5 ms·

Fun story: I work remotely for an org located in the Bay area. Few months ago I get a call early morning from the IT security person. Apparently someone had bee

Fun story: I work remotely for an org located in the Bay area. Few months ago I get a call early morning from the IT security person. Apparently someone had been trying to RDP into my work laptop, over a thousand attempts per day for last couple of days. What changed before the last couple of days? My laptop was frequently dropping WiFi connection- a lot of times in the middle of zoom meetings. We use a router provided by AT&T. My wife complained of the same thing, so I thought I'll ping their customer support. The customer support person proceeded to tell us they wanted to reconfigure our router to enable "5G". After some bewilderment we realized they were talking about 2.4G vs. 5G WiFi. And they will do it remotely. Ok fine go ahead, we said, and forgot about it.. until I got the call from my office IT security. Apparently the AT&T support person left our router in passthrough mode. According to their K/B, "Placing a device in passthrough mode will remove firewall protection provided by the AT&T gateway." I reset my router to default settings, and got myself a 100ft Ethernet cable to fix the issues.

LoganDark 4y ago
> Placing a device in passthrough mode will remove firewall protection provided by the AT&T gateway Did... did they seriously turn the router into a DMZ*, without your consent? Where every port of your computer is just open to the internet? That's scary. *that's what it was called on my router, the "forward every single port to one device" mode. Not sure if that is the correct term for it.
- esalman 4y ago
  Yeah. We checked with censys.io, port 3389 and 8080 were open as publicly available service on the router.
  - jandrese 4y ago
    Oh yeah, if you leave RDP open to the internet the scanbots will be all over that like white on rice. If only we would finish the switch to IPv6 we could pull the rug out from under those bots.
- rzzzt 4y ago
  Passthrough mode turns ~90% of the (DSL modem / ONT) + router + DHCP + NAT + WiFi AP + whatever functionality off, allowing you to add another home router after it which is completely under your control and let the ISP-provided one only do the most necessary, eg. (DSL modem / ONT) parts.
  - LoganDark 4y ago
    > add another home router after it which is completely under your control and let the ISP-provided one only do the most necessary, eg. (DSL modem / ONT) parts. Oh absolutely, I used that trick once in order to use a router that I could configure over web interface instead of Over The Cloud With A Spyware Mobile App (aka Internet Of Shit). Unfortunately my ISP smartened up to this and started cutting the line whenever I tried to use my router. Like, it would work for a while, then they'd shut off service, and it wouldn't work anymore (even if I removed my router) until I called them up and complained. They would act oblivious like the problem was with my equipment. Every time I asked them why my internet stopped working they would say there was some problem with my hardware. The hardware was brand new and could not have been more fine; they were mistaken. It would also work perfectly when I actually had service; the issue was the ISP kept cutting it because they're petty bastards. Eventually I gave up, which is probably what they wanted, but it's not like I'm suffering too badly with their equipment, even if I have to use a rooted phone in order to pry away all the spyware permissions from their stupid app. They are a monopoly so I have no choice.
    - bee_rider 4y ago
      Wow, I hate Comcast like everyone else, but even they are not that bad. That is just ridiculous. If I couldn’t have my own modem and own router… I dunno, they have a local monopoly, but I’d start looking at 5G connections or something.
      - deleted 4y ago
        [deleted]
    - radicaldreamer 4y ago
- faeriechangling 4y ago
  That's why a firewall I own is in-between my ISP provided equipment and my computer.
  - LoganDark 4y ago
    Yeah, my computer has an application firewall[0] between it and anything that tries to connect to it (LAN or not), so if my router ever opened up my ports, I would know. Same applies for my other two computers (my MacBook runs Little Snitch on 10.14, so it's a kernel extension that Apple can't bypass). Not the rest of my devices though. Though it's not like anyone could get through fail2ban on my server, or compromise my Android device, or hack any IoT devices since I own none, etc. [0]: https://safing.io https://safing.io
deleted 4y ago
[deleted]
freshocean 4y ago
finally, after switching to 5GHz WiFi was the Zoom problem resolved? asking because: Your comment reminded me of one article / discussion about Apple Devices causing huge network load , and hence delays, due to some map ping thingy. [Apple Maps location scan spikes WiFi latency every 60 seconds. 677 points, 172 comments] https://news.ycombinator.com/item?id=31356730 https://news.ycombinator.com/item?id=31356730 (I hate the '5G WiFI' that most ISPs seem to be calling it everywhere. )
- esalman 4y ago
  We don't have any apple products actually. Three Lenovos and a Razer. My wife is still on WiFi most of the time and she hasn't experienced much issues. But my impression is that we always has 5G WiFi enabled. Still not sure actually what AT&T support did, but if there was an issue it was most likely fixed by the router reset.
froggit 4y ago
Aighht... basically, that's kinda like, you know, REALLY bad... Tbh, it'd been way less damaging to your security posture if instead they went like : "yeah... we're gonna have to go ahead and reconfigure your home to operate in passthrough mode. This is going to require techs onsite so we went ahead and deployed some generic subcontractors. What they have to do there is, well kinda counterintuitive. They will be using brute force techniques to uninstall and didpose of ALL of your doors. So.... there's a bunch of little wireless packet things, like the kind use for 5G, or the other 5G, flying around everywhere. They always bounce off things and they get lost a bunch. Now that home passthrough mode is enabled, the packets can just 'pass through' and get where they wanna be. Sometimes other things, like humans, or ocelots, 'pass through' too. How exciting! After all, at ATT no one gives a ** if all kinds of critters go through your crap whenever we 'fix' something. " When your ISP screws up your router settings: 1) It's highly likely you won't be aware there's a major security problem with your network. 2) potential attackers include, but are not limited to, massive numbers of ill-intentioned, yet impossible to identify, individuals quckly become aware there's a major security problem with your network. When your ISP performs a literal brute force attack on your domicile, leaving you completely doorless: 1) You KNOW, 100%, that there's a major security problem. Your doors are gone. No doors. The physical equivalent of a router in passthrough mode. 2) Potential attackers are within a relatively limited geographic area, with numerous ways to learn more. They've likely noticed that things in your home life have been a bit weird.
tlavoie 4y ago
I prefer to treat my ISP-supplied equipment as foreign territory, so their modem is in passthrough mode on purpose. Its only client is my own standalone firewall, since I have its Wi-Fi turned off. As long as I'm not messing with the network, it's all great, and I know where to start looking if there is odd traffic going on.

