On 04/07/18 13:23, Jookia wrote:

I haven't got the NBN yet, but we currently have a Telstra technicolor modem. What interests me about it is that it does firmware updating automatically and I can't find any firmware for it online. Short of cracking it open and reading flash chips or doing traffic snooping, there's not much I can do to tell it's not being malicious.

I also have a Technicolor modem on Internode NBN, and I always put my modem into bridged mode and use a FOSS server (typically Linux or BSD) as the actual router.  I'm currently using an old Dell "small business server" that I got for free, but even a Raspberry Pi would work as a single-armed router.  That probably won't protect you against actively malicious firmware, but it should mitigate against a lot of vulnerabilities because it's much harder to externally contact a router in bridged mode. Cheers,         Andrew

On 04/07/18 14:17, Jookia wrote:

On Wed, Jul 04, 2018 at 01:33:54PM +1000, Andrew Pam wrote:

...

On 04/07/18 13:23, Jookia wrote:

...

I haven't got the NBN yet, but we currently have a Telstra technicolor modem. What interests me about it is that it does firmware updating automatically and I can't find any firmware for it online. Short of cracking it open and reading flash chips or doing traffic snooping, there's not much I can do to tell it's not being malicious.

I also have a Technicolor modem on Internode NBN, and I always put my modem into bridged mode and use a FOSS server (typically Linux or BSD) as the actual router.  I'm currently using an old Dell "small business server" that I got for free, but even a Raspberry Pi would work as a single-armed router.  That probably won't protect you against actively malicious firmware, but it should mitigate against a lot of vulnerabilities because it's much harder to externally contact a router in bridged mode.

Cheers,         Andrew

Yeah, I've done that before, so I might do it again eventually. I've started to consider to just run a local VPN for all my machines to have things encrypted at the wire level, so no network spying can happen.

Yes, I think it is best to always put the ISPs modem in bridge mode if you can -- but VoIP /may/ be one thing that stops people from doing so. A

On 05/07/18 03:01, Andrew Pam wrote:

On 05/07/18 01:31, Andrew McGlashan wrote:

...

Yes, I think it is best to always put the ISPs modem in bridge mode if you can -- but VoIP /may/ be one thing that stops people from doing so.

I have a Sipura 3000 VoIP adapter behind the Technicolor modem, because the built-in VoIP doesn't work in bridged mode. But most people use mobiles these days and barely use landlines. Businesses might want to run Asterisk and use VoIP handsets.

Yes, your own ATAs solve some of the problem, but you need to be provided with the VoIP login/setup details. I wouldn't run an Asterisk server as there is far too great a risk of massive bills if your server is compromised or somehow mis-configured enough. To me, it's not worth the risk. I do use Sipsorcery though, one of very few pay for subscription services that I subscribe to. A.