Verizon DSL Router Caught Red-Handed !

I reset all the computers and routers the way I wanted and removed the DSL modem (I disconnected the Ethernet cable between the Westell and the Netgear).  When everything was stable logging, I plugged the Netgear modem into the DSL modem and went to Thanksgiving dinner.  I left Wireshark, on my computer, logging all the packets it could hear from its connection to the Netgear router.

When I got home, I perused the logs.  Sure enough!  My 10.0.0.101 computer had been switched to a 192.168.1.18 number again.  It was easy to scroll down the Source column and find where the IP address switched about 21632 seconds into the log.  It appears Verizon performed an ARP attack to steal my computer's IP, swapped addresses inside my LAN network, and executed a perfect Man-in-the-middle (MITM) attack on my network.  It appears they culled admin passwords to the router, and modified my router settings.   Unbelievably, their DSL User Agreement paragraph 10(4) actually says they will "access and adjust your computer" settings!  Do you know what your internet provider is doing?!

Ethernet Log Documents Verizon Hack into My Network

What you see in the above Wireshark log, on the third blue line, is my computer (10.0.0.101 Elitegro network card) announcing its CUPS printer server available on port 631.  The logs show this occuring every 30 seconds or so for a few hours.  Verizon is using the Westell modem to sequentially ARP-scan 192.168.1.1/24 addresses to find anybody on the network.  This is done at a rate (every few seconds) below the threshold that most firewall programs will report a scan attack.  Perhaps this is a way to find rogue DHCP servers that someone may have put on the net to conflict with the Verizon's services.  I don't know why Verizon does this, whether from remote servers, or from Jungo DSL middleware installed on the modem (as suggested by one reader).

When Verizon found my Netgear router at 192.168.1.18, the Linux box responded with the five purple packets.  Then, about 0.01 seconds later, the modem sends a bogus attack packet followed by an immediate DHCP offer of a new IP address, and a DHCP ACK.  Notice there are no missing packets in this sequence.  All three are shotgun out in quick sequence.  You can duplicate this type of behavior using the Ettercap program if you'd like to experiment yourself.  In fact, acquire a copy of the entire Helix Linux distribution, and you can have all sorts of fun.  I have successfully captured other computers on a network, and forced them to send all their traffic through me.  Caution: you do this where you're not welcome and it is criminal activity.

This fast triple sequence (NAK OFFER ACK) is intended to snatch the attention of the target computer before any ~other~ DHCP server can figure out what happened.  It worked.  Notice the packet was sent to 255.255.255.255 - this means all other networks, not just the subnetwork that the Westell is on.  There is no reason to do this except an intent to reach into other subnets and hack into them.  Remember, the Westell was on the WAN side of the Netgear; this data is being logged on the LAN side of the Netgear. I need to look into whether or not the Netgear router can be configured to block "broadcast all" packets from WAN side to LAN side.

As an aside, maintaining TOTAL silence on the network (replying not at all) would have caused the Westell modem to pass me by and go searching at other addresses.  This is the theme strongly advocated by the grc.com ShieldsUP! web pages in order to make your computer less attacked while on the Internet. However, your computer can not remain silent about DHCP ARP packets, because that's how your computer gets an IP address to do all the rest of the required network communication.

You'll see that the attack worked because 0.08 seconds later, my computer (Elitegro MAC address) announced its new IP address with the bright tan-colored packet.  It has been hacked!  Simultaneously, it's netmask and gateway has been changed to point it toward the Westell modem (not visible in this log).  The Westell has inserted itself in the middle of any communication between my computer and my LAN router.  This is a Man-In-The-Middle attack. In other words, if my computer now tries to send to the Netgear router at 10.0.0.1, the packet will be sent to the Westell modem first because this address is off its newly assigned subnet.  I'm not sure how the Westell modem succeeded in reprogramming my internal LAN network away from 192.168.1.1/24 to 10.0.0.1/24.

Verizon Hacks and Collects your LAN Information

Below is the main page of the web server inside the Westell modem.  Only the top panel exists when you first install the modem, before it has ever communicated on a DSL line; the bottom 3 panels of data (with the red banners) do not show up.  Whenever the DSL cable was disconnected, the data for the panels was unavailable.  The point here is that displaying these pages apparently require communication with the "mother home ship" back inside the Verizon network somewhere.  The Westell modem does not do these things itself (disconnected from the DSL).

