Kitz ADSL Broadband Information
adsl spacer  
Support this site
Home Broadband ISPs Tech Routers Wiki Forum
 
     
   Compare ISP   Rate your ISP
   Glossary   Glossary
 
Please login or register.

Login with username, password and session length
Advanced search  

News:

Pages: [1] 2

Author Topic: BT Home Hub 3 Ports 161 4567 permanently open  (Read 31532 times)

bbnovice

  • Reg Member
  • ***
  • Posts: 267
BT Home Hub 3 Ports 161 4567 permanently open
« on: March 05, 2012, 08:09:17 PM »

Hi,

I hope I’m posting this in the correct section of the forum…..

I recently acquired a BT Home Hub 3 as part of my new Infinity installation.

I’m surprised to learn that this router has ports 161 and 4567 permanently exposed to the internet and that this is “hardwired” by BT and that the end user cannot change this behaviour.

Browsing other forums I learn that HH3 users (this issue does not affect earlier versions) are getting very irate over this issue and some are regarding it as a serious security breach by BT. And BT does not appear to have helped itself by initially giving obviously misleasding answers to the question as to why they are doing this. Paranoia reigns over BT’s motives.

Some are relaxed over this and taking the view that port stealthing is “security by obscurity” so is not effective anyway. Others are taking a diametrically opposed viewpoint and regard it as creating an opportunity for open season on HH 3 users by  hackers.

I’ve searched this forum and have not found any threads on this subject so thought I would ask for your views.

By the way I’m not trying to whip up BT hysteria as I don’t think it will achieve anything as rants on forums is unlikely to influence their behaviour. I’m more interested in the possible security situation – and I’ve never owned a router before that exhibited any behaviour like this.

Regards

BBN
Logged

burakkucat

  • Respected
  • Senior Kitizen
  • *
  • Posts: 38300
  • Over the Rainbow Bridge
    • The ELRepo Project
Re: BT Home Hub 3 Ports 161 4567 permanently open
« Reply #1 on: March 06, 2012, 12:06:02 AM »

Hmm. :hmm:  I had to look up those ports -- SNMP and TRAM, respectively. I wonder why those ports are open?

Why not purchase a Type 2, BT Business Hub, V3.0 (a.k.a. a 2Wire 2701HGV-C) from eBay and replace the HH3?

This is what I see, using "GRC | ShieldsUP" for a quick scan of those ports, on my line --

Quote
GRC Port Authority Report created on UTC: 2012-03-05 at 23:56:34

Results from scan of ports: 161, 4567

    0 Ports Open
    0 Ports Closed
    2 Ports Stealth
---------------------
    2 Ports Tested

ALL PORTS tested were found to be: STEALTH.

TruStealth: PASSED - ALL tested ports were STEALTH,
                   - NO unsolicited packets were received,
                   - NO Ping reply (ICMP Echo) was received.

Needless to say I am a user of a 2Wire device. ;)

Edit: If you decide to try a 2Wire 2701HGV-C and are confused by the various items available on eBay, send me a PM and I will look up some suitable links for you.
« Last Edit: March 06, 2012, 12:09:08 AM by burakkucat »
Logged
:cat:  100% Linux and, previously, Unix. Co-founder of the ELRepo Project.

Please consider making a donation to support the running of this site.

bbnovice

  • Reg Member
  • ***
  • Posts: 267
Re: BT Home Hub 3 Ports 161 4567 permanently open
« Reply #2 on: March 06, 2012, 03:59:36 PM »

Hi B_cat

On the BT user forum, BT initially said that these ports were left open to speed up gaming. When it was proved by those in the know that this was horse manure they changed tack. They then claimed it was for network management reasons but have refused to expand on this. As a result they have a lot (more) angry users.  Personally I think its a waste of energy persuing that avenue, but I'm still curious about others opinions concerning the security implications of leaving these ports open.

Thank you for your 2Wire recommendation and kind offer to send me appropriate links on ebay. In fact you already did that when I first posted about hardware a couple of weeks ago and before I migrated to Infinity.  In fact I followed up one of your links and am the proud owner of a new unboxed 2Wire which I got for £10 - unfortunately I missed the one that went for 99p! I originally intended it as backup for the HH, but I may swap it and use the HH for that purpose once my 10 day settling in period is over.

Regards

BBN

 
Edit: BTW here is the link to the BT community. There are also threads on the same subject on other forums.
http://community.bt.com/t5/BB-Speed-Connection-Issues/port-161-open-on-home-hub-3/td-p/133207
« Last Edit: March 06, 2012, 04:04:37 PM by bbnovice »
Logged

asbokid

  • Kitizen
  • ****
  • Posts: 1286
    • Hacking the 2Wire
Re: BT Home Hub 3 Ports 161 4567 permanently open
« Reply #3 on: March 06, 2012, 08:55:26 PM »

Hi bb,

The comment at the end of that thread from El-Buzzo is only correct to a point..

