Hacking ISPs with PPPoE

The talk treats internet service provider access equipment as a target, arguing it resembles a home router in its exposure and its rarely patched state. The speaker explains that a subscriber's modem reaches the provider's broadband remote access server over a layer 2 link, so that server can be approached from the customer side. Possible impacts discussed include outages, DNS redirection across a whole customer base, and access to individual subscriber records.

The research focused on a Redback Smart Edge unit running a NetBSD-derived system on PowerPC. Walking through PPPoE and the link control phase, the speaker found that one LCP option, the endpoint discriminator, was accepted with oversized length and no data checks. Logging copied that field into a fixed-size stack buffer, producing an overflow. A live demo crashed the daemon and gave root command access. Since IP reachability could not be assumed, a layer 2 only shell was built, using packet capture facilities on the device to receive commands in stages. A second flaw, where broadcast session termination was sent to all clients, was also covered.

Practical lessons covered how to start such research without the hardware: emulating user space, cross-compilation pitfalls, debugger workarounds, and buying a cheap used unit to learn the ISP-side setup from long manuals. The vendor, Ericsson, assigned CVEs and confirmed the product had reached end of life. The speaker estimated around 500 exposed devices across about 20 countries. Suggested mitigations were disabling PPP logging, filtering broadcast traffic at the switch, and replacing old hardware.