2

I have an ISP supplied cable modem/router over which I have almost no control. They can upgrade the firmware remotely, so I assume they can do virtually anything with it.

When I transfer data using the switch that is contained within the modem, I think they could look at the data. When I use my own switch which is connected to the ISP modem, will the ISP modem see the traffic that goes through the switch?

I know WiFi that is secured with WPA2-PSK can be eavesdropped upon, same as BNC-style network or those old CAT-style hubs I had in 2000. That is the source of my confusion/suspicion.

Improve this question
1
  • Keep in mind that some switches can be forced to "revert" to hubs through some types of attacks.
    – KnightOfNi
    Aug 31, 2014 at 21:15

3 Answers 3

Reset to default
5

A switch will try to only send traffic to its intended recipient. But it is not guaranteed. If the switch doesn't know where the recipient is, it will send the packet to all devices connected to the switch.

There are ways to make a switch forget where the intended recipient is (such as overflowing the CAM or MAC spoofing).

There are also ways to make individual computers send packets to some other MAC than the intended recipient (ARP spoofing and the like).

You should only consider a switched network to be a trusted network if you either trust every device connected to the network or the switch has some advanced security features to protect against all the attacks described above.

You'd be better off using a router, which is controlled by yourself only. If using your own router would mean an (extra) layer of NAT, you should use a bridging firewall instead.

Improve this answer
2
  • This is better than my answer.
    – lzam
    Aug 31, 2014 at 23:42
  • Now that you say that switches can be overloaded and behave like hubs, I remember that a buddy told me that some 8 years ago. I think that another router would mean a NAT for IPv4 and a firewall for IPv6. Some routers do not pass IPv6 to the clients, so I would loose IPv6 connectivity. I guess my own router with a firewall would be an improvement in any way.
    – Martin Ueding
    Sep 1, 2014 at 8:30
1

That depends on whether you're talking about local or internet traffic. For internet traffic, it doesn't matter what modem you use; your ISP can see EVERYTHING that you send out onto the internet. After all, they're your bridge to the internet, and everything you do passes through them first. It doesn't matter who the traffic is "addressed" to; it's passing through them, so they can read it if they want to.

However, it is possible prevent them from being able to read what you're sending with encryption. Sites that have SSL/TLS (ones that begin with https://) have encryption enabled by default, and it works from your computer all the way to the web server on the other end, so it's very difficult to eavesdrop on such traffic. But for sites that don't use SSL/TLS, you need to use a VPN service or TOR to hide your activity from your isp.

WPA encryption only works between the computer and the router - the router decrypts the information before it gets sent out onto the Internet.

If you're talking about local (LAN) traffic, it's pretty unlikely that your ISP has hijacked your modem to send such traffic to them for inspection, though theoretically it's a possibility. And you're right, installing a switch would likely protect you against this by making sure that local traffic is not sent to the ISP router/modem at all.

Improve this answer
3
  • Not really. While a switch does not unnecessarily forward traffic through all ports by default, an attacker on the network can easily work around this. Some switches can be forced into a failover mode that causes them to behave as hubs (forwarding traffic out of all ports). In addition, ARP poisoning can be used to intercept traffic on the LAN.
    – lzam
    Aug 31, 2014 at 21:13
  • A note: going the other way (from the internet to the recipient) switches and hubs differ greatly: a hub sends out communications going over the local network to everyone on it, whereas switches send it exclusively to its intended recipient.
    – KnightOfNi
    Aug 31, 2014 at 21:14
  • I am aware that the ISP can see everything I do on the web. It might not see the contents on TLS protected pages, but it can still see which pages I open (DNS, handshake). There, I have to rely on data protection laws or use my university provided VPN.
    – Martin Ueding
    Sep 1, 2014 at 8:31
1

If you are concerned that your ISP provided router may be compromised, you should replace your router with one that is under your full control. Unfortunately, with the pitiful state of home router "security" in general, this may not be that much better.

It is true that switches are designed to forward ethernet frames only out of the ports connected to the addressee. Some would like to consider this a security feature, but it isn't really designed as one, and there are ways around it. Like good old ARP poisoning. It is really shockingly easy to intercept traffic once you have control of a device on the LAN.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .