Hidden NSA/GCHQ VLAN in British Telecom Customer Routers

Even if BT or GCHQ/NSA were altering routing tables, it doesn't really change the threat model of "assume Internet connections will be MITM'd". It does concern me that it appears inbound connections to LAN devices are unrestricted from this hidden VLAN, potentially allowing the ISP or its agents direct access inside most peoples' primary network security perimeter. But I suppose this is really no more dangerous than the remote firmware "upgrade" facility found in this and many other consumer network devices. Best practice is certainly to run your own, separate, firewall and wireless AP built as much as possible on trusted FLOSS.

In any case, despite claims that, "At this point the attacker has complete control of the modem and your LAN, extra firewall rules are added the moment the ptm1.301 VLAN device is enabled by the dhcpc command", they annoyingly did not list those firewall rules.

I also do not think their claims of Tor subversion hold water. From what I understand of Tor, directory information (including nodes' key fingerprints) is ultimately verified by the hard-coded keys of very few "trusted" operators of authoritative directory servers. So long as the Tor software isn't compromised, no MITM, regardless of where it's effected, will be able to subvert the user's circuit construction (of course, barring bugs in Tor and exploits higher up in the software stack). At least, that's my understanding.