Spark, the least secure part of your home network?

Forums › Spark New Zealand (including Skinny and BigPipe) › Spark, the least secure part of your home network?

1 | 2 | 3

NonprayingMantis

6434 posts

Uber Geek

#1202389 23-Dec-2014 02:02

NZtechfreak:
NonprayingMantis: You don't need to prove Id to give instructions on how to reset a modem, since there is no info given away that could be considered private. There is no privacy breach here imho.

That wasn't what was asked for though, even according to Telecom's logs of the call - the request was for a password change. That isn't quite the same as asking how to reset the modem, I would think that a request of the kind that was made would warrant checks. It's not a privacy breach here, it is a network breach facilitated by the ISP, who failed in their duty to credential a caller adequately.

I think that's just confusion around the terminology. It's clear that what happened wasn't a 'password change' at the account level but rather a modem password reset, which doesn't require any privacy breach to happen since it is using publocally available information.

I.e. Press the reset button on your modem. Done.

plambrechtsen

1948 posts

Uber Geek
Inactive user

#1202620 23-Dec-2014 12:55

NonprayingMantis:
NZtechfreak:
NonprayingMantis: You don't need to prove Id to give instructions on how to reset a modem, since there is no info given away that could be considered private. There is no privacy breach here imho.

That wasn't what was asked for though, even according to Telecom's logs of the call - the request was for a password change. That isn't quite the same as asking how to reset the modem, I would think that a request of the kind that was made would warrant checks. It's not a privacy breach here, it is a network breach facilitated by the ISP, who failed in their duty to credential a caller adequately.

I think that's just confusion around the terminology. It's clear that what happened wasn't a 'password change' at the account level but rather a modem password reset, which doesn't require any privacy breach to happen since it is using publocally available information.

I.e. Press the reset button on your modem. Done.

This too was my point. It seems that said teenager rang up about how to reset a WIFI password on the router. No customer specific information was required (such as account number or even phone line number for that matter). Since all Spark broadband connections are authenticated based on the physical line. No username / password credentials are required in the modem to get onto the network so it wouldn't have been a breach of privacy of the customers account information.

Again only hearing one side of the story the person rang up on reset the Wifi password, the CSR assisted them through this process using exactly the same information that is freely available on the public Spark site and available using 2 seconds of google.

As cbrpilot already said the best path to take is to escalate this is back with the call centre so they can review the call and see exactly what happened.

I would say the same no matter if I worked for Spark or any other ISP, or if this had occurred with any other ISP. If someone is legally in the house and they have physical access to the router then it's game over. Just like they could have physically plugged into the router and done whatever they wanted to do or plugged in their own wifi router into the existing DSL Router and been away.

I'm struggling to see what Spark could have done differently when no customer identifiable information was required or from the sounds of it provided over the phone. Especially considering exactly the same information is freely available on the internet with step by step instructions on how to achieve it.

coffeebaron

6231 posts

Uber Geek

Trusted

Lifetime subscriber

#1202635 23-Dec-2014 13:32

Who wants a "Secure Master Filter" install. Secure wiring from ETP to secure cage that houses your router. Special Geekzone price of $1500 +GST :)

Rural IT and Broadband support.

Broadband troubleshooting and master filter installs.
Starlink installer - one month free: https://www.starlink.com/?referral=RC-32845-88860-71
Wi-Fi and networking
Cel-Fi supply and installer - boost your mobile phone coverage legally

Need help in Auckland, Waikato or BoP? Click my email button, or email me direct: [my user name] at geekzonemail dot com

wasabi2k

2096 posts

Uber Geek

#1202770 23-Dec-2014 16:55

Good lord - talk about making a mountain out of a molehill.

Teenager reset the router when it was explained to them how - none of this is secret, it is written IN THE MANUAL and the button is labelled RESET. There is no financial impact to the account holder.

No passwords were given or changed.

The issue here is a teenager who clearly doesn't get that you don't go messing with stuff that ISN'T YOURS.

This is not a Spark issue.

1 | 2 | 3