Summary
When we think about security threats, we generally imagine them coming from far away across the wider internet. But what if the connection between you and your ISP was the target? [Rithwik Jayasimha] and [Rithvik Vibhu] have explored how fiber to the home connections may not be as secure as you would hope. The hack centers around fiber-to-the-home connections, of which many deployments rely on Gigabit Passive Optical Network (GPON) standards. The key there is the “passive” part—these networks don’t rely on active components to switch signals. ISPs run central trunk lines out to optical line terminals (OLT), with passive splitters installed in neighborhoods to serve a number of downstream subscribers. Each subscriber then has something called an Optical Network Unit (ONU) in their home, which filters out the traffic intended for that specific subscriber. Therein lies the flaw, though. Light (and thus, data) for many subscribers flows into the home, and it’s only the ONU that is filtering that out. Hack the ONU, or replace it… and you have access to downstream traffic from your neighbors that you shouldn’t be able to access. The duo were able to hack an ONU to forward every single frame it receives, revealing downstream data intended for other homes in their immediate neighborhood. A great deal of traffic is encrypted these days, which provides a layer of safety, but it is by no means an ideal situation that such a hack is possible at all. They also explored other threats, such as installing splitters in publicly-accessible infrastructure, and compromising an upstream OLT and using it to flash firmware to other subscriber’s ONUs on the network. All this was presented in a talk at DEF CON, too, which can be viewed online. It’s a concerning look at an often unconsidered link in the network chain. Few of us expect our data to be snooped upon in between us and the ISP, after all. Here’s the link, we’ll be streaming our talk @ 1PM PT If this breaks, it’s Track 1 Main Stage on the [#DEFCON]YT channel[https://t.co/nv0lzLkMwZ]— Rithwik Jayasimha (@thel3l) [August 8, 2026] This by the way also happens with cable internet. Heavy encryption is used in both networks to reduce snooping. Do you know that encryption is used, or do you hope that it is used? Because this article sounds like there is no encryption apart from the application level HTTPS (which still exposes a lot of metadata). Provider dependent on how they configure ONUs. IIRC aes was used for downstream in some networks I worked on. Docsis encrypts each data stream prior to mixing and transmission. It’s based on the same idea in set top boxes (really pcs with hardware accelerated decryption chips and an on-board smartcard) which was developed for the purpose of making money. Alternately, if you work with line installs, you have the test equipment for coax to see this in action. For fiber, yes, the article is saying they don’t do this where ever they are at. I think GP mentioned it to imply the fiber company Should be using the same solution, not that they are. I also wouldn’t be surprised to see such failure with multiple fiber providers, despite hoping this is a one off screwup. Used to reduce theft of service. Protect profit first, then customer. But what about the risks of packet injection by nefarious actors causing you to be labelled as the source?