User comments on ISPs
  >> Virgin Media (Cable)


Register (or login) on our website and you will not see this ad.


  Print Thread
Standard User jamesmacwhite
(learned) Wed 21-Oct-20 18:55:22
Print Post

Has TR-069 always been open on Virgin Media routers?


[link to this post]
 
I got an alert from shodan.io on a previous Virgin Media IP address I had monitored until it changed recently (I suspect network segmentation work in my area).

The alert was saying TCP 7547 is open on the WAN side which CWMP/TR-069. I know a lot of ISPs use this, but I've never seen it open directly before on Virgin Media. I use modem mode so might have never noticed, but looking at my parents Virgin Media IP, it isn't open, yet shodan.io is showing over 200k Virgin Media IPs in various areas:

https://beta.shodan.io/search?query=org%3A%22Virgin+...

This is also going up every few minutes. Have Virgin Media changed something on mass here?
Standard User Moto
(fountain of knowledge) Wed 28-Oct-20 06:20:26
Print Post

Re: Has TR-069 always been open on Virgin Media routers?


[re: jamesmacwhite] [link to this post]
 
Closed on my hub 2 but Virgin's support site has a thread discussing it which contains:

I've had an update from the team for you.

They have advised that this is a standard port that is seen open by the team. It is used for communications to the Modem for updates and Virgin media back office diagnostics.

I hope that helps to clear things up.

Thanks

Melissa


I see you have joined that discussion. What I haven't seen is someone pointing out that as one would expect access to that port be limited to sources within Virgin's management network, the fact that that port is open to shodan.io's network suggest Virgin has forgotten to limit access on a number of their networks.

laugh A friend surfing in laugh

Edited by Moto (Wed 28-Oct-20 06:44:10)

Standard User jamesmacwhite
(learned) Wed 28-Oct-20 08:32:44
Print Post

Re: Has TR-069 always been open on Virgin Media routers?


[re: Moto] [link to this post]
 
In reply to a post by Moto:
Closed on my hub 2 but Virgin's support site has a thread discussing it which contains:

I've had an update from the team for you.

They have advised that this is a standard port that is seen open by the team. It is used for communications to the Modem for updates and Virgin media back office diagnostics.

I hope that helps to clear things up.

Thanks

Melissa


I see you have joined that discussion. What I haven't seen is someone pointing out that as one would expect access to that port be limited to sources within Virgin's management network, the fact that that port is open to shodan.io's network suggest Virgin has forgotten to limit access on a number of their networks.


Hi,

Yes I came across that recent post. I have actually pointed this out in that thread as it's my whole argument around sites like Shodan suddenly indexing TCP 7547 open on over 1.5 million Virgin Media routers now and climbing, suggesting if this was happening before you'd have thought Shodan would have had it indexed a long time ago but it seems very recent, given how I've seen the number go from 235,000 to 1.5 million in the space of around a week.

I asked someone who has a contact at Virgin Media for clarification on it if it some recent change. I don't know if they will get a response. It's certainly not the first time a router has been seen with TR-069 open, but I've not ever noticed it on Virgin Media routers before.

This is what I know, without any official comment.

* TCP 7547 is not open on every single router (Confirmed as my mother is VM customer in the same area ref in router mode and it's not open on hers)
* If you are in Modem Mode then it won't be open, but VM can still access the modem side through their management network.
* Shodan seems to be suddenly indexing this port on mostly Virgin Media UK IP addresses, but it does have results for VM Business and VM Ireland (much lower results)
* This seems to have started happening around 21st October


Register (or login) on our website and you will not see this ad.

Standard User j0hn83
(fountain of knowledge) Sun 01-Nov-20 11:31:16
Print Post

Re: Has TR-069 always been open on Virgin Media routers?


[re: jamesmacwhite] [link to this post]
 
https://www.ispreview.co.uk/index.php/2020/11/isp-vi...
Standard User jamesmacwhite
(learned) Sun 01-Nov-20 11:32:58
Print Post

Re: Has TR-069 always been open on Virgin Media routers?


[re: j0hn83] [link to this post]
 
Thanks for your reply. I'm the one who tipped Mark about it. Virgin Media seem to acknowledge it's open, but why it's suddenly open widely still remains a mystery.
  Print Thread

Jump to