BT modems have NSA/GCHQ back-door, claim researchers

[Arthur]

Don't forget to put your tin foil hat on before reading this!

 

Source: Cryptome (via Bit-Tech)

 

BT has been accused of hiding a government back-door in modems provided to broadband customers by a team of researchers who claim the company is not alone in providing such access to supposedly-private home networks.

 

The document starts by quoting a piece by noted cryptographer Bruce Schneier written for the Guardian, which states in part: 'The NSA also attacks network devices directly: routers, switches, firewalls, etc. Most of these devices have surveillance capabilities already built in; the trick is to surreptitiously turn them on.'

 

The pseudonymous team then goes on to claim that they have the 'first independent technical verifiable proof that Bruce Schneier's statements are indeed correct.' Starting with a précis on the traffic capturing system believed to be used by the US NSA and the UK Government Communications Headquarters (GCHQ), the team make a bold claim: 'BT Broadband equipment contain [sic] NSA/GCHQ back doors.'

 

Gaining local access to the BT Broadband modem provided to customers using a USB serial cable wired directly to the motherboard, the team claim to have discovered a hidden virtual local area network run by the modem and connecting it directly to the NSA and GCHQ's data capture network. Not visible using any LAN-side package capture tools, nor from the connected router's administrative page, the network presents all ports to the VLAN without restriction - providing the ability to, for example, insert false entries in the DNS table as part of a man-in-the-middle attack, to access computers on the LAN side of the modem, or even to mirror all outgoing and incoming internet traffic across the VLAN for capture - a mode it is claimed to use by default.

 

http://i.imgur.com/iQvgzyL.png

[mjs_mjs]

very interesting idea - what's to stop them doing the same thing upstream anyway?

[CAM]

Wonderful, guess what I have at home! They also told me I needed to use the Homehub and router they supply and not my own.... :/

[elsiegee40]

Oh . I can't wait for this to hit the tabloids. My father in law, an Express reader, buried his old modem in the garden when it failed in case someone used it to extract private information about him. I must suggest the tinfoil hat to him for protection Edited December 26, 2013 by elsiegee40

[mjs_mjs]

I wonder how hard it would be to verify the finding of this?

[Norphy]

Wonderful, guess what I have at home! They also told me I needed to use the Homehub and router they supply and not my own.... :/

 

I'm using my own router with BT Infinity. As long as it supports PPPoE, it'll work

 

You still need their VDSL modem of course...

[sted]

I'm using my own router with BT Infinity. As long as it supports PPPoE, it'll work

 

You still need their VDSL modem of course...

 

if you have one mines a home hub 5 straight to the socket no other boxes