The problem gets worse when thing aren't just routers, but modems from your ISP. Unlike routers, which you are free to replace it (or install OpenWrt), using a modem is mandatory, and it's very likely that there is no alternative. Even if the modem uses a standard protocol like DOCSIS internally, it either has some vendor-lockins or proprietary/customized software by ISPs.

A few years ago, I got my optical cable modem from my ISP, and I immediately found that the real admin account was locked from me, only accessible by the ISP. So I couldn't just PPPoE and gets my connection, but I had to use the NAT on the modem. After a quick websearch, I realized there are plenty of ISP/OEM management interfaces and backdoors in the modem. Although the documented backdoor has been disabled, I eventually found my way to a root shell, so I could change the mode to bridged w/ PPPoE.

Meanwhile, I always use my own router behind the modem, with an additional firewall blocking all the incoming connections from the modem's IP address. I absolutely don't have the slightest trust on these modems. If I cannot change the modem, at least I can isolate the problem away from my routers (and use encrypted protocols as much as possible). Attackers are free to execute arbitrary code on my modem, I'll simply treat the modem as part of the untrusted Internet, which can be as dangerous as a hacked modem.

Letting the attackers be 'mittle in the man' is little bit too generous especially on dns side

Your ISP is has a MITM position whether they own your cable box or not¹. What you usually don't want is them having access to your LAN.

¹ As far as is relevant in this context.

You are unfortunately right about the reputation of SOHO routers and modems. The programming required to correct this issue is rather trivial, so hopefully patches should be easy to roll out.

The unfortunate thing, is how the code has propagated from Broadcom across many vendors to even more ISPs, and how getting in touch with every affected ISP is a bit of a mess. Hence our attempt at branding, as this has a better chance of getting non-technical focus, which seems to be the way to reach many ISPs these days.

If you have fiber you're probably plugging your SFP into an ONT which is already acting like a modem anyway.

> With cable this becomes a lot harder or even impossible due to all kinds of network specific systems such as DOCSIS.

You're probably on a PON which doesn't use DOCSIS exactly but it's still doing TDM and/or WDM multiplexing because you're sharing a laser diode with a bunch of your neighbors - the ONT transceives the multiplexed laser signal. You're still dealing with DOCSIS-like functionality.

By my reckoning, as long as the modem has no public- or customer-facing IP address, it's probably not going to be a vector for easy attacks. It might be accessible from within the ISP network, but if someone has access there then they can probably just tap your line directly, no need for additional exploits.

ONTs typically terminate to Ethernet at the customer premises so it's effectively the exact same thing as a cable modem. So not any more secure than having cable and using the cable company's provided modem.

If you tapped someone's fiber line, all the traffic between the ISP headend and customer premises (OLT and ONT if we're talking fiber) will be encrypted. In fact on a PON network using TDM it has to be, because if you stared down your own fiber you would be seeing all your neighbors' traffic as you're all time-sharing the same laser diode at the ISP headend (because it's a passive network, you will be seeing your neighbor's traffic when the diode is transmitting outside of your designated time cycle).

Anyway my only point was to inform OP that contrary to their belief, they effectively are in the situation of having an ISP-owned modem.

When I was setting this up for an ISP a few years ago the TDM was just a SFP that has its own MAC address inside. Its doing the TDM part inside the SPF itself. When we configured a new customer it was just adding the MAC to the config of an interface on an alcatel router at the hub side. You might not be able to transmit without interference but I bet you could spoof the MAC of a neighbor on the same fiber and listen in.

Wow that is very interesting! That would be a worthwhile experiment to test out for sure.

In the case of Openreach in the UK, the majority of subscriber lines carry PPPoE traffic over VLAN 101 which is bridged on the modem to the consumer equipment.

There's also an additional VLAN 301 for TR069 management traffic, which is used by the HG612 modems (and possibly others) that Openreach used to enjoy flinging at all VDSL subscribers. The modem itself claims an IP address in this VLAN.

Although usually hidden from the end-user, it's actually surprisingly easy to drop yourself onto VLAN 301 even with the HG612 and get an IP address on that management network. I imagine that this is the kind of way that modem exploits become dangerous if they are indeed routable on networks like this.

Can you recommend any resources to learn more about this kind of stuff?

NANOG.

https://www.youtube.com/watch?v=__wn9zXFiy8

Most countries allow you to own a modem, and that’s why all the major retailers sell them. They are not property of the ISP. Only the ISP can upgrade them however.

You make it sound like the providers giving you a modem is a bad thing. This is a good thing. You as the consumer just needs to buy a decent router, and it's your ISPs responsibility to maintain the modem. If you have a decent router you have nothing to worry about. You can simply consider an attack on your modem an attack on your ISP.

