1

When I was changing my router my ISP technician told me that he has remote access to all routers provided by ISP. Was that true? If that is a fact it scares me...

7 Answers 7

2

Go home, plug a new router into the ISP router, or if you're courageous, replace the ISP router with your own router. Set the admin password to a 32 character "Horse Battery Staple Kumquat" value.

Now ask whether the ISP has access to all routers connected to their network.
The admin told you what it is useful (to him) for you to believe.

2
  • 1
    Then it might not still be giving you access to the internet? Depending on your ISP. I'd recommend rather another device inside the router provided by your ISP, and for privacy use a VPN service and a DNS service outside the control of your ISP.
    – Simply G.
    Commented Mar 17, 2016 at 7:27
  • 1
    The OP said "all routers provided by ISP". And the router on the local network is, according to your design, not on the ISP's network anymore...
    – schroeder
    Commented Jan 1, 2022 at 9:54
5

In a typical modern setup, the cable modem and router are the same device. It is both an endpoint on the consumer's network as well as the telecom's. As such, they have base level access to administer the device, however what they are allowed to do with it is generally governed by your terms of service. Even when the router is separate, if it is supported by the ISP, then they need access to it to be able to provide support.

This is why I never use the router provided by the ISP. If you want to be secure, you should always use your own hardware that you own as an additional layer of defense. I have my ISP's cable modem/router set in to bridge mode and it relays the connection to my personal router which treats it as a WAN device. This gives me complete control of my interior network, but it also means I'm on my own whenever there are problems with my connection and the first thing they make me do is plug in to the cable modem directly to eliminate my network as a possible problem.

5

ISPs have complete access to the router provided by them. They often use port 7547 which is TR-069 Protocol (CWMP customer-premises WAN management protocol). And you cannot disable it because it's hidden from GUI mode, and obviously, ISPs don't provide the CLI to customers.

The solution is to replace the router with your own and asking the complete router configurations from your ISP.

2

Of course, how else would they be able to fix something if things go wrong? Note that normally all access should be regulated by a TACACS server which also logs every router access. I do say normally...

0

I highly doubt it, yes there may be limited access to the router itself most likely for diagnostics purposes. But having access through the router itself into your network is unlikely as there are numerous laws which would come into play e.g. in the UK we have the computer misuse act making it illegal to access your network directly without your consent. If you are worried you can do simple things to help put your mind at ease,

  1. change the administrator password on the router

  2. change the access password to your router

  3. keep anti-virus software up to date (some may have anti-intrusion algorithms as well)

    The chances are what he meant was that he (the ISP) will have a degree of access to routers which would allow them to carry out diagnosis in the event of a problem. Without reverse engineering the router though there is no way to be 100% sure but chances are he was making it up a bit. If all else fails i'm sure Edward Snowden will let us know soon

5
  • 2
    Have you ever read the contract you signed with your ISP? Commented Feb 11, 2014 at 13:20
  • I haven't, what are you implying?
    – Davidenko
    Commented Feb 11, 2014 at 13:41
  • 1
    That there is a high possibility that there is a clause in your contract which states that the equipment you are using is still their property and that therefore they are allowed to have access to it. Commented Feb 11, 2014 at 15:03
  • That is true, however attaching themselves to your computer or networked storage still remains highly illegal, such a clause would also have privacy *implications for which they could be sued
    – daark
    Commented Feb 11, 2014 at 16:41
  • None of your suggestions would do anything against an ISP-level threat. Not every country has the CMA, and some ISPs claim that your home network is their network, which defeats your CMA argument.
    – schroeder
    Commented Jan 1, 2022 at 10:03
0

It's probably true. This is to enable technical support. ISPs have wasted huge amounts of time trying to walk customers through menus, so they have cut out the middleman. I'm guessing it scares you because:

  • "OMG, they can see everything that I do!" Truth is, they already can; they're your ISP. Everything you do on the internet is an open book to them whether they control your router or not. OK, if they have control of your router they can sniff traffic between systems in your home network, chances are that's not a real concern
  • "OMG, they can control my network!" So what? There's nothing that they could do on your router that they couldn't do from their routers

If having control of your router is important to you then talk to your ISP. Many ISPs now have it in the T&Cs that you use their provided router in order to get tech support. If you put your own on there it will probably still work but you'd be on your own if something goes wrong. You also may be able to pay a bit more monthly in exchange for retaining tech support while still using your own router.

2
  • 2
    What do you mean: "There's nothing that they could do on your router that they couldn't do from their routers" Isn't router separating my LAN network from internet? I sad it scares me, because they can see shares and disks they are not supposed to see.
    – Davidenko
    Commented Feb 11, 2014 at 13:37
  • They can configure your local wireless and lan networks!!! They could ABSOLUTELY not do this if they didn't have access.
    – chad
    Commented Nov 11, 2021 at 20:08
-1

They do maintain a way to access the routers that they provide. This gives them a way to look at the configuration if something goes wrong. To access your network, though, they would have to have a machine that has a private IP address on your network. To be sure, the router has that. The computer they're using doesn't unless it's connected by VPN.

This would mean that the router has the software installed full-blown command environment and/or VPN software. This is highly unlikely. But, even if it isn't, then can he access other devices on your network? That depends on which servers each device is running. Can you access and control someone else's computer in your house? Probably not, because they're not running an SSH server on port 22. If you can't access the machine, he can't. Since he's not the user of your machine, he can't access yours either. Let's say someone in your household has given you access to their machine (whether SSH or not). You should have a password that's necessary to initiate that service. But he doesn't have it.

I am confident allowing my ISP access to its own device doesn't allow its employees free run of my entire network, and also that they're too busy to try anyway.

7
  • 1
    Your comments about external machine's access to the local network and the need for a VPN are false and not how it would work.
    – schroeder
    Commented Jan 1, 2022 at 9:22
  • The OP says explicitly that the technician said "routers provided by ISP" so your comment on that is redundant and removed.
    – schroeder
    Commented Jan 1, 2022 at 9:23
  • "the router has the software installed full-blown command environment" -- they certainly can. Most are custom-built Linux machines.
    – schroeder
    Commented Jan 1, 2022 at 9:24
  • Theis entire answer seems to be about access to the router meaning access to the network, but that was never asked, Then you go further to talk about logging into local machines. Again, never mentioned in the question.
    – schroeder
    Commented Jan 1, 2022 at 9:25
  • The rest of the answer is a story about your struggles maintaining your own router, which is completely off-topic of the question and removed.
    – schroeder
    Commented Jan 1, 2022 at 9:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .