[Supervisor login from 194.134.170.2] Zyxel security breach?

[Jonjuin]

Good morning,

I have been looking into the Security Logs from my Zyxel VMG8324-B10A router provided by Online.nl and for some reason I see the following in multiple days and multiple times a day (same situation with my previous router which has been replaced days ago):

"User supervisor login from 194.134.170.2 succesful"


The following are facts:
-This is an SSH succesful connection attemp to my router from outside my network.
-This IP is from my ISP provider https://www.findip-address.com/194.134.170.2.
-In the Zyxel admin panel / GUI there is no "supervisor" account, only Admin.
-I cannot access the router via SSH (I guess I can re-import the config file with the adjusted settings for ssh but that is not the issue discussed here).
-I can access the router via Telnet and there I can only see the Admin account using the embedded commands.
-Router documentation states that 4 login accounts are present by default: root, admin, supervisor and guest. Although I only see Admin.
-When exporting the Zyxel configuration via "Maintenance > Configuration > Backup Configuration", I see the following lines at the bottom of the exported "configuration-backupsettings.conf" config file:
<X_5067F0_AccessServiceCfg>
<SshStatus>TRUST_ONLY</SshStatus> <TrustDomainIP>194.134.170.2@194.134.191.85@83.119.32.10@</TrustDomainIP>
<CustomerWebRedirection>url</CustomerWebRedirection>
</X_5067F0_AccessServiceCfg>

I understand that the ISP needs to be able to update my router configs when required.
But I have now serious security concerns. That have connected to my router every day and multiple times per day, what are they looking at? Are they also tapping and listening to the traffic that goes inside my local network? Who has the supervisor credentials and how do they store them and why?


The service desk technicians from Online.nl state that they are not aware of the "supervisor" account. They also stated that they cannot see the security logs of my router because of privacy and they cannot provide further support, but it is clear that their systems have full control over the router (including its logs).

Have you experienced the same? Should we be worried? Is this a security breach? Have they been affected by SolarWinds and their systems are trying to hack into everybody's homes? I'm not trying to be alarmist but I need more clues.

Regards

[laurens0619]

To start, compliments on your analysis and that you were able to find out the source of the events (from backup settings export, nice). You should become a security analyst

I would not be that worried, all providers have backend connections to their modems to monitor status,uptime, performance etc..
I would expect just 1 persistent session but maybe their backend is polling the status of the modems on a regular interval for health status

If you don't trust your ISP, you should cancel your subscription If they want to listen to the traffic, they don't need to connect to your modem as they simply could also check their local switch to which you are connected.

I don't think this is related to Solarwinds, just normal behavior of your ISP

[ Voor 8% gewijzigd door laurens0619 op 21-12-2020 16:19 ]

[Cliff]

I have exactly the same behaviour and looking at the times, it seems scripted:



It does trigger some paranoia at my end too. But I think this is standard behavior.

I have asked Online.nl about this but they have never replied.

It's always the same with ISP's. Their helpdesks suck. Does anyone know an ISP with a helpdesk that you can actually send an Email and get a reply from? Let me know

[laurens0619]

Ik snap niet zo goed waarom een helpdesk slecht is als ze jou geen inzicht willen geven hoe ze hun modem beheren..

Is toch niet jouw apparaat? En het ip hoort bij de provider, dus maak je je ergens zorgen om?
Het enige effect wat je met een kritische toon gaat hebben is dat een provider een modem de volgende keer dichtzet en je als gebruiker helemaal niets meer ziet (ook geen malicious logins)

Lekker doorgaan met je leven dus

[Rob]

laurens0619 schreef op vrijdag 11 juni 2021 @ 13:10:
Ik snap niet zo goed waarom een helpdesk slecht is als ze jou geen inzicht willen geven hoe ze hun modem beheren..

Is toch niet jouw apparaat? En het ip hoort bij de provider, dus maak je je ergens zorgen om?
Het enige effect wat je met een kritische toon gaat hebben is dat een provider een modem de volgende keer dichtzet en je als gebruiker helemaal niets meer ziet (ook geen malicious logins)

Lekker doorgaan met je leven dus

De provider levert een product. Met de interface van dit product kun je rechtmatige en onrechtmatige inlogpogingen zien. Maar de helpdesk kan niet duidelijk aangeven of een vaak voorkomende login van hunzelf komt of dat iemand wel de boel gehackt heeft. Ik verwacht van de helpdesk dat zij kunnen aangeven dat het een veilig IP is of dat ze een onderzoek gaan doen.