All ISPs I've ever seen in the US allow you to use your own router.

At a $5+/mo fee for items that normally sell for $60 it seems like profit seeking behavior.

Comcast at least now made equipment returns easier though ups franchises, historically, it could take hours at an under staffed, low budget facility to return a item. And if you didn't you'd often expect to argue with collections.

Here's a fun trick Comcast is now playing with in Chicago. For unlimited data, it costs $50 a month if you're using your own modem, but using Comcast's modem, I get a "discounted" rate of $20 a month including the modem rental.

It's their way of charging me to use my own modem (which I believe is illegal), hidden behind the ruse of it being a discount to rent theirs.

Comcast in Washington is $10/mo

5/mo is 120 over 2 years, which is imo the expected life on a modem. Now of course some last 5 years or more, but then some last 6 months. I think 60/year is a decent price for a 100 percent satisfaction guaranteed working modem.

> which is imo the expected life on a modem

Then buy better modems. My current modem is 4 years old and functions as well as it did on day 1.

If they weren't making money on it they wouldn't sell it to you as an option. Sure the "insurance" might be nice, but overtime they're making money off of you.

> for a 100 percent satisfaction guaranteed working modem.

Importantly, the company I mention historically had such a bad satisfaction experience that it was rated lowest for customer experience. Such issues that they rebranded. With their contractor model it was regularly the experience of customers that the install goes through 2 or 3 cheap cable modems until one worked; in combination with their Mac locking, dns poisoning data caps, almost daily scheduled downtimes.

Though I'm still not sure how it's a decent price to pay $120 for something that retails for $60.

Satisfaction guaranteed. Don't like the service? Move along, you're out very little/nothing.

This would be a good argument if:

* there was any choice in the market * my satisfaction was actually guaranteed * The cost of switching was low (it will take at least a day of coordination to end one service, and start the second)

Where are you living where modems die every 2 years? My cable modem/wifi router from ISP is about 5 years old. Can't use your own cable modem in UK. They don't list providing of the modem as a line item on the bill either

Officially the EU requires allowing customers to use their own modem if they want to. If the ISP setup requires registering MAC addresses they are obligated to register your personal modem and if a weird setup is required they have to document everything and notify you in advance of changes.

Do you have any more details about this? A link or what to search for would be also great.

The directive is 2008/63/EG.

https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32...

Can only see one example of someone asking about that on google.

I do not understand what you mean by that. Note that these directives force the member states to adopt their own laws implementing them. They do not directly affect people, only indirectly. So if people want to invoke the rights they have to cite the national law implementing the directive.

The response in the UK is always "you can't do that", so either the UK hasn't implemented the law, or no one cares

The directive stipulates some authority who enforces the rules.

It’s quite possible that, similar to the situation in the Netherlands, the rules don’t align with the opinion of the appointed authority and any appeal is nullified by an endless stream of denials and delays.

For a truly determined citizen or group it would be possible to work through the national and European legal system and force the authority to do its job but it takes a very long time and a lot of money and determination.

Likewise, you make it seem like ISPs are competent enough to recognize an attacked modem, and repair or replace it on demand, and promptly. My experience is that when your internet connection goes down or becomes unusable, and you call and complain, it can be literally several weeks before they even respond to you.

They may technically own the modem but you’re in your own to keep it running.

> competent enough to recognize an attacked modem, and repair or replace it on demand

The cable modems I've interacted with all seem to be immutable infrastructure: their state consists of 1. a signed firmware image; 2. a DOCSIS initialization packet received upon network registration (essentially equivalent to a cellular "carrier profile"); 3. a set of saved preferences; and 4. some volatile working state, like ARP tables or WPA encryption-stream key state.

#4 gets trashed on reboot; #3 shouldn't be large enough (or executable) in a way where programs can run from it; #2 gets overwritten every time the network reconnects; and so the only place to put a persistent malware vector should be #1. And #1 can only be written to using signed code (sort of like Intel CPU microcode.)

So what's the problem that can't be solved by rebooting the modem?

Not my experience. My parents are stuck with Comcast due to their monopoly and even they bend over backwards to fix my parents recent issues (hardware failure). Sure it took a couple weeks, but it a couple weeks of troubleshooting, testing, a couple visits, some hardware replacements. People expect these repair installers to be miracle workers, but sometimes an intermittent fault takes time.

> You can simply consider an attack on your modem an attack on your ISP.

Never thought about it that way. I agree.

> All ISPs I've ever seen in the US allow you to use your own router.

I'm not familiar with the US market, I was speaking from my personal experience with EU based ISPs. I should have made that clear.

In the USA, you can use your own router and your own modem, if you are aware enough to do so. Most common people just use whatever the ISP hands them, and pay $5 per month or more for years on end for the privilege of using boxes that never get updated.