Botnet Attack on BSNL Broadband network

[Rajneesh Rana]

Called NIB today and their response was to use BSNL DNS. It would improve pings and reduce latency.

 

[partymonger]

Same applies to who use custom dns

Are you saying I should use bridge mode instead of the optilink one doing it? Is it possible on an R7000 with Tomato custom firmware?

Its mindblowing to me that the Optilink modem wont let me set custom dns server when configured to login itself. I have set google + Cloudflare on my router and getting my pihole up again today and see if it can cache a large number of sites.

 

[airforce]

@partymonger optilink modem you bridge with tomato router, are you using voice?

 

[varkey]

Called NIB today and their response was to use BSNL DNS. It would improve pings and reduce latency.

TBH, unless BSNL's DNS servers were compromised (I doubt that), using BSNL resolvers itself wouldn't have caused issues.

The problem is that, using the ONT vulnerability, the attacker would have been able to override the resolvers used by the ONT to malicious ones (ie change from BSNL's resolvers). In the default configuration, on client devices the resolver is set to the ONT's IP address. So indirectly the user gets pointed to a malicious resolver.

Now, users who were using custom resolvers ie not the ONTs IP address, wouldn't have been affected even if the ONT itself was compromised. This is assuming all the attacker did is change the resolvers to malicious ones.

 

[varkey]

Are you saying I should use bridge mode instead of the optilink one doing it? Is it possible on an R7000 with Tomato custom firmware?

Its mindblowing to me that the Optilink modem wont let me set custom dns server when configured to login itself. I have set google + Cloudflare on my router and getting my pihole up again today and see if it can cache a large number of sites.

I would always recommend using the ONT as a dumb modem where all it does is take in fiber and give ethernet.

When in bridge, a remote attacker wouldn't be able to access the ONT like in this case, so whatever vulnerability exists on the ONT a remote attacker might not be able to exploit it. However your main router could also be vulnerable if it is old and not updated etc.

Having said that, if an OLT was compromised due to some misconfig or having the default creds or vulnerability and was remotely accessible, the ONTs could potentially affected due to remote configuration options.

Either way I'd always bridge.

 

[Realme]

To Everyone,

I have completely lost my trust on ONT security, today my ONt got upgraded(and OLT from his side) . I don't undertsand how this is possible with a backdoor as I have disable telnet and TR69

Also I contacted my guy about FUP expiration and ridiculous data usage, and I found him helpless in this regard(he couldn't do anything about it)

LCO are just yet another 'retail' customer for BSNL, they are not that much respected by Higher-up who are just seen as someone taking care of cabling stuff only.( a bit more priority in custommer support for them and beyond it they are helpless)

I don't know if I should proceed with data cap complaint through official means

 

[varkey]

root@varkey:~# mtr -w -z -4 dns.google.com
Start: 2020-03-14T15:07:02+0530
HOST: varkey                                        Loss%   Snt   Last   Avg  Best  Wrst StDev
  1. AS9829   static.bb.ill.59.92.184.1.bsnl.in      0.0%    10    1.7   2.2   1.6   3.4   0.5
  2. AS9829   static.ill.218.248.61.250/24.bsnl.in   0.0%    10    1.9   2.6   1.9   4.1   0.8
@Not a TXT record
  3. AS???    ???                                   100.0    10    0.0   0.0   0.0   0.0   0.0
@Not a TXT record
  4. AS???    ???                                   100.0    10    0.0   0.0   0.0   0.0   0.0
@Not a TXT record
  5. AS???    ???                                   100.0    10    0.0   0.0   0.0   0.0   0.0
  6. AS15169  72.14.211.114                          0.0%    10  138.8 139.5 121.0 163.5  13.8
  7. AS15169  108.170.253.97                         0.0%    10   94.7  91.2  79.4  96.6   5.2
  8. AS15169  74.125.253.69                          0.0%    10   58.7  57.6  45.9  65.7   5.9
  9. AS15169  dns.google                             0.0%    10  118.8 112.3  95.7 128.3   9.4

For some reason, latency is really bad today, issue started around 12:30 AM. Pings to Google DNS was like 15 ms yesterday and today it has gone crazy.

 

[Realme]

How you guys get such detailed traceroutes? for me most of tme after few IPs : it is just this:

<NO> * * * Request timed out.

For me it is 16 ms, but cloudfare is very bad at 40 ms

 

[airforce]

root@varkey:~# mtr -w -z -4 dns.google.com
Start: 2020-03-14T15:07:02+0530
HOST: varkey                                        Loss%   Snt   Last   Avg  Best  Wrst StDev
  1. AS9829   static.bb.ill.59.92.184.1.bsnl.in      0.0%    10    1.7   2.2   1.6   3.4   0.5
  2. AS9829   static.ill.218.248.61.250/24.bsnl.in   0.0%    10    1.9   2.6   1.9   4.1   0.8
@Not a TXT record
  3. AS???    ???                                   100.0    10    0.0   0.0   0.0   0.0   0.0
@Not a TXT record
  4. AS???    ???                                   100.0    10    0.0   0.0   0.0   0.0   0.0
@Not a TXT record
  5. AS???    ???                                   100.0    10    0.0   0.0   0.0   0.0   0.0
  6. AS15169  72.14.211.114                          0.0%    10  138.8 139.5 121.0 163.5  13.8
  7. AS15169  108.170.253.97                         0.0%    10   94.7  91.2  79.4  96.6   5.2
  8. AS15169  74.125.253.69                          0.0%    10   58.7  57.6  45.9  65.7   5.9
  9. AS15169  dns.google                             0.0%    10  118.8 112.3  95.7 128.3   9.4

For some reason, latency is really bad today, issue started around 12:30 AM. Pings to Google DNS was like 15 ms yesterday and today it has gone crazy.

View attachment 424

Same here

 

[Realme]

I jinxed myself and now my latency is 70ms

EDIT:Back to 16ms

What happens after stsic.ill stuyff I walways get one request time out after that and then my connection reaches googl's IP