Possible Magnet security/privacy issue

ikoonman

To cut a long story short, I am subscribing as a Magnet Bitstream client, and the service is OK. I cannot *really* complain.

My problem is that I've been on to the support staff regarding gaining access to the modem's interactive web-based configuration menu. I have several reason for wanting to do so. To name a few, some of the ports are not blocked, which is a bit of a problem to me. Since I am doing software development, I cannot open and close ports, not even mentioning setting configurations on Port priority/forwarding/QOS/stronger wireless encryption/filter by wireless MAC address.

Upon my request to access the configuration the response from Magnet was NO, mainly for support reasons. (Not that this is to me a valid reason since I'd prob never need to contact Magnet support once I can do my own configurations) But, although I have technical experience, I cannot see what the real reasons would be, not even mentioning the fact that I will not do anything to break my own configuration.

The real concern is though that Magnet can access my internal network and there is very little that can be done about it without having some access to the modem/router. This clearly raises some privacy issues. I can install (for example) ZoneAlarm on all my PC's and prevent access this way, but what about customers that does not know how to do this?

After posing this question, the support guy "J" assured me that, "speaking for the whole company", nobody would attempt to access my internal network (or any customer's home setup for that matter). I said that I'd like to have something like that in writing, and although making a broad sweeping statement like that, he declined to put it in writing, but did say that he'd escalate it with his manager. He took my email and I am waiting to see what transpires. I used to work for an ISP and know that unfortunately not everybody is honest enough not to snoop around.

How would people (who has the technical know-how) feel about this? The way I see it is:

• Magnet can either supply me with the modem admin password (which is to be quiet honest no skin of their noses)

• give me a written letter guaranteeing my privacy

• or offer me a way to get out of my contract without any liability so I can take my business elsewhere.

Before joining Magnet I used Digiweb (but moved house and they don't cover my area) and the service and support was second to none. I had limited access to the wireless modem's configuration which suited me fine for my technical requirements.

I don't think my request to Magnet is unreasonable at all. I am not trying to be difficult, I just want to know/see that all reasonable effort is made to protect my interests and privacy.

Sponge Bob

Seems a bit odd that you cannot configure anything at all on the inside and odder still that you cannot see any settings.

Even if you were able to view 'inside settings' as you wish , there is the additional issue of whether the modem is TR-069 compatible on the outside which still gives an ISP, ANY ISP, a lot of leeway to 'monitor' you unbeknownst !

start your research on that separate subject here

http://www.netopia.com/products/technologies/nbbs.html

Now you know why I always use my own modem and shut down the TR-069 features if present .

ikoonman

Well that's precisely my point. Magnet didn't even offer to share the setting with me, so who knows how they've set it up!

The modem sports lots of features but yet customers are denied access to it. This is very disappointing.

What's even more is that the product offers detailed activity logs which is an invasion of my privacy because Magnet controls it and not me.

Best of all MAGNET would not allow me to set up my own DSL router/modem if I had one, because that "would cause support issues".

Unfortunately the modem is not netopia but 2wire (2wire.com)

jor el

Is the modem yours to keep or is it like with most other providers, on loan for the duration of your contract. If it' yours, either a free offer or you bought it at install, then surely they must provide the password.

Since this is just Eircom bitstream product, the settings for using your own modem are well known, just see Eircoms webpage for the numbers you need. The only place I can see a problem would be with the username/password. With BT everyone has their own, with Eircom I believe it's a universal username and password. I guess it's universal with Magnet too and they set it up in the modem prior to giving them out, but you don't know what that is and you've probably no way of finding out.

Was there any mention of this in the T&Cs before you signed up? If not then it could be grounds to terminate the contract since you can't configure the modem to your requirements and you also can't set up your own.

ikoonman

jor el wrote:

Is the modem yours to keep or is it like with most other providers, on loan for the duration of your contract. If it' yours, either a free offer or you bought it at install, then surely they must provide the password.

Unfortunately it's theirs. I'd be happy to get my own so I can set the darn configuration. Personally I think they haven't really thought the issue through and just deny customers access to the modem configuration so they don't burden themselves with too much support calls....

jor el wrote:

Was there any mention of this in the T&Cs before you signed up? If not then it could be grounds to terminate the contract since you can't configure the modem to your requirements and you also can't set up your own.

Now that is interesting. I skimmed over the T&C and don't recall a clause like that being stated. I am most certainly going to request a copy of the signed T&C, which I suppose I should get in the post in any case. From what I could find on the website there was no mention of this particular issue.

dub45

Is it a wireless router they supply? If not what happens if you want to add say a wireless router?

ikoonman

dub45 wrote:

Is it a wireless router they supply?

Yes, it's a wireless "gateway", but with weak encryption (WEP) and a predetermined key (you cannot change any of these settings)

bk

ikoonman wrote:

Yes, it's a wireless "gateway", but with weak encryption (WEP) and a predetermined key (you cannot change any of these settings)

FFS, well that is Magnet off my list of providers to recommend to people.

This is shocking really, they are completely leaving their customers open to being hijacked.

jor el

Woh, that's not good. Is the pre-determined key the same for all Magnet routers I wonder? That's terrible behaviour by Magnet.

ikoonman

jor el wrote:

Woh, that's not good. Is the pre-determined key the same for all Magnet routers I wonder? That's terrible behaviour by Magnet.

No - i am sure they are not THAT irresponsible. I think the key is random, but it's somewhere on a list that can get lost ..... for instance .....

WizZard

Is the wep password provided under the serial number of the router?

Is it asking for a username/password, or activation key(try: 522P-22P4-6262-22AT-F2NV)?

What ports does it have open on the internal network?

<edit>According to the internetweb you have to contact 2Wire with the code that is given after you try to view the password hint:

2Wire wrote:

If after your hint is shown to you, you still can't remember your password, there is a "I still can't remember my password" link that you can click to take you to a page to obtain a temporary password. To obtain a temporary password, you must call the support telephone number on the screen and provide the special code number that is generated by your HomePortal. The support representative will use this special code number to generate a temporary password. Once you have entered the temporary password, you can then change your password and enter an appropriate hint.

You may have to ring a US number. Good luck
</edit>

ikoonman

WizZard wrote:

Is the wep password provided under the serial number of the router?

Yes - although it's actually the key - no password

WizZard wrote:

Is it asking for a username/password, or activation key(try: 522P-22P4-6262-22AT-F2NV)?

The web admin interface? Username and password. No prompts for any other username/password/activiation keys.

WizZard wrote:

What ports does it have open on the internal network?

You wouldn't believe this, but after i told them i want to close my ports, they did so without me *actually* asking them. A simple port test previously revealed them all to be unsecured, but now the same test reports they are closed.

WizZard wrote:

According to the internetweb you have to contact 2Wire with the code that is given after you try to view the password hint:

There is no way to even view this. All i get is the username/password prompt.

event

jor el wrote:

Was there any mention of this in the T&Cs before you signed up? If not then it could be grounds to terminate the contract since you can't configure the modem to your requirements and you also can't set up your own.

i doubt its in the contract that you have to be able to configure it to your requirements

so long as your broadband is working, thats all they have to provide

ikoonman

event wrote:

i doubt its in the contract that you have to be able to configure it to your requirements

so long as your broadband is working, thats all they have to provide

But can they then refuse me access to it if it's not specified in the T&C's?

event

ikoonman wrote:

But can they then refuse me access to it if it's not specified in the T&C's?

id say so

is it theirs or did you buy it from them?

i doubt its in the T&C's that the have to allow you access either

TomTom

I have magnet to be honest I just set up my own router behind it.

I have the 2wire router and it connects to the wan of my firewall. from this i place my machines and WAP. I prefer to have 100% control so this is my solution to the same issue.