El-Buzzo writes:

Quote
"To all those annoyed that BT even does this: Quit whining. Not everything is a **bleep** conspiracy. Complaining won't help. You can get rid of your hub if you want, but frankly I'm happy with my hub and see no reason to dump it; its security holes - intentional or not, whatever their reasons - can be safely sealed by the end user with just a little know-how, without impacting security or performance."

Forwarding inbound traffic to those two ports is El-Buzzo's solution.  It's not necessarily a full solution though.  The HomeHub could just as equally 'phone home' periodically.  That is what the Huawei and the ECI VDSL2 modems, and the BT BusinessHubs are programmed to do.  Since the HH3b remains unhacked, no one can say for sure whether it 'phones home' or not.

There is a lot to be said for open source firmware, whether in residential gateways, home portals, mobile devices, networked set-top-boxes, or whatever.

Personally, I wouldn't be too bothered about it.  BT has packet-level access throughout the rest of the network any way.  As long as the security protocols have been implemented properly in the client and the server, and key-management remains sound, there shouldn't be a problem.

Nevertheless, it would be interesting to see what can be done remotely with the HomeHub.  It's not certain what services are listening on those two ports.  Port numbers are only indicative.  For example, the Huawei HG612 also has a network service listening on udp/161 and tcp/161, but it is not an snmp service.  It is a bespoke daemon called btagent for remote management. 

Code: [Select]
# netstat -nltu
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 0.0.0.0:161             0.0.0.0:*               LISTEN     
tcp        0      0 127.0.0.1:2600          0.0.0.0:*               LISTEN     
tcp        0      0 127.0.0.1:8011          0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:23              0.0.0.0:*               LISTEN     
udp        0      0 0.0.0.0:161             0.0.0.0:*                           
udp        0      0 0.0.0.0:67              0.0.0.0:*                           
udp        0      0 0.0.0.0:69              0.0.0.0:*     

As for the HomeHub3, it's anybody's guess what type of server is listening on (tcp?) port 4567.

Have you tried to connect to the port 4567 service with telnet or netcat?  If so, what does it reveal?

cheers, a
« Last Edit: March 06, 2012, 09:24:48 PM by asbokid »
Logged

burakkucat

  • Respected
  • Senior Kitizen
  • *
  • Posts: 38300
  • Over the Rainbow Bridge
    • The ELRepo Project
Re: BT Home Hub 3 Ports 161 4567 permanently open
« Reply #4 on: March 06, 2012, 11:44:28 PM »

Quote
Thank you for your 2Wire recommendation and kind offer to send me appropriate links on ebay. In fact you already did that when I first posted about hardware a couple of weeks ago and before I migrated to Infinity.  In fact I followed up one of your links and am the proud owner of a new unboxed 2Wire which I got for £10 - unfortunately I missed the one that went for 99p! I originally intended it as backup for the HH, but I may swap it and use the HH for that purpose once my 10 day settling in period is over.

BBN -- Obviously b*cat is getting forgetful.  :o  Oops!  :blush:

Just a small point about the last phrase in the quote, above. There is no "10 day settling in period". As long as the modem has been connected to the VDSL2 port (on the SSFP at the NTE5/A) and powered up for 24 hours, everything is configured. The router -- your LAN side of the modem -- is irrelevant to the process. The process only involves a bout of training between the DSLAM in the FTTC and your VDSL2 modem.  :)
Logged
:cat:  100% Linux and, previously, Unix. Co-founder of the ELRepo Project.

Please consider making a donation to support the running of this site.

bbnovice

  • Reg Member
  • ***
  • Posts: 267
Re: BT Home Hub 3 Ports 161 4567 permanently open
« Reply #5 on: March 07, 2012, 04:32:46 PM »

Hi b*cat

BT told me that there is a 10 day training period for Infinity. Thats what I meant by settling in.

I had phoned them about my speed dropping a few days after installation from 37Mbs (BT speed tester)  to very low levels indeed - even had it as low as 4Mbs which is just about the same as the ADSL line I had previously. Profile confirmed as still being at 38Mb. Weird thing the upload speed has hardly moved from the original 8Mbs.

So they are not very interested in listening to me until the 10 days is up.
 
Don't understand what is happening here. The cabinet is only about 200 metres away.

Perhaps I should start another thread on the FTTC issies part opf the forum?
BBN
Logged

burakkucat

  • Respected
  • Senior Kitizen
  • *
  • Posts: 38300
  • Over the Rainbow Bridge
    • The ELRepo Project
Re: BT Home Hub 3 Ports 161 4567 permanently open
« Reply #6 on: March 07, 2012, 08:07:00 PM »

What might help you to regain your higher DS speed would be to power off the HH3 for a couple of minutes before powering it back on. Just use the switch on the back of the HH3 (left-hand end) . . .

