nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Child Item

Site Totals

3649 Users Online 5848159 Members 365599 Discussions 61880 Solutions

Verizon Home Access Works Over the Internet

DPratt1

At home, when I disable Wi-Fi on my Pixel 8a phone, leaving 5G/LTE network access, I am able to use Verizon Home remote administration. This is with Normal Security set on the G3100 router and without Remote Administration enabled. Which means that I, or potentially anyone else, can access my Fios home network from anywhere on the Internet. Clearly, the Verizon Home utility has backdoor access into the G3100 router. This is a serious security hole.

Comments

Cang_Household

Firewall being set at "Normal security" and even "High security" cannot disable the TR-069 backdoor to Fios' business support system.

Having a TR-069 backdoor does not equate to "serious security hole." The ISP is bound by the CPNI regulation promulgated by the FCC. You are protected legally under 47 CFR Part 64.

DPratt1

This is what the Verizon G3100 states regarding remote administration: "Attention With Remote Administration enabled, your local network will be at risk from outside attacks." I agree, but under the circumstances it's a meaningless statement. Why is there even the option to disable Remote Administration, if "High security" is a no-op?

Please read carefully what I am saying here: My concern is not referring to authorized Fios business representatives having access for support. If I am on the phone with a technician, and they wish to access my network, they will ask for my permission. I am talking about the backdoor being available to myself and anyone else in the world.

I should have control over which ports are open to the world at large for inbound connectivity, independent of official ISP access. As I stated, if I leave myself with only 5G/LTE networking on my phone, I can see my router through the Verizon Home application from anywhere.

Let me make this very clear: It is my contention that when Remote Administration is disabled on the G3100 by a customer, the functions of the Verizon Home application should not work across the Internet for that customer, or anyone else who is not an authorized Verizon representative acting with the customer's knowledge and approval. There is a weakness in the remote administration scheme that must be patched.

When logging into the app with my Verizon credentials, it doesn't go through the usual security checks to be sure "it's me." It just lets me in. Which means that if, through whatever means, the login is hacked, then the view of my home network is wide open without notification to myself or to Verizon.

This is the very definition of a security hole. If someone who is unauthorized is looking at my home network, what "protections" am I granted under 47 CFR Part 64?

Cang_Household

GUI Remote Administration refers to the HTTP/HTTPS service being opened on the WAN interface. Because no other safe guards exist besides the administrator password, which is unchangeable, this is regarded as a security risk.

Verizon Home, Verizon official BSS uses the TR-069 backdoor.

Are you saying you don't need any authentication into your Fios account in order to use the Verizon Home? Or are you saying the Verizon Home app lacks a two-factor authentication mechanism?

Because I am incapable of speaking on behalf of the General Counsels at Verizon, you need to consult your own lawyers to see exactly what protections are granted under 47 CFR Part 64, or write to Verizon Legal. In the ballpark, if an ISP's application is "insecure" as a matter of "fact," it may incur secondary liabilities in cases of being hacked.

DPratt1

I'll install another router or a filtering bridge in front of the G3100. Thanks for your interest.

Child Item