Re: Hardware needed for home network
Tixy a écrit :
> On Mon, 2011-02-14 at 11:19 +0100, Pascal Hambourg wrote:
>> Tixy a écrit :
>>> The server uses PPPoE to talk to the modem, which translates this into
>>> PPPoA to get to my IPSs equipment.
>>
>> Are you sure of this ? Isn't your modem rather working as a plain
>> ethernet bridge, just transparently forwarding the PPPoE traffic between
>> its ADSL and ethernet ports ? If so, then it is an obvious security
>> breach : it is a plain ethernet switch connecting your LAN to the
>> outside world.
>
> Thinking about this some more. Even with PPPoE, I can't imagine that the
> DSLAM in the exchange would be set up to pass and route Ethernet frames
> down my phone line which had MAC addresses of machines on my private
> network or which were broadcast packets.
I beg to differ. I can imagine anything about an external device which
is out of my control, and wouldn't base the security of my LAN on
optimistic assumptions.
If an attacker takes over the DSLAM, it can first listen to your LAN
broadcast traffic leaking through the bridge modem and learn the MAC and
IP addresses of hosts on your LAN from it. Then it can communicate
directly with them using this information.
Is it unlikely ? Yes.
Is it impossible ? No.
Is it easy to protect against ? Yes, just isolate the modem from the LAN.
> Seems like that leaves the telco network open to abuse.
Telco networks have been cracked and abused. It has happened, it will
happen again.
> Even if the telco network did this, would a home modem just pass these
> frames through transparently to its Ethernet port?
Yes. As a I wrote, a bridge modem works as an ethernet switch. It does
not care whether ethernet frames carry PPPoE, IP, or any other protocol.
> Also, from an efficiency point of view, why send a 48 bits destination
> MAC addresses down my phone line with each frame? (Or even a source
> address?).
Because that is the way ethernet works. There may be several stations
each with a different MAC address at each end of the line. Bridge modems
are not used only for point-to-point protocols such as PPPoE.
Reply to: