Cable modem/router hidden internal ISP network?

Question

I was querying my router(Thomson TCW750-4) over the SNMP and stumbled upon some interesting information. I see that the router actually has five separate network configurations operational:

1. Loopback(Router IP: 127.0.0.1)
2. Local network(Router IP: 192.168.1.1, Subnet: 255.255.255.0)
3. Local network 2(Router IP: 192.168.100.1, Subnet: 255.255.255.0)
4. Broadband WAN network(Router IP: 109.X.X.X - dynamic, Subnet: 255.255.252.0)
5. ISP internal network(Router IP: 172.21.X.X - static, Subnet: 255.255.248.0)

(I've hidden parts of the addresses for privacy reasons with X)

Now I'm interested in this number 5 network. I'm not actually sure if it is called 'ISP internal network' that is what I basically think it is. From my computer connected to the router I can not access other addresses on that network but I can access my router configuration page over that address the same way I do over 192.168.1.1!
However inside the router configuration there is a ping test page and through that ping I can ping other machines inside the 172.X.X.X network.

So my questions are: What is this network for? Is it essential for cable network to function properly? Is it just there so that my ISP can access my router configuration? Can other users on the network access my router configuration over this network? How?

I tried answering the last question by testing, but whatever I do(for example configure my PCs network to be in that network range) I can not access(ping) any other machine in that range. Pinging from the router test page however does work. So either the router is blocking traffic from local network to that network(which would be some sort of security measure) or I do not know how to configure things correctly. What I think would definitely work is, if someone managed to clone his cable modem on a more capable router machine running DD-WRT for example he could basically reach this network.

However I would be interested if it is possible to reach this network even through these primitive routers that the ISP is giving to its users(Mentioned Thomson router and the second option that users potentially get is a Scientific Atlanta DPC2203), by some sort of configuration.

Disclaimer: I'm primarily researching this to know if my personal network is vulnerable or not.

Answer 1

The IP addresses beginning with 172.21 are in the "172.16/12" block, reserved for private networks by RFC 1918. It is plausible that:

• The routers from the ISP are indeed part of an ISP-maintained private network.
• The ISP uses that private network to talk to the routers, e.g. to reboot or configure them remotely.
• The routers are configured not to route packets between that private network and the rest of the world, including the Internet, and the local network on the customer side (the 192.168.*.*). This is not surprising, since that network is supposed to be private.

How exactly the router prevents packet exchanges between the ISP network (172.21) and the local network (192.168) is an open question. It is possible that the router is very basic in that respect. Most such routers run on a Unix-like OS, often a VxWorks or Linux derivative. Let's suppose a Linux. Linux maintains a routing table, which would tell him something like:

• There is a local network with IP addresses 172.21.X.Y/21 on interface eth0; when a packet is for such an address, send it on eth0.
• There is a local network with IP addresses 192.168.1.Z/24 on interface eth1.

(Use netstat -rn on a Linux machine to see that table.)

If you configure your PC to assume a 172.21.U.V address, but still connected on eth1, then you may bring an ICMP request targeted to another 172.21.X.Y address to the attention of the router; but even if the router accepts to forward it to the target machine, and the target machine responds, the response will be for 172.21.U.V, and the router won't re-emit it, or only on eth0, so you would not see it. This is why configure your PC with an internal address will not allow you to see anything in that respect.

Similarly, if you keep your machine with its 192.168.1.Z address, and send your ping request from that, then the router will see it, and possibly forward it on the 172.21.X.Y network. But then, the response will be sent to 192.168.1.Z as seen from the target machine, which will not be your machine, but possibly a machine on the internal network of another client. Or maybe it will go to the default gateway of that target machine, i.e. to the Internet. The Internet does not know that 192.168.1.Z is in your home, so you will not see the response anyway.

If you reflash your router with something like DD-WRT, then you might be able to access that network, except if the reflashing destroyed some credentials which the router was using to connect to the ISP network in the first place. You may have better luck if you find an exploitable hole in the router, allowing you to hijack it without rebooting it: in that case, it seems highly plausible that this would give you network access to all other systems on this private network, including (probably) the routers of other customers. At that point, risks depend a lot on how the ISP people authenticate themselves with the routers when they want to run administrative things (e.g. firmware updates). Right now you have zero information on the subject. For an attacker, using this private network may be useful in that a target home router (the one in the home of someone else) is nominally accessible from the Internet but through the ISP firewalls, and the private network might allow for working around the said firewalls.

A noteworthy point is that your router sees a netmask of 255.255.248.0 on that 172.21.X.Y network: that's room for about 2000 IP addresses at most. So this private network is probably used for only a small subset of the cable routers from that ISP.