It appears that any information about my internal network is traveling over the DSL lines back to Verizon. Of note, the modem home page displayed below, at 192.1681.1, was recorded after I fixed the IP-snatching problem.  The one listed "computer" on My Network below is one device Verizon should see: the Netgear router.  When I had other computers inside my LAN, they also appeared on this page until I tuned them to refuse DHCP ARP attacks.  Realize that all this internal LAN information is being collected and used by Verizon, available to them because they hack into the network on the LAN side of your router!  See Verizon's DSL User Agreement, paragraphs 10(2).

Solution

1. Someone asked, "What makes you think material posted on your page is credible?"  As with any research, I would say documentation, data, and community discussion.
2. How was Wireshark being run?  The Mandriva Linux OS was the only computer running.  I added an additional sentence to clarify that Wireshark was running on it.  Anything on the ethernet cable plugged into the Linux computer would be available to the Wireshark log.  This includes traffice sourced from anywhere on the LAN or WAN side of the Netgear (including the world-wide Internet) provided the Netgear put it on the LAN-side ethernet cable to the Linux box.
3. Wireshark was set to filter packets as explained in the main text, using the rule "! (ip.addr == 127.0.0.1)".  All other packets are shown.  I believe this filter changes none of the conclusions.
4. At least one readers bristled at my claim of "bogus attack packet", quoting sources describing how a NAK packet is suppose to be used, and pointing out that my claim doesn't fit the protocol.  I apologize for not being clear: I know this is not normal NAK usage, and using a NAK packet in an incorrect way is why I called it bogus!
   
5. Network topology came up in some dicussions.  A clarification is in order for those not familiar with the terminology: a Man-In-The-Middle attack doesn't mean the attacker is physically in the middle.  I was critiqued for not recognizing that my Netgar was in the middle.  Of course.  With a MITM attack, the "middle man" can be on either side of any network or firewall.  I've done MITM attacks using a wireless laptop link into a WAP, and was able to reach any other computer on the network.  By "reach", I mean cause that other computer to route all traffic through me, and accept traffic through me as if it came from elsewhere.  The concept of being "in the middle" is an operational concept, not an attempt to describe physical connection topology.
6. I was critiqued for not recognizing a modem can detect if there is a DSL signal, and asked to provide "proof" that the data displayed on the Westell's configuration pages was being accessed from elswhere.  I clarified the relevant passage in the main text.
7. To the folks pointing out the problems are impossible with static IP addresses, I'm sorry for being unclear.  Static IP addresses were used as a solution to fix the problems, they weren't part of the problem.
8. One interesting discussion highlighted that if my claims were really happening, 99% of the people would never know, but the remaining 1% would be vocal about it. I agree! Well, I'm being vocal, and I'm all ears for whatever data or documentation polite readers would like to cooperatively collect. I propose: setup your own 192.168.1.1/24 network, plug in your own DSL modem, network log what happens, and let's see if your local network computers are reprogrammed to 10.0.0.1/24.
   
9. I received rather violent disagreement and personal slams that no outside network can "hack into my wireless Netgear router".  I can only refer that reader back to the text above starting with "This much I know: ..."  I do have ideas of how this can be done.  I'll document that it can be done with the assistance of some people behind more friendly emails, and the maybe we'll spill the beans of how.

Bibliography / Additional Resources

Wikipedia on ARP Spoofing -  describes the technique used to steal an IP address from your computer.  Once your IP address taken, the other computer can be you on the network.

Wikipedia on DHCP and ARP Snooping.

Dartmouth College Enumeration of DHCP Flaws- describes how the DHCP protocol lets another computer (or DSL modem) steal the IP address of your router gateway and penetrate your network to intercept whatever it wants!  This includes the password to your router/gateway, which it can then use to log-in and do secret administration of your router settings!

http://www.tekbar.net/hackers-and-security/seven-easy-way-to-help-you-defend-against-arp.html - How to defend against ARP attacks.