Adventures & Findings in ISP Hacking

Adventures & Findings in ISP Hacking

Speaker: Ian Foster

Conference: BSidesSF 2025 — April 26-27, 2025, San Francisco

YouTube: Watch the full talk

Reading time: ~7 minutes

TL;DR

A hobbyist offensive security engineer found that two Bay Area ISPs had left their control plane networks fully accessible to customers — one due to missing VLANs, the other through a chain of firmware vulnerabilities in an ADTRAN fiber modem. Basic vulnerabilities like trivially guessable passwords and command injection exposed ISP infrastructure to customers willing to poke around.

Introduction

Most people treat their internet connection as a black box: plug in the router, check the lights, and move on. Ian Foster — offensive security engineer, BSidesSF network operator, and hobby ISP runner — is not most people. When his internet went out, Foster did what any reasonable security researcher would do: he started scanning.

What he found in two separate Bay Area ISPs illustrates a persistent and underappreciated risk in the supply chain of consumer connectivity. ISPs are not just conduits for data — they are complex networks of devices with management interfaces, internal protocols, and, apparently, some very weak passwords. A downstream customer exploiting ISP infrastructure affects everyone else on that network, making these findings relevant far beyond the individual household.

Part One: Pig Spleen ISP — No VLANs, No Problem

▶ Watch: Discovering the control plane (02:00)

The first ISP Foster examined — pseudonymized as "Pig Spleen" — made a fundamental architectural mistake: it mixed the customer-facing network and the internal control plane on the same layer-2 network with no VLAN separation. The control plane is the ISP's management network, used for SNMP, iBGP, device administration, and similar privileged functions. Normally it should be logically isolated from customer traffic entirely.

By simply adding an IP address in the ISP's routable subnets to his router's WAN interface, Foster was able to interact with that network directly. An Nmap scan revealed the ISP's internal switches, routers, SNMP services, SSH servers, Telnet daemons, and web management interfaces — all accessible from what was nominally a home internet connection.

▶ Watch: What Nmap revealed (04:00)

The control plane's default gateway also provided an alternative path to the internet, effectively granting anonymous internet access routed through the ISP's own WAN IP rather than the customer's assigned address. Beyond that, Foster used reverse DNS lookups against the ISP's nameserver to map the physical topology of the network. Device hostnames included building addresses, allowing him to reconstruct which routers were installed where across the Bay Area.

Device interrogation via Telnet and HTTP banners identified specific hardware. Foster found router configuration files exposed over HTTP — completely unredacted online — containing admin passwords, IP address ranges, and even the ISP's own corporate office Wi-Fi credentials. A Cisco router was left running default credentials. The network hardware also flooded the shared segment with broadcast packets from auto-discovery protocols, consuming bandwidth that wireless customers were paying for.

▶ Watch: Configuration files and credentials (06:00)

When Foster disclosed his findings to the ISP via email and follow-up messages over several months, he received minimal engagement. He eventually met a lead engineer at a Bay Area meetup and delivered the findings in person. The engineer's response, as Foster described it: as long as the internet works, they don't really care.

Part Two: Sonic — Firmware Archaeology on an ADTRAN ONT

▶ Watch: Introducing Sonic and the ADTRAN 411 (08:00)

The second ISP was Sonic, a well-regarded Bay Area fiber provider. Foster speaks highly of Sonic, noting they were cooperative and ultimately gave him permission to test findings in a lab environment. The vulnerabilities here were not Sonic's own — they lived in the firmware of the ADTRAN 411, a GPON ONT (optical network terminal) that Sonic provides to fiber customers.

Foster's first step was hardware reconnaissance. The ADTRAN 411 has a hidden four-pin UART serial header accessible without disassembly by pushing wires through the device's air vents. Using an oscilloscope to identify the baud rate from timing differences in idle-line signals, he connected a serial adapter and captured the device's boot logs, revealing the u-boot bootloader and the Linux operating system underneath.

The login prompt at the end of boot blocked further progress, so Foster pursued a flash dump. Without a proper NAND programmer, he used a bootloader feature to dump flash over the serial console — a process that, at 120 MB, took approximately 15.5 hours. A tool called BCM CFE Dump automates the same process without reducing the time.

▶ Watch: UART access and flash dumping (10:00)

Parsing the flash image revealed a Linux filesystem with multiple partitions. The etc/passwd and etc/shadow files were present. John the Ripper cracked most of the hashed passwords quickly. The results were embarrassing in their simplicity: the user account's password was user; the support account's password was support. Foster admitted he was somewhat embarrassed not to have guessed those sooner.

The Magic SysRq Key: Root Without Credentials

▶ Watch: SysRq and root shell access (14:00)

Before needing any password, Foster found a more elegant path to root. The boot logs contained a message referencing the Linux Magic SysRq key — a kernel-level debug feature that allows low-level commands regardless of system state. On this embedded device, sending a specific key sequence over the serial console triggered a root shell bypass of the login prompt entirely. Foster achieved root without ever entering a password.

The device also exposed a Telnet server and HTTP server at the local IP address 192.168.1.1 (visible in the boot logs). The Telnet interface dropped to the same limited CLI used by engineers for network diagnostics. That CLI contained a ping command. The ping command was vulnerable to command injection: appending ; cat /etc/passwd to a ping target executed arbitrary shell commands.

▶ Watch: Command injection via ping (16:00)

The engineers who wrote that CLI had added the message "Have a nice day" on exit — but had not fixed the injection bug. The web interface, accessible with user/user credentials, offered a non-admin user the ability to enable mirror ports (a local LAN tap) and run a tcpdump packet capture. A diagnostic "information dump" feature, available to non-admin users, exported a large XML file containing all system passwords in plaintext — including the admin account and a manufacturer-level account with the password manufactured_password.

Control Plane Access and Disclosure

With root access, Foster examined the device's network interfaces. The main bridge interface br0 handled customer-facing traffic. A second interface on VLAN 702 carried an IP address in the 10.8.128.0/19 range — a subnet covering over 8,000 addresses — which turned out to be Sonic's control plane. This mirrored exactly what Foster had found at the first ISP: a path from customer equipment onto infrastructure management networks.

In Sonic's case, the network was configured to block ONT-to-ONT communications, so lateral movement to other customers was not possible. The control plane was still accessible to the ISP's own gateway, DNS servers, and VoIP servers, but the most severe customer-to-customer scenario was blocked.

Sonic's disclosure process was substantially more professional than Pig Spleen's. The company was receptive, provided a lab environment for testing, and worked toward fixes. ADTRAN, as the firmware vendor, was the ultimate source of the vulnerabilities.

Notable Quotes

"There were no VLANs." — Ian Foster at 02:00, describing the first ISP's control plane exposure

"The user user's password was user. The support user's password was support. I am a bit embarrassed that I didn't guess those." — Ian Foster at 14:00

"I love the fact the engineers put that ['Have a nice day'] in there but didn't fix the command injection." — Ian Foster at 18:01

Key Takeaways

• VLAN isolation is not optional. Customer-accessible network segments must be separated from ISP control plane infrastructure at layer 2. Missing VLANs can expose routers, switches, management interfaces, and configuration files to any customer who thinks to look.
• Embedded devices hide attack surface. UART headers, boot logs, and flash storage can all yield credentials and root access to people with modest hardware skills. Default or trivially guessable passwords in firmware are a persistent problem even in 2025.
• Non-admin users shouldn't have privileged features. Packet capture, mirror ports, and plaintext credential dumps should require the highest privilege levels, not the default guest account.
• Responsive disclosure matters. Sonic's engagement and lab access stands in sharp contrast to the first ISP's indifference. Vendors and operators who engage with researchers get fixes; those who ignore disclosures leave customers exposed.
• Basic vulnerabilities still dominate. Command injection via a ping field and passwords that match usernames are not novel — they are decades-old problems. That they persist in production ISP equipment affecting real customers underlines that "simple" does not mean "fixed."