Subject: Re: [Add] Participation

From: <[email-masked]>
Date: Fri, 23 Aug 2019 15:22:03 +0000

After Kevin's explanation of Vodafone UK's traffic handling, I can clarify something that Rob mentioned this week:

> I also found that BT Smart Hub / Home Hub routers require installation of root certs,
> but I think it may only be for communicating with the router and one BT web page, at the moment.

BT hubs do not do HTTPS interception or man in the middle.
BT hubs only present a self-signed cert for admin user interface connections to https://192.168.1.254. (Customers can also connect to http://192.168.1.254.)

Chris

---

From: Rob Sayre <[email-masked]>
Date: Fri, 23 Aug 2019 09:58:09 -0700

On Fri, Aug 23, 2019 at 8:22 AM <[email-masked]> wrote:

> I think may gotten the product names wrong, or been confused about whether
> this applied:

<https://forum.archive.openwrt.org/viewtopic.php?id=73049>

I think this cert was only for EAP-TTLS to the router. I think I also found
detailed instructions for installing this on Windows on the BT site, but I
can't find that page now.

Sorry about any confusion.

thanks,
Rob

---

From: Rob Sayre <[email-masked]>
Date: Fri, 23 Aug 2019 10:02:58 -0700

One other thing:

A lot of sites claim that users can't change the DNS settings on various BT
Hub routers. Is that true? I was surprised that OnHub TP-Link router
defaulted to Google, but it did at least give me the option switching to my
ISP's DNS service.

thanks,
Rob

On Fri, Aug 23, 2019 at 9:58 AM Rob Sayre <[email-masked]> wrote:

>> After Kevin's explanation of Vodafone UK's traffic handling, I can
>> clarify something that Rob mentioned this week:
>>
>> I think may gotten the product names wrong, or been confused about
>> whether this applied:
>
>
> I think this cert was only for EAP-TTLS to the router. I think I also
> found detailed instructions for installing this on Windows on the BT site,
> but I can't find that page now.
>

---

From: <[email-masked]>
Date: Fri, 23 Aug 2019 19:27:05 +0000

Rob,

> A lot of sites claim that users can't change the DNS settings on various BT Hub routers.
> Is that true? I was surprised that OnHub TP-Link > router defaulted to Google, but it did
> at least give me the option switching to my ISP's DNS service.

This does appear to be the case on some hub routers, although not all. I can understand why - it'll default to BT because that will enable the delivery of content from localised CDN caches, and permit the malware controls etc.

I could speculate that the reason there's no option to manually change the default is to prevent accidental loss of these services, or as a hurdle to social engineering ("Message from BT. Your hub is currently insecure. To fix this, go to http://192.168.1.254/, (more instructions), change the DNS server to <IP of attacker> and click OK".) Another use case is to generally make the task of customer support a little simpler ("Why can't I get to the internet / this site?").

It is always possible to replace the BT hub with your own router, but in that scenario the user is generally perfectly aware that they are using a non-vanilla service that may have different properties.

Chris

---

From: Rob Sayre <[email-masked]>
Date: Fri, 23 Aug 2019 12:44:18 -0700

On Fri, Aug 23, 2019 at 12:27 PM <[email-masked]> wrote:

> This does appear to be the case on some hub routers, although not all.
>
...

> It is always possible to replace the BT hub with your own router, but in
> that scenario the user is generally perfectly aware that they are using a
> non-vanilla service that may have different properties.
>

Thanks for the direct reply. I'm only asking so we have as much data as
possible when people bring up "user choice" arguments.

Both BT and Google are making relatively inexpensive products that seem
relevant to those arguments--and I must underline that I find the products
from both companies totally acceptable.

It seems like I can use DoH in Firefox to bypass decisions like that on
both routers, and consult CloudFlare, or a DNS provider I specify manually.

thanks,
Rob

---

From: "Livingood, Jason" <[email-masked]>
Date: Fri, 23 Aug 2019 20:40:48 +0000

>     This does appear to be the case on some hub routers, although not all. I can understand why - it'll default to BT because that will enable the delivery of content from localised CDN caches, and…

[JL] This is also a standard defense against DNS-changing malware.

