GPON FTTH networks (in)security (2016) | Hacker News Reader

GPON FTTH networks (in)security (2016)

pierrekim.github.io

58 pointspabs316 comments

I think it’s worth mentioning that this vulnerability really exists when the ISP has not separated duties of the physical devices well. Most PON networks do not use the ONU as a method of deciding which service the user should receive. This is instead usually defined by the PPPOE session and the characteristics sent by the RADIUS server. Having zero upstream authentication beyond an ONU serial number, if that, is poor and unusual network design.

If you’d like to understand more about good Ethernet based broadband network design, you should read the reference standard TR-101. This evolved from TR-099 which was the old ATM/ADSL standard.

https://github.com/Anime4000/RTL960x

The article reminds me this Github project, which using 3rd party SFP ONU connecting internet with SLID, Model, SN and other parameters.

If I shined a laser pointer through the fiber in my house, would I DOS my neighbors?

Yes, this can happen with cheap/poor splitters upstream and/or high power lasers of the correct frequency. Sending a regular red laser up the fibre will likely do nothing, however I have encountered ONUs that do not have particularly selective receive optics. Sending a laser at 1310nm or 1490nm can cause havoc.

On GPON or XGSPON, sending 1490nm on the upstream will have no effect unless you get to incredibly high power levels where they cause damage to the transmit laser on the OLT's optics for GPON (many dB higher for XGSPON). Fibre optic cables and PLC splitters don't reflect signals at significant levels (directivity is typically >= 55dB). I have unintentionally tested this by accidentally connecting 2 different GPON segments together in a splitter cabinet; nothing broke.

On GPON, 1310nm light launched at 2-8dB and 1270nm light at similar power levels on XGSPON is enough to blind the OLT from being able to receive signals from other ONUs. Risk-wise, it's the same as cable modems that can spray noise over the upstream channel. But most people aren't interested in launching DoS attacks that take themselves offline.

I've always thought access should be controlled on the ISP side, similar to how the telco can connect or disconnect your local loop from their property.

PON uses passive splitters to allow multiple access -- you can't disconnect a fibre at the office without also taking down the neighborhood you're sharing the physical fibre with. The article, as I understand it, is how it's trivial to bruteforce other sessions once you have root in the ONU.

Fiber can be connected at the PON usually, a lot of FTTH providers use splitters that are in a neighborhood. This is never done, for obvious reasons (usually the ONT is just set to a "locked" state if someone doesn't pay).

I'm not sure about how well these exploits would work on the fiber ISP I used to work - most of the protections for "bad" ONT behavior is related to the light (a laser being stuck on or something else) in which case the ONT will throw an alarm and be disconnected automatically and a technician usually goes out and replaces it, restarts it, or they fix the fiber itself.

There were some protections against malicious behavior as well, but you could certainly tell the vendor designed much more for physical issues with the ONT that could harm other customers rather than someone hacking the ONT.

(AFAIK our ONTs didn't have an HTTP interface, but they were a lot different than the ones mentioned in this write up and were controlled via proprietary vendor software - still interested to know if they were able to be owned like this)

You have to assume an ont is rooted/third party when designing pon, this is pure bad design nothing more.

OLT should inject vlans based on Mac/ID of the ONT+pon port, the only real vulnerability in ones I've designed is if someone on the same pon knows someone else's SN and thier service was subscribed but ont unplugged.

This is a fair observation, however practicalities get in the way. It’s labour intensive to disconnect and connect at Layer 0. The way Access is usually controlled is the user will be unable to authenticate their PPPOE session/receive a DHCP assignment. Some ISPs will also authenticate but send them to a walled garden. Most PON networks are deployed using connectorised terminals so if there was a malicious or faulty user that was not a paying customer, they could physically disconnect them if they needed to without getting out the splicing tools.

>Most PON networks are deployed using connectorised terminals so if there was a malicious or faulty user that was not a paying customer, they could physically disconnect them if they needed to without getting out the splicing tools.

In other words, they would send out a tech to disconnect the fiber between my house and the splitter on a utility pole somewhere in the neighborhood?

Exactly that, yes.

Doesn't that depend on where the network is demarcated, i.e. is ONT/ONU considered to be on "ISP side"?

In the UK, we are tending towards separating the FNO (fiber network owner) and the ISP. The larger FNO's will provide wholesale access to multiple ISP's. There are some smaller operators that are both FNO and ISP, but I am not aware of any provider that combines the ONT and CPE, so they could wholesale without having to replace hardware.

I know of a few, they are using Ubiquiti, TP Link, and Calix. They are however all small.

BTW, if you’re in UK altnet scene are you in… the Slack?

Reply on news.ycombinator.com