When we think about security threats, we generally imagine them coming from far away across the wider internet. But what if the connection between you and your ISP was the target? [Rithwik Jayasimha] and [Rithvik Vibhu] have explored how fiber to the home connections may not be as secure as you would hope.
The hack centers around fiber-to-the-home connections, of which many deployments rely on Gigabit Passive Optical Network (GPON) standards. The key there is the “passive” part—these networks don’t rely on active components to switch signals. ISPs run central trunk lines out to optical line terminals (OLT), with passive splitters installed in neighborhoods to serve a number of downstream subscribers. Each subscriber then has something called an Optical Network Unit (ONU) in their home, which filters out the traffic intended for that specific subscriber.
Therein lies the flaw, though. Light (and thus, data) for many subscribers flows into the home, and it’s only the ONU that is filtering that out. Hack the ONU, or replace it… and you have access to downstream traffic from your neighbors that you shouldn’t be able to access.
The duo were able to hack an ONU to forward every single frame it receives, revealing downstream data intended for other homes in their immediate neighborhood. A great deal of traffic is encrypted these days, which provides a layer of safety, but it is by no means an ideal situation that such a hack is possible at all. They also explored other threats, such as installing splitters in publicly-accessible infrastructure, and compromising an upstream OLT and using it to flash firmware to other subscriber’s ONUs on the network. All this was presented in a talk at DEF CON, too, which can be viewed online.
It’s a concerning look at an often unconsidered link in the network chain. Few of us expect our data to be snooped upon in between us and the ISP, after all.
Here's the link, we'll be streaming our talk @ 1PM PT
If this breaks, it's Track 1 Main Stage on the #DEFCON YT channel https://t.co/nv0lzLkMwZ
— Rithwik Jayasimha (@thel3l) August 8, 2026
This by the way also happens with cable internet. Heavy encryption is used in both networks to reduce snooping.
Do you know that encryption is used, or do you hope that it is used?
Because this article sounds like there is no encryption apart from the application level HTTPS (which still exposes a lot of metadata).
Provider dependent on how they configure ONUs. IIRC aes was used for downstream in some networks I worked on.
Docsis encrypts each data stream prior to mixing and transmission. It’s based on the same idea in set top boxes (really pcs with hardware accelerated decryption chips and an on-board smartcard) which was developed for the purpose of making money.
Alternately, if you work with line installs, you have the test equipment for coax to see this in action.
For fiber, yes, the article is saying they don’t do this where ever they are at. I think GP mentioned it to imply the fiber company Should be using the same solution, not that they are.
I also wouldn’t be surprised to see such failure with multiple fiber providers, despite hoping this is a one off screwup.
50/50 whether or not downstream encryption is turned on. Upstream encryption is very rare, but you would need to be able to tap the central office side to exploit that.
One
Two
One of the authors here!
There is actually no provision for upstream encryption in GPON. XGS-PON, the successor does make some provisions for this, but in GPON, upstream data is always cleartext.
Used to reduce theft of service. Protect profit first, then customer.
Remember folks, the customer is Number 2!
I dunno, that sounds expensive. I think that’s one too many steps.
You’re absolutely right, sir. You deserve a promotion!
But what about the risks of packet injection by nefarious actors causing you to be labelled as the source?
IF encryption is used, then this becomes a non-problem, and honestly should be standard. The issue is that, from what I understand, fiber uses a TDMA scheme (times slicing) which means that a DOS should be easy.
No need for DOS when scissors are enough…
Ding, ding. Prize to this commentor!
You can DOS a GPON connection. Just putting in arbitrary data on the upstream wavelength is enough. But regular GPON setups have mostly around 30 subscribers on one link. At least in Europe. Since GPON can only handle a max of 2.4Gpbs and they are selling service with up to 1Gigabit, most of the time the users are even less on one link.
So you can’t use internet yourself, you annoy your closer neighbours, and that’s it.
You can’t do a district wide, or even city wide DOS with this technique.
It’s called a rogue ONT/ONU, it already exists as something fiber companies deal with, and the max is 128 passings per OLT fiber/PON.
This actually has less to do with the amount of bandwidth and more to do with light physics.
PONs take a single SMF and use passive splitters to split the light. Everytime you break the fiber out to split it you suffer insertion loss. B+ or C+ optics give you maybe +2-+6 dB from the OLT, and then you add roughly -3.5 dB of loss per power split, so 2^n = n * -3.5 dB. 2^7 is 128 splits or passings, which is (7 * -3.5dB) + 5 dB (for the OLT optic) = -19.5 dB before accounting for distance.
Your terminology is incorrect. The OLT is an active powered network device that exists in a central fiber office somewhere. From this device through the splitter, which is what is in the cabinet and not an OLT, all the way to your house, is entirely passive.
This all depends on how your ISP setup their network. Some deploy OLTs in the field, or a mix of field and colocation sites. So it is absolutely possible to get access to an OLT of you know what you’re looking for.
“Few of us expect our data to be snooped upon in between us and the ISP, after all.”
Indeed. I usually expect it to be snooped only on my PC, at my ISP, at all intermediate nodes, and at the destination.
It’s just a bad ISP. I’d guess all the good ones and the big boys encrypt downstream traffic. Mine does. We learned about this 30 years ago with cable modems. A strong argument could be made that there are easier and more effective ways to snoop, but the ISP should be doing whatever they can to protect privacy.
