Router Security ISP Routers Website by     
Michael Horowitz 
Home | Introduction | Router Bugs | Security Checklist | Tests | Resources | Stats | About | Search |
 

In my opinion, you are safest using both a modem and a router that you purchased on your own. That is, avoid equipment from your ISP. I say this for a number of reasons:

As to the last point, some ISPs charge a rental fee for the box they provide, be it just a modem or a full fledged gateway. Buying your own will pay for itself soon enough. Time Warner customers looking to buy their own modem can purchase one from this list or this one. Comcast users should review mydeviceinfo.comcast.net.

Another big security issue involves remote configuration of the router/modem provided by an ISP. Assorted mechanisms used by ISPs to update their devices in your home or office have been abused by bad guys to hack the devices. One remote update mechanism is a protocol with two names: TR-069 and CWMP. More than once, bugs in this protocol have been abused.

In November 2016, about 900,000 customers of Deutsche Telekom were knocked off-line by router problems. My blog on this attack, which started with a new variant of the Mirai malware, detailed the mistakes ISPs made to get to the point where Mirai could cause so much damage. They left an open TCP/IP port undefended, and then quickly blocked it once the s..t hit the fan. Some ISP-supplied routers were running a TR-064 server that was open to the public, a huge configuration mistake. And, some routers locked up when the had to deal with the many incoming connection attempts created by the malware.

Lucian Constantin, of IDG News Service, has been covering routers for Computerworld, PC World and others for a few years. On June 2, 2015, writing in ITworld, about a bunch of router flaws he said:

"Past research has shown that the security of ISP-provided routers is often worse than that of off-the-shelf ones. Many such devices are configured for remote administration to allow ISPs to remotely update their settings or troubleshoot connection problems. This exposes the routers' management interfaces along with any vulnerabilities in them to the Internet, increasing the risk of exploitation. Even though ISPs have the ability to remotely update the firmware on the routers they distribute to customers, they often don't and in some cases the users can't do it either because they only have restricted access on the devices."

In December 2016, Scott Helme wrote My Ubiquiti Home Network about upgrading from consumer routers to Ubiquiti. But, he lead with his thoughts about ISP provided equipment.

"I've never used the equipment provided by my ISP and have always used my own ... I've always been a bit of a tech geek and I like having things with extra features ... but there are some other more genuine needs. ISP (Internet Service Provider) provided equipment usually has one main factor driving the choice of hardware, cost. They want it to be as cheap as possible because purchasing the device and giving it to you is eating into their profits ... low cost usually means low quality in other areas than hardware too, like security. My previous ISP, EE, sent me a BrightBox router when I signed up that [had] several serious security vulnerabilities ... Following their (very late) patching efforts there were yet more vulnerabilities. I could go on and on listing the issues with ISP kit, a story even popped up on The Register about 1 million German routers being compromised whilst writing this blog, but I think you get the idea. This isn't to say other hardware will be perfect, of course it won't be, but I'd seen enough and wanted rid."

An example of ISP incompetence comes from the TR-069 protocol many use to manage their devices in your home/office. A story, by Lucian Constantin back in August 2014 is frightening. See Home routers supplied by ISPs can be compromised en masse. As of 2011, there are 147 million TR-069-enabled devices online listening on TCP port 7547. These devices communicate with Auto Configuration Servers (ACS) operated by ISPs for assorted network management tasks. Many times a router can not close the port. If an attacker hacks into an ACS server then lots of bad stuff can happen. According to Shahar Tal, a security researcher at Check Point Software, ACS servers can be easily taken over by bad guys. The TR-069 specification recommends the use of HTTPS but he found that insecure HTTP is used about 80 percent of the time, opening routers up to man-in-the-middle attacks. TR-069 requires authentication from the device to the ACS, but the username and password is typically shared and easily extracted. Check Point also tested several ACS servers and found critical remote code execution vulnerabilities in them.

HD Moore, chief security architect at Rapid7, and the creator of Metasploit, also weighed in on this on June 17, 2015. Rapid7 runs Project Sonar, which scans the Internet for vulnerable devices. They find that things are getting worse. On reason, cited by Moore is "that a few dozen Internet service providers are rolling out broadband devices such as home routers without properly vetting or properly configuring the security..."

Besides security, there is the issue of honesty. Time Warner Cable, a.k.a Spectrum and Charter was sued in New York State in early 2017 for lying about the download speeds their customers were getting. In The Alternate Facts of Cable Companies Harvard professor Susan Crawford writes
"Based on the company's own documents and statements, it appears that just about everything it has been saying since 2012 to New York State residents about their internet access and data services is untrue. And not untrue in some grey, shadowy way - just untrue. The company's 2.5 million New York subscribers (of its 22 million nationwide) have been told they are getting X (in terms of download and upload speeds) when actually they are getting a lot less than X."
How was Charter/Spectrum/Time Warner Cable cheating? Three ways:
" ... squeezing more households into an inadequate number of narrow, shared neighborhood data connections; squeezing connections between Spectrum's network and other networks; and squeezing consumers who should have gotten upgraded household equipment.
One advantage of the new consumer focused mesh routers, like eero, AmpliFi and Google Wifi, is that the routers themselves can run speed tests. Eero seems to do one every day. AmpliFi keeps a history of the speed tests, so trends are easily spotted. Eero does not keep a history.

Finally, there is a big difference between routers so don't expect to buy the perfect router for your needs right out of the box. If possible, buy a router from a place that will take it back.



Top 
This page was last updated: February 22, 2017 11AM CT     
Created: June 4, 2015
Viewed 8,080 times since June 4, 2015
(12/day over 665 days)     
Website by Michael Horowitz      
Feedback: routers_at_michaelhorowitz.com  
Changelog
Copyright 2015 - 2017