---

From: Rob Sayre <[email-masked]>
Date: Fri, 23 Aug 2019 13:43:57 -0700

On Fri, Aug 23, 2019 at 1:40 PM Livingood, Jason <
[email-masked]> wrote:

> On 8/23/19, 3:27 PM, "Add on behalf of [email-masked]" <
> [email-masked] on behalf of [email-masked]> wrote:
> >     This does appear to be the case on some hub routers, although not
> all. I can understand why - it'll default to BT because that will enable
> the delivery of content from localised CDN caches, and permit the malware
> controls etc.
>

DNS-changing malware tends to exploit the router's OS, doesn't it? I would
not characterize this as a very good defense against that.

thanks,
Rob

---

From: Rob Sayre <[email-masked]>
Date: Fri, 23 Aug 2019 18:34:37 -0700

On Fri, Aug 23, 2019 at 12:27 PM <[email-masked]> wrote:

> I could speculate that the reason there's no option to manually change the
> default is to prevent accidental loss of these services, or as a hurdle to
> social engineering ("Message from BT. Your hub is currently insecure. To
> fix this, go to http://192.168.1.254/, (more instructions), change the
> DNS server to <IP of attacker> and click OK".) Another use case is to
> generally make the task of customer support a little simpler ("Why can't I
> get to the internet / this site?").
>

The argument that ISP defaults are entail customer service costs has some
up a few times.

I think this is a disingenuous argument in cases where the ISP monetizes
DNS traffic. Please object if you represent an ISP, and can also claim that
you do not monetize DNS traffic.

thanks,
Rob

---

From: Rob Sayre <[email-masked]>
Date: Fri, 23 Aug 2019 18:45:49 -0700

On Fri, Aug 23, 2019 at 6:34 PM Rob Sayre <[email-masked]> wrote:

>> I could speculate that the reason there's no option to manually change
>> the default is to prevent accidental loss of these services, or as a hurdle
>> to social engineering ("Message from BT. Your hub is currently insecure. To

"The argument that ISP defaults are entail customer service costs has some
up a few times."

There are some stray words there.

I was intentionally making the point that the "customer service" arguments
aren't very good.

thanks,
Rob

---

From: Kenji Baheux <[email-masked]>
Date: Mon, 26 Aug 2019 10:51:38 +0900

There's been quite a lot of articles like this (i.e. attacking the home
router's DNS settings by exploiting a flaw in their web interface) in the
recent months:
https://decoded.avast.io/threatintel/router-exploit-kits-an-overview-of-routercsrf-attacks-and-dns-hijacking-in-brazil/

Removing the ability to set the DNS via the web UI (which I assume is what
is being referred to) does take care of this particular class of attacks
but it's a bit heavy handed.

On Sat, Aug 24, 2019 at 5:44 AM Rob Sayre <[email-masked]> wrote:

> --
> Add mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/add
>

-- 
Kenji BAHEUX
Product Manager - Chrome
Google Japan

---

From: Vittorio Bertola <[email-masked]>
Date: Mon, 26 Aug 2019 12:30:57 +0200 (CEST)

Il 24 agosto 2019 03:45 Rob Sayre <[email-masked]> ha scritto:

I was intentionally making the point that the "customer service" arguments aren't very good.

Well, the "customer service argument" is: changing the user's resolver from the ISP's to a third party one, without the user fully understanding this, will create "my Internet doesn't work" support calls to the ISP's customer service whenever the third party resolver malfunctions, and the customer service will be unable to solve the problem or even know what's happening.

To disprove that argument, you would have to explain why users wouldn't make those calls in that situation, or how ISPs would be able to deal with them - something that you have not done.

Anyway, this should be discussed when we'll work on a problem statement draft. At this point in time, we'd better focus on a list of work to be done.

--

Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
[email-masked]
Office @ Via Treviso 12, 10144 Torino, Italy