a lot:

  • Some ISP's let the user fully free of their action and officially allow user provided material to be connected to their network. They just announce that they provide support only for their own box, for other devices they provide generic ADSL parameters to use and it's up to the end-user to configure everything by himself. This was common in the pre "triple play" era, but nowadays it is sadly (but obviously?) not the way followed by the major ISP's.
  • Some ISP officially impose the use of their own boxes, but do not technically restrict anything. You can find the parameters to use for your modem on Internet forums, and it will work. Be conscious, though, that your modem will only provide you Internet access, all other services usually provided by your triple or quadruple play ISP box (phone, television) will not be available with your modem.
  • Some ISP strongly impose the use of their own boxes:

    • First they filter incoming connection request's MAC address and reject the connection if the device MAC does not correspond to the MAC allocated to the subscriber (a common symptom of this is that the box from one subscriber is not be able to connect at another subscriber's home).
    • Then from time to time they scan currently connected devices to detect non complying devices (I suppose such scanning can be easily merged in a script checking if your box firmware is up-to-date, except that it will not fail silently if it cannot connect to your box).

    If you are detected as having maliciously bypassed the MAC check to connect a non compliant device to your ISP network, your ISP will consider this as a violation of the EULA and will be free to put an immediate term to your subscription (but you should not go in jail for this... unless it turns out that they also discover that you were wandering in their internal VoIP infrastructure following the black hat point above, if so be ready for some trouble...).

Customer's page on ISP's website use the source IP as sole authentication

Funnily enough, the security of home Internet access was one of my assignments in my last years study, and I saw with my own eyes such an awful practice.

Once someone gets access to your WiFi (if it is a stranger having no access to your home, but someone inside your home can do this from your LAN too), he gains access to the detailed phone bill showing every number you called, when and how long, access to the email box, plus any other service the ISP may provide (for instance some offer a web access to your phone voicemail) with the possibility to activate disabled ones... Well, huge security fail, fortunately this ISP eventually changed this to go on a more traditional and secure authentication system (it seems in your case this was optional, in the case I analysed it was not...).

  • Nice idea. Now I now what will be done on Christmas holidays ;) I found out your examples for the website are harmless: At my ISP you can additionally cancel their service, order new services, order new smartphones and make other purchases with that login. It was only noticed when a visitor wanted to change his contract using his own smartphone but my friends wifi and it showed my friends username. It even is one of the biggest ISP in the country, So I am waiting for a widespread hacking attack ordering smartphones/canceling the contract in the name of millions of customers ;) – H. Idden Dec 13 '15 at 15:53
  • Do you have a suggestion when you regularly need to reconnect the internet connection on the modem configuration page (for changing IP-address for different websites)? When following your suggestions one would have to reconfigure the firewall a few times per day in this case. – H. Idden Dec 13 '15 at 16:07
  • 1
    @H.Idden If you use a small or old computer as firewall, then you could note the URL triggering the Internet reconnection on the web interface and make a basic system relying on some script for instance. It would be harder with a router since it cannot restrict access to some parts of the interface. For what its worth, a possible security through obscurity measure would be to configure the router so you need to access a non standard port to contact the ISP box web interface (NAT). This is better than nothing but remains quite weak. On my side, I just use the box switch to turn it off and on. – WhiteWinterWolf Dec 13 '15 at 17:31
  • Changed requirement to OpenWRT capable router with trigger-script ;) – H. Idden Dec 13 '15 at 17:44
  • @H.Idden: You said it was for a friend of yours, so I wanted to keep it as simple as possible. If you want to go to some "geekeries", then instead of having to manually enable/disable a firewall rule you can opt to setup an HTTP revese proxy in front of your modem web interface, adding either basic HTTP authentication to protect against any unwanted access or, even better, client-side certificate authentication. – WhiteWinterWolf Dec 14 '15 at 13:58
4

A couple of other thoughts to build on what has already been proposed.

If you go down the route of using an additional router on your network have a look at the configuration of the ISP's modem to see if it can be changed to bridge mode...on some devices this alone can make it pretty difficult to access the thing (since it effectively becomes 'invisible' on the network).

I have one ADSL modem that when configured this way requires a physical reset to factory defaults to regain access to it!

Though obviously this may or may not be an option depending on what the ISP checks for...it probably won't be feasible, but if it is it might save you a bundle of complexity.

There is also the remote (pun intended) possibility of command line access (for example SSH), which may bypass the web UI restrictions and allow access to additional functionality. Most ISPs will use a re-badged mainstream device, a quick search of the Internet should identify what the thing is based on and throw up any 'low-risk' options for alternative access. Though check T&Cs to make sure the ISP have not already outlawed 'unauthorised' changes of this type.

  • 1
    Good ideas but unfortunately it is a very much crippled version of a mainstream device. They even removed the functionality to set the IP-address for DHCP and bridged mode/modem only mode. It has a telnet access but has not more functionality except if you would know the superuser password only known to the ISP. Since the latest update there is no known way to gain more access or flash an unauthorizized firmware :( – H. Idden Dec 13 '15 at 19:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.