A lot of ISPs will perform remote diagnosis by connecting into your router and scanning your internal hosts to see if there are any problems.
Between that capability and general appalling security of routers, you’re basically on Starbucks WiFi from a security perspective even at home.
important note: buying an off the shelf netgear/tplink/linksys/whatever might stop your ISP remoting in, but is still wildly full of vulnerabilities.
However, I gave up on consumer hardware and went with Ubiquiti for wifi AP and Mikrotik as my router. It was a bit of a pain to set up all my NAT rules in the Mikrotik router because unfortunately consumer devices do a lot of extra work behind that scenes (like setting up NAT reflection) to facilitate having NAT work painlessly. I'm perfectly content with the end result now though.
http://www.pcengines.ch/apu3a4.htm
It has 3 NIC's, for inside, outside, and DMZ. You can also put a wifi radio on it, and make it an access point.
I run a full Ubuntu on it, with local DNS, DHCP, Shorewall, etc.
I like PF a lot more than IPTables. I've found it to be far simpler to configure.
These days, you can rely on Linux on fairly low-end CPUs to handle a gigabit of traffic, including IPv4 NAT, IPv6, firewalling, DHCP and DNS.
For serious firepower, Jetway sells a 10 x 1 Gbit tiny fanless machine with a J1900 Celeron and up to 8GB of RAM, under $400 (without RAM or disk). All most people need is 2 gigabit ports and maybe a good WiFi interface -- although I prefer to scatter consumer WiFi boxes around my house in bridge mode.
It's not too fancy (but getting fancier as updates are delivered) and does the job well. I wasn't satisfied with the VPN options, so I port-forward to an internal host and set up static routes as required.
1. They offer "IP Passthrough" which is fake Bridge Mode. They still do routing and you'll still hit NAT table limits of 4096. Connection falls apart for anything over 3000.
2. You can dump and reverse the router-gateway firmware and 802.1X/EAP authentication. Oh goodie.
3. There's a history of exploits for the NVG510, NVG589 and NVG599. Try your luck. [1] [2]
4. Create some "magic" to split the 802.1X and untag VLAN0. Works in Linux at least. [3]
5. But good luck if you want to do this in pfSense or FreeBSD. There's an open BTC bounty if you've got any netgraph / networking chops. [4]
[1]: http://earlz.net/view/2012/06/07/0026/rooting-the-nvg510-fro...
[2]: https://www.nomotion.net/blog/sharknatto/
[3]: http://blog.0xpebbles.org/Bypassing-At-t-U-verse-hardware-NA...
Former provider offered FTTB and I used the coaxial cable CPE as a bridge - and even when I do not have that option, I insist on having a router of my own as my network's demarcation: it is basic hygiene.
Other option for GPON would have been to plug a GPON SFP module into one of my switches - the friendly guy who laid the fiber to my apartment even left me one in case I changed my mind... But going through the switch to the router and back to the switch on a different VLAN is unnecessarily complicated in my case. Anyone wants a free GPON SFP module ?
There is a new line of EdgeRouters out and maybe it has some acceleration for bridging. I would like this setup.
You have to enable `set system offload ipv4 vlan enable` else your routing performance will suffer.
I do data analytics and data engineering and a couple of months ago indirectly I have been contacted by an ISP in Spain and they literally were collecting every bit of data that their customers were seeing on internet (websites, timestamps, how much data were transferred and etcetera with the user's id and basically in another table name and address). I was shocked how easy they were talking about it. I didn't accept but for sure someone has done it! I never heard the name of the ISP, I wish I didn't bark at them so fast and I could collect more information about them.
I'd assume if you're using their pipes, they can see what goes through it, regardless.
Genuinely intrigued in this.
This is why there is such a push for end to end encryption on web traffic, chat apps, etc.
It feels like a good compromise between privacy and speed.
(I realise this is not the subject of the article exactly but I figured it's a related issue.)
It has the happy property that the performance penalty will trend toward zero over time, as fewer and fewer holdout websites stick with unencrypted HTTP. Even Netflix streaming uses HTTPS these days.