LoganDark 4y ago

> Placing a device in passthrough mode will remove firewall protection provided by the AT&T gateway Did... did they seriously turn the router into a DMZ*, without your consent? Where every port of your computer is just open to the internet? That's scary. *that's what it was called on my router, the "forward every single port to one device" mode. Not sure if that is the correct term for it.

esalman 4y ago
Yeah. We checked with censys.io, port 3389 and 8080 were open as publicly available service on the router.
- jandrese 4y ago
  Oh yeah, if you leave RDP open to the internet the scanbots will be all over that like white on rice. If only we would finish the switch to IPv6 we could pull the rug out from under those bots.
rzzzt 4y ago
Passthrough mode turns ~90% of the (DSL modem / ONT) + router + DHCP + NAT + WiFi AP + whatever functionality off, allowing you to add another home router after it which is completely under your control and let the ISP-provided one only do the most necessary, eg. (DSL modem / ONT) parts.
- LoganDark 4y ago
  > add another home router after it which is completely under your control and let the ISP-provided one only do the most necessary, eg. (DSL modem / ONT) parts. Oh absolutely, I used that trick once in order to use a router that I could configure over web interface instead of Over The Cloud With A Spyware Mobile App (aka Internet Of Shit). Unfortunately my ISP smartened up to this and started cutting the line whenever I tried to use my router. Like, it would work for a while, then they'd shut off service, and it wouldn't work anymore (even if I removed my router) until I called them up and complained. They would act oblivious like the problem was with my equipment. Every time I asked them why my internet stopped working they would say there was some problem with my hardware. The hardware was brand new and could not have been more fine; they were mistaken. It would also work perfectly when I actually had service; the issue was the ISP kept cutting it because they're petty bastards. Eventually I gave up, which is probably what they wanted, but it's not like I'm suffering too badly with their equipment, even if I have to use a rooted phone in order to pry away all the spyware permissions from their stupid app. They are a monopoly so I have no choice.
  - bee_rider 4y ago
    Wow, I hate Comcast like everyone else, but even they are not that bad. That is just ridiculous. If I couldn’t have my own modem and own router… I dunno, they have a local monopoly, but I’d start looking at 5G connections or something.
    - deleted 4y ago
      [deleted]
  - radicaldreamer 4y ago
faeriechangling 4y ago
That's why a firewall I own is in-between my ISP provided equipment and my computer.
- LoganDark 4y ago
  Yeah, my computer has an application firewall[0] between it and anything that tries to connect to it (LAN or not), so if my router ever opened up my ports, I would know. Same applies for my other two computers (my MacBook runs Little Snitch on 10.14, so it's a kernel extension that Apple can't bypass). Not the rest of my devices though. Though it's not like anyone could get through fail2ban on my server, or compromise my Android device, or hack any IoT devices since I own none, etc. [0]: https://safing.io https://safing.io

deleted 4y ago

[deleted]

freshocean 4y ago

finally, after switching to 5GHz WiFi was the Zoom problem resolved? asking because: Your comment reminded me of one article / discussion about Apple Devices causing huge network load , and hence delays, due to some map ping thingy. [Apple Maps location scan spikes WiFi latency every 60 seconds. 677 points, 172 comments] https://news.ycombinator.com/item?id=31356730 https://news.ycombinator.com/item?id=31356730 (I hate the '5G WiFI' that most ISPs seem to be calling it everywhere. )

esalman 4y ago
We don't have any apple products actually. Three Lenovos and a Razer. My wife is still on WiFi most of the time and she hasn't experienced much issues. But my impression is that we always has 5G WiFi enabled. Still not sure actually what AT&T support did, but if there was an issue it was most likely fixed by the router reset.

froggit 4y ago

Aighht... basically, that's kinda like, you know, REALLY bad... Tbh, it'd been way less damaging to your security posture if instead they went like : "yeah... we're gonna have to go ahead and reconfigure your home to operate in passthrough mode. This is going to require techs onsite so we went ahead and deployed some generic subcontractors. What they have to do there is, well kinda counterintuitive. They will be using brute force techniques to uninstall and didpose of ALL of your doors. So.... there's a bunch of little wireless packet things, like the kind use for 5G, or the other 5G, flying around everywhere. They always bounce off things and they get lost a bunch. Now that home passthrough mode is enabled, the packets can just 'pass through' and get where they wanna be. Sometimes other things, like humans, or ocelots, 'pass through' too. How exciting! After all, at ATT no one gives a ** if all kinds of critters go through your crap whenever we 'fix' something. " When your ISP screws up your router settings: 1) It's highly likely you won't be aware there's a major security problem with your network. 2) potential attackers include, but are not limited to, massive numbers of ill-intentioned, yet impossible to identify, individuals quckly become aware there's a major security problem with your network. When your ISP performs a literal brute force attack on your domicile, leaving you completely doorless: 1) You KNOW, 100%, that there's a major security problem. Your doors are gone. No doors. The physical equivalent of a router in passthrough mode. 2) Potential attackers are within a relatively limited geographic area, with numerous ways to learn more. They've likely noticed that things in your home life have been a bit weird.

tlavoie 4y ago

I prefer to treat my ISP-supplied equipment as foreign territory, so their modem is in passthrough mode on purpose. Its only client is my own standalone firewall, since I have its Wi-Fi turned off. As long as I'm not messing with the network, it's all great, and I know where to start looking if there is odd traffic going on.