One of the authors here, can assure you this is not true, at least for some major US ISPs we tested :)
Also depending on the OLT used by the ISP, DS encryption must be enabled on a port by port basis, and we found some situations where certain port’s traffic was unencrypted while others weren’t (ie, it was a mixed bag on the same network)
Exists in every time division multiple access network. (SpaceX, too) They do it for oversubscription. And then say each subscriber is rated for the network burst speed instead of committed information rate. It’s all about the Benjamins.
Totally dependent on encryption for isolation/security.
Wireshark it with an optical router.
As a XGSPON subscriber, one of the things that bugged me a lot was that invariably the provider absolutely insists on you using their crappy router.
No thanks.
Fortunately, the alternative is a community of folks who have hacked the WAS-110 SPF ONU. http://pon.wiki/
As a layperson, I figured (incorrectly) that of course it was only your data coming in to your house with fiber. So….what we’re saying here, is that yes, of course we were all basically F___’d, and have been for ages, and here’s yet more attack surface.
The downstream AES key is changed every 10 seconds so hacking it is virtually impossible.
Not on any ISP in any country the authors of the original article tested their setup at.
Sure, they were capable of using AES, but they did not.
#encrypt the planet
Do you have a source?
Key rotation is usually vendor specific but usually is only performed once when the ONU is brought up on the PON tree and never after. It is rotated when the device goes offline and comes back.
Also the g984.3 recommendation only provides a mechanism and no minimum rotation cadence, so this usually ends up being vibes.
I have never heard of an ISP rotating every 10 seconds, it doesn’t make sense to do so.
I am always surprised how old-news becomes headline years, sometimes decades later. I am old networking guy building the Internet back around the millennium for one of the major telecom gear vendors. It was widely known that you can deploy a fiber tap, and proven that it can be done as simple as scraping of a bit of cladding and bending the fiber for leakage and do not cause any network interruption. And for that matter, we deployed those taps under “lawful intercept”. Independent of fiber, I am not sure whether this is still possible, but a lot of cable modems used to spill any frames that comes from the neighborhood, and we had fun just displaying what the neighbor was browsing at the time.
For real. There’s no way people are this clueless, is there?!
Yeah I guess the authors never heard about DOCSIS before encryption. The only new thing here is pushing fw updates to peoples equipment.
Pretty sure bending fiber causes some type of disruption, maybe not disconnect but signal degredation
But that’s true for any network where signals are multiplexed. Plug into any LAN, you see the traffic for all the nodes on the subsegment (providing you set your NIC to promiscuous); “plug” into a WiFi, and you can see the entire traffic if you want to. This single sentence which seems dismissive:
” A great deal of traffic is encrypted these days, which provides a layer of safety, but… ”
is also the canonical and proven solution to this problem.
There’s HTTPS traffic, which obviously protects a vast majority of user traffic, but then there’s the whole host of metadata attacks you can perform when you can see things like people’s DNS responses (plaintext), browsing patterns etc.
The cool thing we are able to do, is pivot into the OLT itself from the home and the push fw updates into people’s homes, which is the new attack vector that hasn’t been quite priced in yet.
I used to spy on neighbours using explornet satellite internet service. I could see all traffic from the node onward. A sniffer sniffed it all easily. Porn seems to be the biggest thing people are viewing from my experience snooping. Haha
Hm? x.com is hosts-blocked here, but still gets loaded in the iframe?
How?
Ah, platform.twitter.com. Lol, how inconsistent with their rebranding.
And dynamic.x.com.cdn.cloudflare.net, wow.
The snooping is basically pointless these days. The modern internet encrypts everything assuming that someone nefarious will be listening in, not only because of open wifi hotspots but because you often have no control over what people or indeed even what counties your traffic will be routed through.
The days of the secure hardline connection are over, for all but the most paranoid government users.
What is more of a threat is the ability to impersonate one of your neighbours, and either make it look like traffic originated with them, or to use data that they will be billed for. This should be something that future versions of this hardware could at least detect though, since the user endpoints could listen for the existence traffic they didn’t originate. They could maybe even send a warning upstream, though how to act on it might be a tricky problem. Changing the keying might not buy you much and starts to look like it could be vulnerable to deauth attacks.
I thin this is true to a large degree, but DNS etc still remains unencrypted. Plenty of attacks can still be performed on the metadata (what sites you browse, when you’re home etc)
I like this! Interesting idea, but with the commercial hardware, this is not possible since the APD in the SFP is not sensitive to 1310nm (upstream frequency) but we’re planning on building more hardware :;)
The funniest part of this whole GPON saga is that everyone keeps arguing about whether encryption ‘should’ be on, while the actual attack surface is sitting there waving like a lonely OLT in a remote hut. The moment your ONU stops behaving like a polite TDMA citizen and starts forwarding everything like it’s auditioning for Wireshark’s Got Talent, the downstream becomes a neighborhood‑wide group chat you never asked to join.
And sure — ‘just enable AES’ sounds great until you remember half the ISPs treat key rotation like a New Year’s resolution: technically possible, rarely performed, and usually abandoned by February. Some vendors rotate keys only when the ONU re-registers, which means the security model is basically: ‘hope nobody power-cycles their gear during an attack.’
The real nightmare fuel isn’t the snooping — it’s the fact you can pivot upstream into the OLT. Once you’re in the control plane, you’re not sniffing packets anymore, you’re pushing firmware like Oprah: you get an update, you get an update, everybody gets an update! At that point the PON tree stops being passive and starts being a very enthusiastic botnet distribution system.
So yeah, scissors can still DoS fiber, but a compromised OLT can DoS your entire sense of safety.