Warning - Users with Tenda ADSL modem

Forums › New Zealand Broadband › Warning - Users with Tenda ADSL modem

Psi

19 posts

Geek

#119152 22-May-2013 12:30

I installed a Tenda W150D at a friends place 2 weeks ago and their internet usage jumped
from 200-600MB/day to 2-15GB/day.

At first i thought it was the typical reasons, unsecured Wifi/WPS, virus/rootkit on PC etc..
However after checking and ruling them all out we contacted the ISP (Telecom).
(We thought it might be someone else's usage getting crossed with theirs.)

The response back from telecom was...

----------
This is the sixth case in the last week where people with Tenda modems notice this behaviour. With 4 of my cases we have proved the fault to the Tenda modem itself, and we're waiting back on information for the fifth case. Because of this I think there is a high chance in your case that the modem is also causing the issue. Do you have another modem (maybe an old Telecom one) lying around we'd be able to plug in for the time being to prove/disprove that the Tenda modem is at fault? Alternatively would it be possible to borrow a modem off a family member for one night so we could prove the same thing?

Complex Technical Support
Telecom NZ

-----------

There are likely many other people with Tenda modems with this issue and they may not even known it.
(I have informed PBTech of the issue)

So, if you have a Tenda W150D, or any Tenda. There is a potential security risk.
(It is still unknown what the extra traffic is.)

1 | 2 | 3 | 4

19282 posts

Uber Geek
+1 received by user: 2526
Inactive user

#823495 22-May-2013 12:39

Did the usage go back to normal after swapping back to the other modem?

JamesL

956 posts

Ultimate Geek
+1 received by user: 342
Inactive user

#823496 22-May-2013 12:40

It's probably an open DNS resolver issue

Try using something like this http://www.kloth.net/services/nslookup.php

Under server use the wan ip of your friend

eXDee

4033 posts

Uber Geek
+1 received by user: 1070

Trusted

#823549 22-May-2013 14:09

JamesL: It's probably an open DNS resolver issue

Try using something like this http://www.kloth.net/services/nslookup.php

Under server use the wan ip of your friend

This. It'll be having no firewall enabled for DNS on the WAN interface.

Psi

19 posts

Geek

#823554 22-May-2013 14:17

johnr: Did the usage go back to normal after swapping back to the other modem?

I dont know yet, i just got the news today. I will probably go around to their house tonight and check.

JamesL: It's probably an open DNS resolv

er issue

Try using something like this http://www.kloth.net/services/nslookup.php

Under server use the wan ip of your friend

Thanks, i will check that tonight.

sbiddle

30853 posts

Uber Geek
+1 received by user: 9996

Retired Mod

Trusted

Biddle Corp

Lifetime subscriber

#823570 22-May-2013 14:57

eXDee:
JamesL: It's probably an open DNS resolver issue

Try using something like this http://www.kloth.net/services/nslookup.php

Under server use the wan ip of your friend

This. It'll be having no firewall enabled for DNS on the WAN interface.

I'll put $1 on it being this as well.

Psi

19 posts

Geek

#823573 22-May-2013 15:06

If the issue does turn out to be a WAN DNS problem should adding a pinhole from port 53 to a non existent lan IP fix it
(Assuming the router has no firewall option for DNS i can enable)

Geekzone support

Support Geekzone with one-off or recurring donations Donate via PressPatron.

Kyanar

4089 posts

Uber Geek
+1 received by user: 1684

ID Verified

Trusted

#823610 22-May-2013 16:18

Psi: If the issue does turn out to be a WAN DNS problem should adding a pinhole from port 53 to a non existent lan IP fix it
(Assuming the router has no firewall option for DNS i can enable)

Not really. The data is counted at your ISPs end so you'll still be charged for the DNS requests coming in to your IP.

Telecom should be able to switch you to a new IP or something I'd assume.

Psi

19 posts

Geek

#823614 22-May-2013 16:20

Kyanar:
Psi: If the issue does turn out to be a WAN DNS problem should adding a pinhole from port 53 to a non existent lan IP fix it
(Assuming the router has no firewall option for DNS i can enable)

Not really. The data is counted at your ISPs end so you'll still be charged for the DNS requests coming in to your IP.

Telecom should be able to switch you to a new IP or something I'd assume.

i'm aware that it wont stop traffic from being counted.

but if it stops the DNS requests from being answered then people should stop sending them.

Zeon

3926 posts

Uber Geek
+1 received by user: 759

Trusted

#823648 22-May-2013 17:00

Psi:
Kyanar:
Psi: If the issue does turn out to be a WAN DNS problem should adding a pinhole from port 53 to a non existent lan IP fix it
(Assuming the router has no firewall option for DNS i can enable)

Not really. The data is counted at your ISPs end so you'll still be charged for the DNS requests coming in to your IP.

Telecom should be able to switch you to a new IP or something I'd assume.

i'm aware that it wont stop traffic from being counted.

but if it stops the DNS requests from being answered then people should stop sending them.

Very true.

Speedtest 2019-10-14

JamesL

956 posts

Ultimate Geek
+1 received by user: 342
Inactive user

#823651 22-May-2013 17:08

No harm trying, but I'd just scrap the modem altogether.. sounds like a cheap piece of...

eXDee

4033 posts

Uber Geek
+1 received by user: 1070

Trusted

#824248 23-May-2013 17:54

Just found a user on Snap who has my old ipv4 IP with a Tenda modem, and sure enough, it responds to DNS queries.

Letting them know, hopefully they inform the customer.

edit: oh man. This thing not only presents its web interface, but responds to telnet. And when you get the password wrong... it tells you it?!

BCM96328 Broadband Router
Login: admin
Password:
______________________admin,*********_______________________

These things are shocking! And no i didn't touch anything, before anyone asks, i immediately disconnected and have sent snap a message on Twitter.

New World

Shop on-line at New World now for your groceries (affiliate link).

Psi

19 posts

Geek

#824296 23-May-2013 18:28

Wow, that really is bad.

I will post here when i have more info about this specific Tenda modem

But yeah, from what you've said this does seem to be the problem.

plambrechtsen

1948 posts

Uber Geek
+1 received by user: 459
Inactive user

#824328 23-May-2013 19:13

There are a number of modems that suffer from poor security...

Feel free to read about how the Internet Census 2012 was done.....

Thankfully all Telecom supplied modems don't suffer from this problem as we check them before the firmware gets signed off. Can't say the same for all modem providers.

So now the real question. Since the internet census is out there is the onus on customers who are running non Telecom supplied modems that are insecure be on the ISP? Or does responsibility fall on the customer?

freitasm

BDFL - Memuneh
80696 posts

Uber Geek
+1 received by user: 41151

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#824333 23-May-2013 19:17

I think if the customer buys/uses a cheap modem not supplied by the ISP then all traffic and implications of lack of security lies on customer.

Same as running a PC without antivirus then having problems...

/Devil's Advocate

Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

cyril7

9075 posts

Uber Geek
+1 received by user: 2499

ID Verified

Trusted

Subscriber

#824334 23-May-2013 19:22

plambrechtsen: There are a number of modems that suffer from poor security...

I dont think this counts as poor security, there are other words not suitable for prime time to describe such incompetence.

Cyril

1 | 2 | 3 | 4