Date: Fri, 17 May 2013 16:16:11 -0400
From: Justin Elze <formulals1@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: My ISP is routing traffic to private
	addresses...

This is pretty common practice for ISPs to use private RFC IP space and
route it via iBGP/OSPF/ISIS on their network.

However they don't export this space to the rest of the internet


On Fri, May 17, 2013 at 4:04 PM, sec <sec@...tsploit.me> wrote:

> **
> [At least] TWC has a vast mishmash of vendors and models and device types,
> depending on what they were bidding for and when, and how much outdated CPE
> they've been able to or even attempted to reclaim / replace. I would
> hesitate to endorse a blanket statement that they don't do this any more.
>
> This is extremely common practice (malpractice?): add Cox to the list of
> current RFC1918 leakers.
>
>
> On 2013-05-17 15:20:12 (-0400), Joshua Zukerman wrote:
>
> Time Warner Cable (roadrunner) used to have this problem. They used the
> 10.x.x.x in various subnet masks for backend management IP addresses on all
> of their customer cable modems, plus whatever other network equipment they
> had. 2600 mag had an article a few years ago discussing this very issue. I
> assume RCN is also a cable internet provider, so my guess is your issue is
> one in the same. I can safely report that TWC is now filtering out those
> from the ethernet side of the cable modem (has been for about a year or
> so), so I cannot see any other 10.x.x.x networks outside of my own.
> Probably done via the cable modem config & ACLs.
>
>
> On Fri, May 17, 2013 at 3:08 PM, kyle kemmerer <krkemmerer@...il.com>wrote:
>
>
> So today when trying to access a device on my network (172.30.x.x range) I
> was taken to the web interface of a completely different device.  This
> baffled me at first, but after a bit of poking around, I determined that my
> ISP was actually routing traffic to these addresses.  See the trace below
>
>
> Tracing route to 172.30.4.18 over a maximum of 30 hops
>
>   1    11 ms    18 ms    19 ms  XXXXXXXXX
>   2    30 ms   178 ms   212 ms  vl4.aggr1.phdl.pa.rcn.net [208.59.252.1]
>   3    13 ms    18 ms    13 ms  tge0-1-0-0.core1.phdl.pa.rcn.net[207.172.15.50]
>
>   4    37 ms    39 ms    57 ms  tge0-0-0-2.core1.lnh.md.rcn.net[207.172.19.227]
>
>   5    35 ms    34 ms    32 ms  tge0-1-0-1.core1.chgo.il.rcn.net[207.172.19.235
> ]
>   6    42 ms    38 ms    39 ms  port-chan13.aggr2.chgo.il.rcn.net[207.172.15.20
> 1]
>   7    37 ms    39 ms    39 ms
> port-chan1.mart-ubr1.chi-mart.il.cable.rcn.net [
> 207.229.191.132]
>    8    57 ms    61 ms    53 ms  172.30.4.18
>
> Trace complete.
>
>
> So I break out nmap and do a quick scan, and find that there are thousands
> of these devices across this IP range.  Has anybody ever seen anything like
> this?  Surely this must be a mistake, right? If anybody else is using RCN
> as an ISP, can you access these addresses as well?
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>



-- 
IMPORTANT NOTICE: This e-mail and any attachments thereto is intended only
for use by the individual or entity to whom it's addressed and may be
proprietary and/or legally privileged. If you are not the intended
recipient of this e-mail, you are hereby notified that any dissemination,
distribution or copying of this email, and any attachments thereto, without
the prior written permission of the sender is strictly prohibited.   If you
receive this e-mail in error, please immediately telephone or e-mail the
sender and permanently delete the original copy and any copy of this
e-mail, and any printout thereof.

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists