Bizarre question

S

Sieravor

Gawd
Joined
Apr 9, 2005
Messages
943
Ok, I'm not new to networking or security or anything, but I've encountered something weird. I don't want to really get into details because talking about hacking is against TOS, but can anyone think of a reason why I would be able to see an entire ISP's internal network?

Anyway, what I'm asking is, can anyone out there think of any reason why I'd be allowed access, without hacking or anything weird, to an entire reserved ip range on an ISP's network?

I'm not interested in actually doing anything about it, I just want to know what's up, as the ISP is stonewalling.

Mods, if this is inappropriate, just let me know.
 
You are lacking any explanation here, as to what you mean by access to their reserved range?
 
if you can see the servers in your my network places then they are broadcasting netbios names. This is a little bit stupid and means their core network is setup wrong.
:eek:
 
Xipher said:
You are lacking any explanation here, as to what you mean by access to their reserved range?
Click to expand...

I can see their not by the servers' public IP addresses, but by their 10.x.x.x address. This includes, but is not limited to, their customers cable modems and routers. As in, instead of seeing blahblah.router.blahblah.com for their router, I see no FQDN, merely 10.x.x.x, along with the ability to connect and auth with telnet/ssh/http as if I were a part of their trusted network.

I'm trying to be as vague as possible so as not to expose too much of their issue.....just curious if anyone else has noticed something like this in the past with a non mom and pops ISP.
 
nope.

This is a core network issue. Some one has made a nasty mistake and it could be all the way down to how your areas exchange connects to the datacenter. It won't be just you that will see it like this.
 
hold on... if you are part of their trusted Vlan you will have MASSIVE bandwith.
 
Jay_oasis said:
nope.

This is a core network issue. Some one has made a nasty mistake and it could be all the way down to how your areas exchange connects to the datacenter. It won't be just you that will see it like this.
Click to expand...

Sounds like a DSLAM with a bad config.
 
Unforunately I'm still capped when it comes to bandwidth since my interface hardware is still working normally.

I'm still waiting for a phone call from the ISP security team. Four days and still no fixes. It's times like this that I wish I was willing to explore the network on a more intimate level. I bet there's all sorts of fun stuff out there just waiting to be examined, vastly scalable bandwidth included.
 
I think this is a switch config error all the way back at the datacenter.
 
Sieravor said:
]
I'm still waiting for a phone call from the ISP security team.
Click to expand...

Don't wait for them to call, make noise and send them such evidence of said problems and raise the volume a whole lot more... As it is your information that may be out there as well...

Any chance you could mention the ISP themselves so that we could know who to watch out for if anyone else around here are under the same ISP and whatnot.

Raise the volume to 11...
 
Jon855 said:
Don't wait for them to call, make noise and send them such evidence of said problems and raise the volume a whole lot more... As it is your information that may be out there as well...

Any chance you could mention the ISP themselves so that we could know who to watch out for if anyone else around here are under the same ISP and whatnot.

Raise the volume to 11...
Click to expand...

Actually I contacted them shortly after I realized what was happening. I made sure that they made some notes on my account that I reported the problem and didn't intend to do anything malicious.

As for the ISP, it wouldn't hurt anything to give out that info. Roadrunner, Brighthouse, Time warner, what ever you want to call it.

Now, I'm still not sure exactly what is going on with all of this, so if someone out there is willing to risk delving deeper than I, let me know what you find. I stopped as soon as I realized that this was a possible risk factor. here's a quick rundown of the conversation I had with the techs.

“Hello, thank you for calling roadrunner technical support. My name is Bill, how can I help you?”

“Hi Bill, my name is Tim. I’m just calling to report some strange behavior on your network. It seems that I am able to see some of your internal IP address, as in I can access your entire class A subnet as if it were public.”

“Oh….hold on a minute I have to make a call….”

I am put on hold for about 20 minutes. Eventually Bill returns, his voice has a slight edge of concern to it.

“Can you give me some more information about this? What addresses are you seeing? What do you think is allowing you to do this?”

“Well, any IP address on the roadrunner network that starts with 10 is visible to me. There don’t seem to be any restrictive measures in place or anything, Bill. As for how this is happening, I’m not sure.”

“Ok, do you see any other private IP addresses, anything like 192?”

“Doesn’t seem like it, Bill, but I haven’t really looked either.”

“How are you seeing these IP addresses? Are you using a packet sniffer or something?”

At this point I realize that he is very concerned and is fishing for some information. I tell the truth, as I don’t want to go to jail for terrorism or some other equally retarded reason (hooray for abusive and unconstitutional laws).

“I’m just using nmap to scan the subnet. No packet sniffers or anything. So, yeah, I’m actually very concerned about this. If I can see these internal IP addresses, it means I can sniff traffic off the network as well, Bill. I don’t like that. If I found this by mistake, someone out there will certainly find it as well. I mean, if I were malicious I could some serious damage. Alot of these devices have default admin logins as well.”

“……..really? <nervous chuckle> Well….hold on a minute, I have to make a call.”

I wait again, this time for only a couple minutes.

“Alright, the security specialists say this is normal for the network. Since you’re a part of the network you should be able to see the other machines, so it’s ok. You’re on a business account and since you have a static IP you are able to see some things that most of our customers cannot. I’ll make some notes on your account so that it’s clear that you mentioned this to us and were concerned. You might get a call from the Roadrunner security department sometime in the future. Is there anything else?”

The conversation ended with the standard scripted close and I hung up the phone.

As a side note, it has nothing to do with business or residential accounts as I can access the network equally as well from either.

I'm actually half hoping that this is just some weird and massive honeynet or something, because the thought of it being anything that is actually functional is beyond retarded.
 
You must log in or register to reply here.
Back
Top