Don't worry about it too much but the BT person, who said that there is a ten day training period, seems to be a numpty! The only important period is the first 24 hours.  :)

Perhaps Mr Eagle will be able to give you some advice, when he next passes by?
Logged
:cat:  100% Linux and, previously, Unix. Co-founder of the ELRepo Project.

Please consider making a donation to support the running of this site.

Bald_Eagle1

  • Helpful
  • Kitizen
  • *
  • Posts: 2721
Re: BT Home Hub 3 Ports 161 4567 permanently open
« Reply #7 on: March 07, 2012, 09:37:47 PM »


BT told me that there is a 10 day training period for Infinity. Thats what I meant by settling in.

I had phoned them about my speed dropping a few days after installation from 37Mbs (BT speed tester)  to very low levels indeed - even had it as low as 4Mbs which is just about the same as the ADSL line I had previously. Profile confirmed as still being at 38Mb. Weird thing the upload speed has hardly moved from the original 8Mbs.



Wandering off topic a bit here, but.....................

BT's own document (SIN 498) has this to say about DLM & the training period:-

2.2.5 Dynamic Line Management

Dynamic Line Management (DLM) is employed in GEA-FTTC. DLM constantly manages lines to maintain a target stability.
It does this for as long as the product exists.

At provision, the line is put on wide open profiles, allowing downstream line speeds of up to 40Mbit/s, and upstream line speeds of up to 2Mbit/s or 10Mbit/s depending on the upstream product option selected.

On the first day of operation, DLM will intervene if severe instability is detected.
Otherwise, DLM will wait until the day after provision before intervening, provided that the line has been trained up for at least 15 minutes during the preceding day.

If DLM intervenes it will set a capped profile with a maximum rate and a minimum rate, where the minimum rate is set at approximately half of the maximum rate.

The purpose of the minimum rate is to ensure that the line does not train at a rate which is significantly below the level the line should be able to achieve. If this happened, then the line is likely to remain at a very low rate till a re-train is forced by the user powering off the Active NTE.


I & some other FTTC users have noticed that the HG612 modem has a habit of re-syncing "on the fly".
These "on the fly" re-syncs are far too quick to be detected by most ISPs & thus the current PPP session & dynamically allocated IP addresses are maintained.

As IP BT's Profiles are only recalculated whenever a new PPP session is started, it is very feasible (& my connection has proven it countless times) that the modem could quickly sync at a very low or high speed, yet the IP Profile does not change.
This appears to confuse ISP & even BT customer service agents, who then start to talk about ficticious 10 day training periods.

One way to recalculate IP Profiles is to disconnect/reconnect the HG612 modem & force a new PPP session.
This can be quite drastic as DLM may see this as instability & set a lower sync speed in order to provide stability.

A less drastic way is to disconnect/reconnect the router/hub to force a new PPP session & thus recalculate the real IP Profile. As the modem stays in sync, DLM will not take any action.

Now, a 40Mb sync speed (39999k) should provide an IP Profile of 96.79% for FTTC connections (38716k), probably now reported by the updated BT speed tester as 38.72Mb, or some very close value.

Actual throughput speed can vary drastically for many reasons, such as contention at peak periods, the modem having resynced "on the fly" at a very low speed due to massive error counts, ending up with a "stuck" IP Profile etc. etc.

At a quiet time (no contention) throughput speeds as reported by speedtest.net are usually around 96% to 97% of the IP profile for FTTC connections.

As an example, my router reconnected a few days ago (reason unlnown), resulting in an IP Profile of a bit ovwr 14Mb.
Throughput was only 14Mb, but I could see the modem was still synced at the 23.67Mb oit had been at for a few days.
I reset the router & the IP Profile immediately returned to 22.91Mb (96.79% of sync speed), giving throughput of just over 22Mb.

I chose not to force a full modem resync as I have an engineer's visit booked for tomorrow & wanted to demonstrate that my connection is under-performing when he arrives.
Logged

burakkucat

  • Respected
  • Senior Kitizen
  • *
  • Posts: 38300
  • Over the Rainbow Bridge
    • The ELRepo Project
Re: BT Home Hub 3 Ports 161 4567 permanently open
« Reply #8 on: March 08, 2012, 12:41:05 AM »

Thank you for those words and the quotation from SIN 498, BE. I'm pleased to see that you have agreed with me --

Quote
A less drastic way is to disconnect/reconnect the router/hub to force a new PPP session & thus recalculate the real IP Profile. As the modem stays in sync, DLM will not take any action.

 :graduate:
Logged
:cat:  100% Linux and, previously, Unix. Co-founder of the ELRepo Project.

