5 ms·

also, yet another reason I don't trust (and don't use) any ISP provided equipment. Remote administration from my ISP? No thank you.

whatwhaaaaat 2y ago
Even if you buy your own modem they can push firmware to it (and do). The config file your modem downloads includes a cert that allows the isp to do this. You can flash special firmware (used to be called force ware) to prohibit this.
- akskakskaksk 2y ago
  Is it safe enough to buy a separate router and put the ISP modem on the "internet" side of it?
  - jraph 2y ago
    I think the attack described in the article is still possible in this setting, where the modem is in the middle of your unencrypted http traffic. This is true of any equipment belonging to the isp However, I would assume no unencrypted traffic is safe anyway, and the modem would indeed not have access to your internal network.
  - whatwhaaaaat 2y ago
    It depends. The tr069 managed devices are typically router wifi combo type devices. If you can get a dumb modem that would would likely remove any tr069 vulnerabilities. The firmware on whatever is doing docsis is going to be updatable by the ISP generally. Two different mechanisms. The tr069 management and snmp triggered firmware upgrade
- ipython 2y ago
  You're assuming DOCSIS. I'm on FTTP, where the demarcation point is a cat5 cable to my equipment. Granted, there could be chicanery on the optical terminal, but that still doesn't provide my ISP visibility into my internal network.
paulsef 2y ago
[dead]
accrual 2y ago
How about putting the ISP supplied modem in a DMZ? Then the ISP could admin it all they want but still never touch the LAN.
- bennyp101 2y ago
  So open it up to anyone? DMZ is an open target, not what you want to be doing.
  - ipython 2y ago
    It’s more about protecting your network against a potentially malicious device rather than protecting the device from attackers on the Internet. From that position, placing the isp device on a “DMZ” aka outside your own router/firewall, makes perfect sense.
- autoexec 2y ago
  That's pretty much the way to go. Keep the ISP modem, but connect it to your own router/firewall and connect your devices to your hardware and not the ISP modem.
moooo99 2y ago
I get the perspective, but I also like the fact that ISPs do take over some of the admin burden associated with running a piece of equipment like a router. You, I and most of the HN crowd may be well capable of maintaining a reasonably secure state of our own hardware and troubleshoot our way through common errors. However, the average internet user isn’t that experienced nor are most people interested in learning those skills.
- ipython 2y ago
  I have a feeling the OP ... has the skills to manage his router :) but point well taken in general.

whatwhaaaaat 2y ago

Even if you buy your own modem they can push firmware to it (and do). The config file your modem downloads includes a cert that allows the isp to do this. You can flash special firmware (used to be called force ware) to prohibit this.

akskakskaksk 2y ago
Is it safe enough to buy a separate router and put the ISP modem on the "internet" side of it?
- jraph 2y ago
  I think the attack described in the article is still possible in this setting, where the modem is in the middle of your unencrypted http traffic. This is true of any equipment belonging to the isp However, I would assume no unencrypted traffic is safe anyway, and the modem would indeed not have access to your internal network.
- whatwhaaaaat 2y ago
  It depends. The tr069 managed devices are typically router wifi combo type devices. If you can get a dumb modem that would would likely remove any tr069 vulnerabilities. The firmware on whatever is doing docsis is going to be updatable by the ISP generally. Two different mechanisms. The tr069 management and snmp triggered firmware upgrade
ipython 2y ago
You're assuming DOCSIS. I'm on FTTP, where the demarcation point is a cat5 cable to my equipment. Granted, there could be chicanery on the optical terminal, but that still doesn't provide my ISP visibility into my internal network.

paulsef 2y ago

[dead]

accrual 2y ago

How about putting the ISP supplied modem in a DMZ? Then the ISP could admin it all they want but still never touch the LAN.

bennyp101 2y ago
So open it up to anyone? DMZ is an open target, not what you want to be doing.
- ipython 2y ago
  It’s more about protecting your network against a potentially malicious device rather than protecting the device from attackers on the Internet. From that position, placing the isp device on a “DMZ” aka outside your own router/firewall, makes perfect sense.
autoexec 2y ago
That's pretty much the way to go. Keep the ISP modem, but connect it to your own router/firewall and connect your devices to your hardware and not the ISP modem.

moooo99 2y ago

I get the perspective, but I also like the fact that ISPs do take over some of the admin burden associated with running a piece of equipment like a router. You, I and most of the HN crowd may be well capable of maintaining a reasonably secure state of our own hardware and troubleshoot our way through common errors. However, the average internet user isn’t that experienced nor are most people interested in learning those skills.

ipython 2y ago
I have a feeling the OP ... has the skills to manage his router :) but point well taken in general.