Orange Livebox ADSL modems are leaking their WiFi credentials

Re:Orange Livebox ADSL modems are leaking their WiFi credent... by lucb1e on Sunday December 23, 2018 @12:20PM (#18747154)

> it only does modulation-demodulation on Layer-1/2 with little attack surface

The simplest of them have a webinterface. If that's leaky, there goes the whole thing because any website can try to connect to it.

[ Parent | on HN ]

Re:Orange Livebox ADSL modems are leaking their WiFi credent... by segfaultbuserr on Sunday December 23, 2018 @01:22PM (#18747490)

Well, sure, but it depends, in practice the security risk is smaller.

I've seen many modems with a web interface, but it's often not routable to the public Internet in actual use, as the connection was bridged and the job of getting a public IP has been delegated to the PPPoE connection on the router behind it (You need to add another network interface, assign a IP address on your router inside the LAN segment under the control of the modem to reach it).

Some modems have a management link, it can be described as an universal ISP backdoor, only reachable in the ISP's LAN.

But in both cases, it's still better than a modem/router combined unit.

[ Parent | on HN ]