Excitel is spying on customers with their Fiber ONU (PPC Belden)

[havoc]

What just happened here

 

[Lolita_Magnum]

On the latest excitel ONU that I received, a secondary SSID ie www.excitel.com is placed in the firmware by default, which can be disabled if you click on the multiple AP option and deselect it. See image.

While they have been hijacking DNS, TR069 is not working at the moment at least for Mumbai Region.

TR-069 is an unmanned data pushing system, that pushes the required configuration onto your ONU, in case the owner/customer resets his device. This can also be used to change WIFI SSID and password, using a designated app, which is done by the likes of Jio and Airtel.
It's a simple push system and does not have a receiver system, so it technically cannot collect data. This will be obvious when you manually change a setting on your ONU, but it does not reflect on your APP.

 

[abX]

My post was not intended against TR069 in the first place.

It was against the unauthorised WiFi SSID being broadcast by Excitel and their subsequent refusal to disable the same.

PS : TR069 is bidirectional (not merely an unattended push protocol) and can be used to collect client device details including, but not limited to, Mac address and hostname.
Needless to mention, TR069 is widely known for its vulnerabilities; and if ISPs were so transparent, why are they resorting to blockade of bridge mode and active pushing firmware-locked ONUs / gateways?

This wasn't the case earlier, even with Excitel.


--------------
Citation : Harrison's Sandbox (Blog)
Article : Your ISP is probably spying on you
URL : Your ISP is probably spying on you

 

[Lolita_Magnum]

In your own link.

Realistically speaking, chances are nothing bad will happen to you because of this. But there are several reasons to still be concerned.

For the rest, if you have been using Google for many years now, then it already knows more about you than you yourself.

 

[abX]

Exactly.
I have a choice of either using Google or not using it.

Its not forced upon me anyday, unlike some ISPs who are bundling spyware / crapware over and above the contracted service i.e internet.

Great that you understood the difference between liberty and compulsion.

 

[WieldyBinkie]

You have a choice of either using Excitel or not using it.

 

[Lolita_Magnum]

My post was not intended against TR069 in the first place.

First, you say this
But then you turn to this.

unlike some ISPs who are bundling spyware / crapware

Does having www.excitel.com as an SSID in your ONU spyware?
Regardless, I am yet to see ISPs adding something like that.
There was once an adware BSNL incident, but nothing else like that ever with anyone.

 

[WieldyBinkie]

There was once an adware BSNL incident

There still is adware/code injection.

 

[abX]

First, you say this
But then you turn to this.

You don't seem to know what defines 'intent'. Nevermind.

Does having www.excitel.com as an SSID in your ONU spyware?

Anything which is outside the scope of any contract is unintended. I have paid for Internet service, nothing more and nothing less.
Having an SSID with a password presumably known to the general public does pose a security risk, even if not exploited by the company; but can still be exploited by unpatched vulnerabilities on their crappy Chinese ONU.

I appreciate your advocacy for the ISP though.

Regardless, I am yet to see ISPs adding something like that.

Thats your PoV.

There was once an adware BSNL incident, but nothing else like that ever with anyone.

Everyone knows about airtel injecting JS unauthorisedly. And DPI in Jio

That BSNL case was possibly an unintended attempt of redirecting users to their ngn service.
And yeah, PSUs are never behind your data. THEY STILL ALLOW OPEN MARKET ONUs

-------------

Just like when we want to have full control on our brand new car, without the influence of the manufacturer ; or may be having full control over my new apartment outside the interference of the builder, the same is analogous to having full control on my network and devices, without the influence and unauthorised control by the ISP.

My post was to raise awareness. Cheers!

 

[havoc]

Privacy is a topic which is like two sides of a coin... It just loops back to Infinite argument.