By Claus Hetting, WiFi NOW CEO & Chairman
Plume is well known for its home Wi-Fi optimisation services – and more recently for its expanding portfolio of operational services for ISPs (read about it here) – but few are aware that the company is now investing significantly in ISP security and research. Plume’s newly established Security Labs has uncovered serious problems with a certain class of ‘SuperBox’ streaming media devices, the company says.
Affected home subscribers may not notice in the least that their SuperBox media streaming player has been commandeered to become a node in a clandestine commercial residential proxy network, meaning the device has become a SuperProxy for nefarious activities. The problem was recently flagged as a possible security breach by Plume’s NOC and since investigated. Plume’s Security Labs has now released a research paper outlining the findings and the threat.
“We’ve always used machine learning to identify anomalies but we’ve recently expanded our AI capabilities in order to monitor how home devices are connecting across the LAN and the WAN. Excessive uplink activity flagged the issue and we’ve now completed the technical investigation. It turns out that SuperBox devices – depending on the app – can accept connections without authentication, opening tunnels to remote command servers,” says Plume CTO Chris Griffiths.
The behaviour resembles commercial residential proxyware schemes that monetise consumer devices by routing third-party traffic through home networks, which in some cases can severely impact ISP services. Plume established its Security Labs about a year ago for the specific purpose of uncovering and resolving challenging security issues, Plume says.
Plume manages hundreds of millions of home broadband devices and their connections via its services, which means security breaches can be discovered and resolved early and before they spread. “Scale works to our advantage in various ways. These types of problems tend to spread quickly but if we can discover them early as a small anomaly across millions of households, we can stop the spread. This also means that all of our hundreds of ISPs clients will immediately benefit even if only a small number has been affected initially. This is one of the benefits of a large footprint,” Chris Griffiths says.
Plume clients also benefit from the company’s integrated approach to security as opposed to incorporating third-party solutions that typically would not have access to the full device and connectivity management data set. The large telemetry data set is what feeds AI engines and ultimately makes the discovery of new security threats possible, Chris Griffiths says.
Degrading ISP services
Plume says SuperProxy boxes in the worst case deliver unusually high volumes of uplink traffic, adding to data streams from legitimate users. This potentially disrupts ISP infrastructure and degrades services. “We’re now helping our ISP clients so that they have the right provisions and tools in place to tackle and remove this problem. And we’re committed to helping resolve new industry security issues before they impact our customers and their subscribers, which is why we’re issuing the research paper. Of course neither ISPs nor subscribers want unauthorised and illegal services running on their devices or networks,” he says. The research paper can be found here.
Meanwhile, governments across the world are ramping up cybersecurity regulation. Singapore’s Cyber Security Agency has certified a Plume-integrated CPE at Level 4 of the Cybersecurity Labelling Scheme, the scheme’s highest tier, which requires structured third-party penetration testing.
“This means a national cybersecurity authority has independently verified, through third-party penetration testing, that certified hardware running Plume meets Singapore’s most rigorous router security standard. Separately, subscribers running Plume get contextual protection for every device in the home, including devices the operator did not certify and cannot see into,” Griffiths says.
Plume Security Labs new research paper can be found here.
/Claus.
