gpwn Wiretapping fiber GPON ISP deployments from the comfort of your home

The talk opens with a fiber installation the speakers followed step by step, then asks where a household gets separated from its neighbors when the street splitter is purely passive. It explains GPON, the fiber-to-home standard whose downstream broadcast relies on optional encryption that many vendors ship switched off. Basic terminology is covered: the line terminal at the provider, the subscriber unit at each home, and the passive tree linking them.

Using a consumer subscriber unit built on a Realtek chipset, the researchers bypassed several filtering layers to capture downstream frames from neighbors. The captures showed unencrypted DNS, POP3, SIP and RTP, along with GTP-tunneled 4G and 5G backhaul from nearby towers. They also showed that unsecured street splitters allow upstream capture. On the provider side, they fuzzed the provisioning handshake on a white-label line terminal, found that injected HTML rendered in an administrator's discovery page, and chained it to a command injection that yielded root.

Control of the terminal exposes subscriber encryption keys, lawful-intercept features, and firmware pushes to every connected unit, which can reach customer routers. Recommendations cover locking splitters, enabling downstream encryption, patching line terminal firmware, and not relying on the ISP for privacy. The team released a tool for scanning gem ports and recording traffic, and said the vendor only partly fixed the flaw after about 90 days.