By the end of the year I figure we'll have virtually no such holdouts. https://www.theregister.co.uk/2018/02/08/google_chrome_http_...
There are good and bad VPNs but ISPs are much larger corporations with direct ties to governments. I fail to see how a good VPN is worse than ISP + Governments.
NOTE: I'm in no way related to this company or the podcast (aside from being an occasional listener).
Episode page: https://twimlai.com/talk/107
Direct episode link: https://feeds.soundcloud.com/stream/393602724-twiml-twiml-ta...
Episode description:
In this episode I’m joined by Michel Allegue and Negar Ghourchian of Aerial.ai. Aerial is doing some really interesting things in the home automation space, by using wifi signal statistics to identify and understand what’s happening in our homes and office environments.
Michel, the CTO, describes some of the capabilities of their platform, including its ability to detect not only people and pets within the home, but surprising characteristics like breathing rates and patterns. He also gives us a look into the data collection process, including the types of data needed, how they obtain it, and how it is parsed. Negar, a senior data scientist with Aerial, describes the types of models used, including semi-supervised, unsupervised and signal processing based models, and how they’ve scaled their platform, and provides us with some real-world use cases.
Would it be ghostly figures or more like black and white photos?
[1] https://www.medgadget.com/2014/06/mits-wifi-system-detects-p... (June 2014)
[2] https://hackaday.io/project/5452-wifi-thermal-camera (2015)
[EDIT] I stand corrected, [2] is unrelated. My bad! Here's some good sources as alternative.
"MIT turns Wi-Fi Into Indoor GPS New tech from CSAIL lab lets one Wi-Fi device locate another to within centimeters" [3]
"RF-Capture: Capturing the Human Figure Through a Wall
It can know who the person behind a wall is. It can trace a person's handwriting in air from behind a wall. It can determine how a person behind a wall is moving." [4]
They also contain further resources.
[3] https://spectrum.ieee.org/tech-talk/telecom/wireless/mit-tur...
https://m.youtube.com/watch?v=rDC34awd0f8
There are a lot of people doing research in this space:
https://scholar.google.com/scholar?hl=en&as_sdt=0%2C47&q=hum...
But ignoring encryption, this is the price you pay for cloud management: the could knows your data.
That's not to say it still shouldn't be encrypted, but with a FTTH connection using a PON network there's already physical layer encryption going on typically, otherwise a custom configured ONT could snoop on other peoples traffic on the same segment.
Why would an ISP care about that?
What if technical support is outsourced to a call-center in India?
The only counter is for an adversary to own your box, which is far more expensive.
or require your clients to run your software, like in AOL days
The problem here is not that the ISP can not be trusted, you should never trust them anyway. The problem is that the ISP is using their router to force their way into what is supposed to be the trusted part of your network, your LAN.
This is exactly why I don't use the ISP provided router, and every piece of equipment of theirs I have to use (mainly the IPTV box) is in a separate, untrusted, VLAN.
That said, if you set up your own vpn on a digital ocean node, moving your network boundary to the datacentre, then the cloud hosting companies network that you end up trusting is less likely to be set up to spy on you then a consumer isp.
I get bad speed though when I do this. The processibg speed required to encrypt a connection at 300mbps just isn't there in my router.
Also, I dont rely on just the one VPN service. I use nested chains of VPNs, and so distribute trust among multiple providers. Doing business from different jurisdictions. Just as Tor does with three-relay circuits. Sometimes I use private VPNs running on anonymously leased VPS.
Finally, each of my personas uses a different nested VPN chain, or Tor (Whonix) through other nested VPN chains. So linking my various personas would be nontrivial.
Fundamentally a VPN service allows you greater control over who you trust with your traffic. You always have to trust someone[1]. For example I trust F-Secure and the Finnish court system much more than I trust Virgin Media, GHCQ and the British court system which is why I run Freedome and route my traffic through Finland. As pointed out in another subthread here UK ISP are required to collect a bunch of data by the Snooper's Charter, the same is not true in Finland.