Please consider making a donation to support the running of this site.

bbnovice

  • Reg Member
  • ***
  • Posts: 267
Re: BT Home Hub 3 Ports 161 4567 permanently open
« Reply #9 on: March 08, 2012, 07:08:23 PM »

Hi B*cat and Mr Eagle,

I'm afraid I'm a bit behind the 8 ball at the moment (called in to look at yet another yet NHS IT problem - read b*llsup - which has taken up all my time).

I think I understand what you have said but need time to digest it (I'm more of an application developer/project manager than comms expert).

I am all at sea regarding how in reality my connection is actually performing - it was easy in the ADSL days with Netgear and RouterStats. I'm still experiencing real difficulties in getting a reliable set of stats to use as a benchmark and which I understand. The speedtest sites (including BT's own) seem to peform in very weird ways sometimes (and are very inconsistent both compared with each other and also on their own results for test performed very close together). My XP related issues (which was the subject of another thread I created - which was very helpfully answered by you guys) did not help.

Anyway I'm wandering off the topic of this thread so what I think I'll do is start another thread once I've got my head around the problem.

Meanwhile....many thanks for perservering with a comms novice.

Regards
BBN       
Logged

Bald_Eagle1

  • Helpful
  • Kitizen
  • *
  • Posts: 2721
Re: BT Home Hub 3 Ports 161 4567 permanently open
« Reply #10 on: March 08, 2012, 10:53:19 PM »

Hi BBN,


I am all at sea regarding how in reality my connection is actually performing - it was easy in the ADSL days with Netgear and RouterStats. I'm still experiencing real difficulties in getting a reliable set of stats to use as a benchmark and which I understand. The speedtest sites (including BT's own) seem to peform in very weird ways sometimes (and are very inconsistent both compared with each other and also on their own results for test performed very close together). My XP related issues (which was the subject of another thread I created - which was very helpfully answered by you guys) did not help.
 

The ONLY current way to gather a set of reliable stats that look quite like RouterStats is to unlock the modem & use the graphing scripts.
They work straight out of the box with XP, Vista & Windows 7. (& they are free!)

Regardless of throughput speeds from speed tests, they will show you everything you would want/need to know about your connection.

Cheers,

Paul
Logged

PsiDOC

  • Just arrived
  • *
  • Posts: 2
Re: BT Home Hub 3 Ports 161 4567 permanently open
« Reply #11 on: April 15, 2012, 08:06:56 PM »

Port 161 is BT's access to your router. Not a lot of people know that BT have access to any home hub from V2 on at any time whilst it is switched on. I took them to task about this on their forum when the introduced it quietly 2 years ago in the 2A and 2B they initially denied it, then admitted it then denied it again. For my efforts I was also temporarily banned off their forums so I guess I struck a raw nerve.
Anyhow this can be switched off in the router if it's a 3A by unlocking it (or at least getting CLI access) by using the command:
Code: [Select]
conf set bt/bt_agent/enabled 0
conf reconf 1
Port  4567 is a throwback from the OpenRG software and it's not defunct TR-069 management. The hub now uses ACS for updates not TR-069. YOu can again block this on the 3A if you have CLI access by putting a rule in the firewall.

Psi
Logged

burakkucat

  • Respected
  • Senior Kitizen
  • *
  • Posts: 38300
  • Over the Rainbow Bridge
    • The ELRepo Project
Re: BT Home Hub 3 Ports 161 4567 permanently open
« Reply #12 on: April 15, 2012, 08:33:43 PM »

Very interesting, Psi. But what about the HH3.0B? Any progress? Any developments?

I ask because when I last checked your site, there was absolutely no reference to the currently supplied HH3.0B:-\
Logged
:cat:  100% Linux and, previously, Unix. Co-founder of the ELRepo Project.

Please consider making a donation to support the running of this site.

ben1066

  • Member
  • **
  • Posts: 74
Re: BT Home Hub 3 Ports 161 4567 permanently open
« Reply #13 on: April 15, 2012, 08:37:10 PM »

I have a HH3B and HH2A sitting here if they can be used for anything I'll be happy to help. Neither are in use.
Logged

PsiDOC

  • Just arrived
  • *
  • Posts: 2
Re: BT Home Hub 3 Ports 161 4567 permanently open
« Reply #14 on: April 16, 2012, 09:37:40 PM »

B*cat.
In a word no mate. Not even seen one aside from the pictures on here.
Unlocking should not be a problem. It from what I can glean off the internet it's an openrg esque firmware so should be like the 2B / 3A unlock.
The hard part will be getting access to a cli. I am 99% sure that BT closed the simlink loophole we use to get access on the 2B and 3A from the initial firmware upwards so it may be hardware on the console port to unlock initially.

Psi
Logged
Pages: [1] 2