BTAgent – CPE backdoor

Re:BTAgent – CPE backdoor by samcrawford on Saturday November 01, 2014 @05:58AM (#8542623)

I was initially interested when I first saw this last year, but it turns out to be complete FUD. See http://www.revk.uk/2013/12/paraniod-ravings.html for the take on the original disclosures from the MD of one of the UK's most technical ISPs (and believe me, he's no fan of BT's).

In a nutshell, some ISPs will effectively hijack publicly routable ranges for internal use if they know that there's no way those addresses will ever be used for real public services. In this case, a UK ISP is re-using the US DoD's 30.0.0.0/8 network. Anecdotally I've heard the inverse is also true (US ISPs use UK MoD ranges).

[ Parent | on HN ]

Re:BTAgent – CPE backdoor by heromat on Saturday November 01, 2014 @08:51AM (#8542869)

No matter if he's right or not: it can't hurt to set up an additional firewall. TR-069 is scary enough.

[ Parent | on HN ]

Re:BTAgent – CPE backdoor by Moral_ on Saturday November 01, 2014 @12:00PM (#8543481)

Yeah, I packet captured what TR-069 (on my Actiontek C1000A) was sending to CenturyLink every day it included:

All the Mac address associated on the network.

The username/password to my router.

All the names of the computers associated on the network.

My WPS pin.

My SSID Name.

My WPA2 Password.

My old WEP Password.

How long each computer has been on the network.

Amongst other things.

It was pretty scary. Luckily I have root on the device, tr69 is no longer alive

[ Parent | on HN ]

Re:BTAgent – CPE backdoor by pyre on Saturday November 01, 2014 @12:07PM (#8543514)

Another example (Rogers Internet, Canada): The first hop after my router is IP 7.11.163.13 which is owned by the DoD.

[ Parent | on HN ]