A pure DSL/cable/fiber-optics modem is relatively okay, assuming it's a sane unit, it only does modulation-demodulation on Layer-1/2 with little attack surface. The bad thing is nowadays they usually came from the ISP as a modem/router combined unit, and neither the performance nor security is ideal.

I always see an ISP-provided router as a hazardous & untrusted device. If it offers bridged PPPoE, I would configure it so it works as a pure modem, even it means breaking into the telnet console. Otherwise, I would rather put my own router behind it, double-NAT and firewall it out of my own network.

In Germany, the Choice and Connection of Telecommunication Terminal Devices Act have been passed with the support of free and open source community, which ensure a user can use their own router to connect a broadband network.

https://fsfe.org/activities/routers/timeline.en.html

If you live in/know about Germany, could you suggest a good alternative to the Kabel Deutschland basic CBN router? I have no clue how the registration to the network would work if I buy a third party router connected directly to my cable input.

You can register the modem via a web portal during the first connection. After a few days you get the activation code via snail mail. But third party cable modems are expensive in Germany. You can also use the provided modem in bridge mode and use a better router behind hit.

That works with KD? Fking unitymedia removed bridge mode from their firmware. :(

I recommend the bridge mode + a better router solution.

We got a DSL login per email a few weeks before the connection became active. Went to the router's admin panel and filled them in under "Internet connection". Once the link came up, Internet worked.

> it only does modulation-demodulation on Layer-1/2 with little attack surface

The simplest of them have a webinterface. If that's leaky, there goes the whole thing because any website can try to connect to it.

Well, sure, but it depends, in practice the security risk is smaller.

I've seen many modems with a web interface, but it's often not routable to the public Internet in actual use, as the connection was bridged and the job of getting a public IP has been delegated to the PPPoE connection on the router behind it (You need to add another network interface, assign a IP address on your router inside the LAN segment under the control of the modem to reach it).

Some modems have a management link, it can be described as an universal ISP backdoor, only reachable in the ISP's LAN.

But in both cases, it's still better than a modem/router combined unit.

In Orange case, I opened a previous livebox model and it was built by Sagem. The board also looked to be nice grade PCB manufacturing (to my noobish eyes at least, but you can tell by the materials, sturdiness, layout etc that it's not the cheapest by far).

Maybe they went for offshort design/manufacturing, that's plausible since most box~ are now mediacenters so basically 80% like any internet tv box on ebay.

Most of the various Livebox versions have been made by Sagem, I believe, but they have used others as well, such as Inventel and Thomson.

Don't know how custom the hardware is, but the firmware appears to be.

Can confirm. One of our customers (we're a security firm) was about to ship their modem/router with some firmware on it of chinese origin. The quality of the code (not just security bugs, but just bugs) was astounding. A colleague picked three lines of code at random, not even looking for a particularly bad part, to explain how this had multiple vulnerabilities. He identified four at first glance. Upon reviewing the report internally, we found two more. Six security vulns in three random lines of code. It was truly astounding.

Lots of them were mitigated due to other bugs preventing you from actually reaching the code when you pass funny input, or the code turns out to be unused (random unused code in your binaries is a big code smell). It was functional: they clearly made sure it all worked. But if you would try to do anything outside of the happy flow, it would bug. The customer also had quite a fight over getting the source code (instead of binaries) in the first place.

In the US, the major players use Arris Modems and Gateways.