0

One day, I was playing around with my router configuration. As the result I was able to view TR-069 configuration. I was able to see that the updates server was using HTTP protocol, instead of HTTPS. This made me worried about my router security. From Defcon 22 ( https://youtu.be/rz0SNEFZ8h0 ) I know that TR-069 should be used together with HTTPS protocol, to minimize risk of attacks. I have disabled my TR-069 at my router to not be vulnerable.

Today however I received an email from my ISP, asking me to format my router using reset button on back. While the email does not explain why this is needed, I expect this to be because of disabled TR-069. For now I ignored the email, however if my ISP requires me to have TR-069 enabled, I at least want to be sure that such things can not put my security at risk.

My question is how can I encourage my ISP to use better security?

As a side note I would like to point out that I live in UK, and I would not like to get into any troubles.

  • 2
    Using unencrypted HTTP is not necessarily a sign of vulnerability by itself. Two more things are necessary for this to be a vulnerability: 1) the router don't check cryptographic signature of the downloaded update package/control messages, 2) the ISP don't have network isolation control that prevents other customers and unauthorized personnels from accessing the control port. As an ISP, it's probably cheapest and easiest to implement network isolation than to modify the router software. – Lie Ryan Dec 16 '16 at 1:20
  • vakus - when creating tags, don't plagiarise from other sites. – Rory Alsop Dec 18 '16 at 10:33
  • @RoryAlsop Okay I will keep that in mind in future. – vakus Dec 18 '16 at 13:31
3
  1. Tell your ISP about the issue. It's unlikely to do anything, but you should do that for ethical reasons before you take the next steps.

  2. After they ignored you for a few weeks, report the issue to any technology-oriented news websites which are popular in your location so they can shame them.

  3. Should the websites be uninterested in running the story, or should the ISP not consider it worth their while even after they got publicly shamed, look for a different ISP.

1

The key question is whether you legally own the router. If you don't, then you are breaking the law in the UK by changing its configuration to lock out the ISP. It's an absurd situation/law and an ISP is unlikely to press charges, but it's a road you really don't want to go down. If the router is not yours then there are safer ways to get the ISP to behave.

Tell the ISP about the problem. You are unlikely to get someone at their call centre to understand what you are telling them, so do so in writing, requesting a written response. If you don't get a satisfactory response then you could refer the matter to the telecommunications ombudsman. At this point, more people who don't understand about technology will try to resolve matters. A more effective course of action at this stage would be to name and shame the ISP.

1

Lets assume you get through to your ISP and they give you the time of day to explain the situation.

Let's also assume that they not only understand the technical points, but also agree with you that something should be done.

Chances are - you're not talking to the person who gets to make the final call at that ISP. And try as you and your new ISP-buddy might, you will very likely encounter resistance to anything that costs time and money on the companies part unless it has an verifiable and compelling reason to do so that is backed up by evidence and examples in a non-technical way.

Point them towards the consequences of what could happen if they don't take this vulnerability seriously. I would avoid sending them anything overly technical, however. You can't assume that the person who gets to make the call is technical at all. However you could make a compelling argument that it would be bad for business to see their ISP's name plastered all over the internet as a result of aiding the next massive botnet swarm.

One thing to keep in mind is that your ISP isn't unique in not using HTTPS:

... tests performed by Tal and his colleagues revealed that around 80 percent of real-world deployments don’t use encrypted connections. Even when HTTPS is used, in some cases there are certificate validation issues, with the customer equipment accepting self-signed certificates presented by an ACS. This allows a man-in-the-middle attacker to impersonate the ACS server.

You need to convince them to be one of the few to do the right thing, rather than be amongst the masses doing the wrong thing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.