1

Project BISmark aims to measure broadband service by recording and reporting on service using OpenWRT-based router firmware (software licensing unclear, no LICENSE or COPYING files in the repos) with results published publicly. Their privacy statement highlights that they collect only service information, not network traffic. However their Participant Notices also includes the following statement:

BISmark Remote Access Statement

To control the measurement experiments run on participants' BISmark devices, as well as to upgrade and troubleshoot devices when they are installed in participants' homes, the BISmark routers have remote access capabilities. Authorized members of the BISmark team have the capability to execute scripts and obtain shell access on the BISmark router installed in your home. These capabilities will only be used for controlling measurement scripts and for performing maintenance on your BISmark router.

Given that a BISmark researcher could log in to my router, could they (attempt to) access other machines on my network?

Improve this question

4 Answers 4

Reset to default
4

We can understand your concerns. We do have the ability to ssh in to your router, yes, but access is limited to 4 people, and it is only done for trouble shooting purposes.

The goal of BISmark is to enhance our understanding of broadband networks. We do not collect any personal (PII) information. We are simply not interested in it. We are interested in how your network (access link, wireless network, etc) is performing.

All our experiments are vetted by the Georgia Tech Institutional Review Board (IRB). Please address further concerns to [email protected]

Improve this answer
1
  • I assume that this means that once on the router you could (attempt to) ssh onto other devices on the network. I'm accepting this answer because it states clearly where the trust lies. Thank you for the feedback.
    – lofidevops
    Oct 28, 2014 at 17:23
1

Short answer: yes.

Once someone has remote access to any node on your network, they could potentially reach out to the other nodes on the network.

Improve this answer
1

I partipicate itself in a similiar internet test. Here, the device in question are put between the WAN port of your own router, and the internet, thus the measurement device would be "outside" your firewall and a owned measurement device would not give the hacker more abilities than direct access.

I cannot tell if BISmark does advise the users to put the device between WAN and internet, this is not shown on their webpage. Anything that is put between your WAN-port on your regular router and the internet, is secure. Anything that you put between the LAN-port and your computer(s)/device(s), is accessible for the thing you put there.

Installing BISmark on your regular router would give them full access. However, if you want to be extra sure, you could "chain" the bismark router behind a Another router, so it becomes like this: [Your computers] --> [A additional regular router] --> [BISmark router] --> [Internet]

If you do such chaining, be sure to setup your regular router to use a different LAN subnet than the BISmark router. So for example if the bismark uses 192.168.1.x, set up your regular router to use for example 192.168.2.x This is best performed by connecting the regular router to a PC, but NOT connecting anything to its WAN port, thus you can change the internal router IP and DHCP range without anything from WAN colliding. When this are done, you can connect the chain.

Improve this answer
0

We do not collect any private information. Having access to the home router does not imply the ability to access any other devices on the home network.

For more information, see our privacy policy:

http://projectbismark.net/participant/privacy/

Improve this answer
3
  • 4
    I can appreciate the privacy policy, but that only implies that you won't, not that you can't. If someone has access to a router, they also have access to DNS, port forwarding, and traffic flow. Can you elaborate on your statement that there is no implied ability to access other devices?
    – schroeder ♦
    Oct 23, 2014 at 15:01
  • 2
    I'm not attacking the BISmark project, or suggesting anything nefarious, but shell access to a router with capabilities to upgrade the device does also provide the option of deeper access, although I am not suggesting that anyone at BISmark would exercise that option.
    – schroeder ♦
    Oct 23, 2014 at 15:04
  • I second that notion.
    – Desthro
    Oct 23, 2014 at 15:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .