Re: [Security Weekly] Is PPoE/A security important?

[Bacon Zombie <baconzombie () gmail com>]

If they have DHCP option 82 enabled then your packets yet tagged with the
Username, and hostname + port number of the DSLAM you are connected to so
they would know who you really are if they looked at their logs.
On 1 Aug 2014 15:15, "Lutz Schildt" <ls () lsmooth de> wrote:

> If you had someones PPPoA username and password, you'd also have to be
> connected to the same ISP to do anything with it since only the BRAS of
> that ISP (or of some ISP using that ISPs infrastructure) would accept the
> credentials. You might be able to login and use that connection depending
> on the ISP in question.
>
> Let's assume you get a session. In that case you might be able access the
> Internet, but not as if you were that person. You would just be using his
> credentials and his account. If the account is capped the person will
> probably notice that something is up when all of a sudden he reaches his
> transfer-volume-cap while normally not even getting close to it. Also if
> you'd be doing stuff you shouldn't (besides committing a crime by using his
> credentials) they'd probably first be turning to him but the ISP could
> still trace it back to your line.
>
> What would be worse would probably be the fact that many ISPs use the same
> credentials (at least the password) for the main-email-address and/or the
> customer website to manage email-addresses etc. you get which in turn means
> you could access his or her emails, possibly private information. So if you
> get access to usernames and passwords of an ISP that does that would likely
> mean access to lots of information and also email-accounts and with those
> access to whatever the person uses those accounts for.
>
> Am 30.07.2014 19:15, schrieb James Woolley:
>
> > Does anyone know how important the PPPoE/A authentication details
> > provided by your ISP? If there was a method to enumerate other peoples
> > usernames and passwords. Would this be a problem?
> >
> >
> > For example. If I knew someone’s PPPoA username and password, could it be
> > configured on my home router and browse the internet as though I was that
> > person? (in the eyes of the ISP).
> >
> >
> > I can find a lot of information on what PPPoE/A is, but not much on how
> > the ISP use the details.
> >
> >
> >
> > _______________________________________________
> > Pauldotcom mailing list
> > Pauldotcom () mail securityweekly com
> > http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom
> > Main Web Site: http://pauldotcom.com
>
> _______________________________________________
> Pauldotcom mailing list
> Pauldotcom () mail securityweekly com
> http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom
> Main Web Site: http://pauldotcom.com
_______________________________________________
Pauldotcom mailing list
Pauldotcom () mail securityweekly com
http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom
Main Web Site: http://pauldotcom.com