[ Date Index ] [ Thread Index ] [ <= Previous by date / thread ] [ Next by date / thread => ]
On 05/01/14 16:41, Julian Hall wrote: > Hi All, > > Just thought this may be of interest as some list members may be on > Virgin. A friend of mine recently told me that Virgin download the > config of your Superhub from your network, which not only contains your > WiFi password etc but also the MAC addresses of any equipment you have > configured. Whilst this wouldn't surprise me in the least, do you have any better references than "my mate told me"? It's probably worth pointing out that most major ISPs have effectively 'root' access to the hubs they supply customers with, which are technically actually still their property in most cases: you're just renting them. This is how Virgin, BT, Sky, etc can forcibly push firmware updates to them on demand. I've mentioned this before several times, but you really need to keep your ISP-supplied hubs outside of your trusted network by putting something you trust in between them and your personal machines, and I wouldn't recommend hardware firewalls or off-the-shelf security appliances as they are no more trustworthy. The Snowden revelations should have adequately proved by now that Cisco, Huawei, Juniper and basically everyone else is well and truly backdoored. Needless to say I have an OpenBSD box sitting between my Virgin Superhub and everything on the inside and I like it that way - only untrusted guests (random visitors with smartphones, etc) connect directly to the wifi network supplied by the Superhub and are completely isolated from my various internal wired and wireless subnets. Whilst we're talking about the laughable state of consumer-grade router crapware, this is quite sobering and those of you with older devices might want to check yours out: https://github.com/elvanderb/TCP-32764 I have already tested against my Superhub and luckily it's at least not vulnerable to this. Regards -- The Mailing List for the Devon & Cornwall LUG http://mailman.dclug.org.uk/listinfo/list FAQ: http://www.dcglug.org.uk/listfaq