0: https://news.ycombinator.com/item?id=16371030
1: The default for many people is their local ISP which might or might not be a good entity to trust based on where you are. In many place you also have very few choice when it comes to your ISP.
This is probably what your ISP is doing. Take your MAC Addresses, try to find the phones in your house which is connected to the wifi, take those MAC addresses to all the telecoms, get the SIM card number and the phone number associated with those MAC numberss, send those phone numbers to the banks to find matching bank accounts and the associated credit card number, along with your registered email address, get the purchase history from the bank on the credit card number, compare it with your browsing history and sell all of this to another company and make money.
Depending upon country that would be illegal. I can be reasonably sure my ISP or telco isn't.
gdpr is a nightmare for websites, because of the consent rule.
but guess what is the first thing you with a ISP. You sign a contract. done. it's all legal with gdpr or not.
For instance, BT in the UK do the same reporting over TR-069 if you use their home hub - however - if you connect a different VDSL modem/router you can disable TR-069, and if you use a dedicated VDSL modem in bridged mode and a wireless router behind that there's no TR-069 to worry about in the first place.
They said they'd look into it, but they couldn't process my claim unless they could prove something was connected via Ethernet to their router. (They apparently never trust customer WiFi speed test results, probably because WiFi on their crappy routers can be notoriously unreliable.)
I ultimately had to connect something to the router's Ethernet port, so I grabbed another WiFi router, configured it as an access point, plugged it in, and voilà, they could verify that a device was connected and processed my complaint.
Obviously customer service reps can easily get access to a list of what is connected to the router.
https://nakedsecurity.sophos.com/2012/10/01/hacked-routers-b...
https://www.welivesecurity.com/2016/10/21/cybercriminals-tar...
Your router is critical, and choosing them wisely is one of the most important things if you care about some security.
> well, who isn't?
I can understand that we all get weary from the constant news of yet another privacy intrusion, surveillance method being discovered, or new government law eroding privacy. But why be dismissive? When Snowden revealed what he knew, it confirmed what I had already suspected. But I didn't go and say, "well of course, we all knew that we were being illegally spied on us". I thought that getting the specific information was very important.
If we all use tor, it will help the tor project because then it's harder to spot individuals using it.
Tor is slightly slower, but it's pretty much a perfect browser replacement. The only reason I don't use it all the time is that I like my browser history. Plus I've got a self built VPN which is about as good as I can hope for.
I've long ago lost the PPPoE password and this same router gets it automatically somehow. When I install another router, it won't do that.
This is why you used https to hide the full URL, VPN to push the problem to a 3rd party who might care a bit more about privacy and then Tor on top of it all.
Here's the good old EFF explanation [0]
Did you read the article? The ISP-provided modem/router automatically sends an overview of devices actively connected to the router (with their MAC address, name, and whether they are currently connected) to the ISP.
This is a different issue than private browsing and using a VPN/HTTPS/Tor is not going to solve this particular problem. The solution to this problem is replacing the router or putting another router between the ISP router and your internal network to hide your internal network from the ISP-provided router.
I'd still be more concerned about my unencrypted HTTP traffic though.
Tor provides anonymity, VPN provides privacy. You want anonymity between you and the VPN, and privacy between you and internet hosts.
From the OpSec for xyz series: https://grugq.github.io/presentations/Keynote_The_Grugq_-_OP... • TOR connection to a VPN => OK • VPN connection to TOR => GOTO JAIL
[1] https://tools.ietf.org/html/rfc6108
[2] https://defplex.wordpress.com/2017/08/15/how-a-south-african...
https://www.usatoday.com/story/tech/news/2017/04/04/isps-can... ISPs can now collect and sell your data: What to know about Internet ...
I feel like the original title "Your ISP is Probably Spying On You" better describes what this post is about. Not using the original router can be due to all kinds of reasons, not just privacy
You can express your opinion about the original title in a comment. There's no need it impose this (twisted, IMO) view on everyone.
