Re:Full Disclosure: The Internet Dark Age [pdf]
by mindslight on Saturday December 14, 2013 @02:24PM
(#6906736)
From the terminal sessions, it seems like they're basically describing an IP management interface for a unit that is presumed to be doing modem only (have no IP), and characterizing things in the most sensationalist way possible.
Of course the default gateway is close - it's the next IP hop. If it's indeed being used as a NSA/GCHQ backdoor, the actual attacker is at a different address.
Traffic snooping is surely much easier to implement upstream, and your ISP is indeed upstream of everywhere, despite what this paper alludes to.
As far as a branching off point for attacks on your network - given that this seems to be a modem-only unit, there's still your router between it and your local network. It seems that its attack surface remains the same as for a dumb PPPoE translator.
edit: Actually they could be describing an entire modem+router combo, but an error in saying the lan PC initiates its own "PPPoE" request threw me off. The interfaces look like a multi-port router (in the one's I've seen, the CPU usually has one ethernet interface which goes into the port of a vlan-capable switch). Really, the lack of showing what the complete config looks like when the user's PC is online makes it hard to see what they're actually getting at.
The only actual suspicious thing presented here is the specific 30/8 IP address, and perhaps that has another explanation (address reuse?). Independent verification is needed, but definitely not using their flawed "Method 2" which clearly changes your modem's complete setup :P.
Of course the default gateway is close - it's the next IP hop. If it's indeed being used as a NSA/GCHQ backdoor, the actual attacker is at a different address.
Traffic snooping is surely much easier to implement upstream, and your ISP is indeed upstream of everywhere, despite what this paper alludes to.
As far as a branching off point for attacks on your network - given that this seems to be a modem-only unit, there's still your router between it and your local network. It seems that its attack surface remains the same as for a dumb PPPoE translator.
edit: Actually they could be describing an entire modem+router combo, but an error in saying the lan PC initiates its own "PPPoE" request threw me off. The interfaces look like a multi-port router (in the one's I've seen, the CPU usually has one ethernet interface which goes into the port of a vlan-capable switch). Really, the lack of showing what the complete config looks like when the user's PC is online makes it hard to see what they're actually getting at.
The only actual suspicious thing presented here is the specific 30/8 IP address, and perhaps that has another explanation (address reuse?). Independent verification is needed, but definitely not using their flawed "Method 2" which clearly changes your modem's complete setup :P.