Security concerns about Sky staff/systems accessing internal router LAN

[Rockingit]

Whilst in the throws of a horrendous tech support call yesterday (which has only started to get resolved after I hung up and made a formal complaint...) I was a bit shocked to have the tech support agent tell me (wrongly) that my issue was with dropped packets on our side of the LAN wifi, and then proceeded to tell me the machine names involved - in other words they were monitoring/able to access the private LAN side of the router and log traffic.  (Not talking about the WAN side, that's theirs and of course is going to be monitored in stages)

Apart from the privacy and security issues involved - especially now they've moved everything over to India - I'm perplexed as to how.  I've checked our router and there are no sneakily open ports, remote management...nadda.  This makes me think that if you use their supplied router there is some undisclosed backdoor access going on that's straddling a local firewall?

More's the point, how do we prevent this?  We are a business account not residential and this throws some massive privacy /gdpr issues with regards to some of our client data.

Cheers, R.

[Mr+Slant]

It'll be TR-069 and there's nothing you can do to prevent it other than use a router which wasn't supplied by Sky. You should find port 7547 TCP is open and you won't be able to close it.

Every major ISP in the UK uses TR-069 (or their own variant) so this isn't unique to Sky.

https://en.wikipedia.org/wiki/TR-069

[Rockingit]

Thank you for the education - had no idea!

So the logical next question has to be...   recommendations for a suitable replacement router?

[TimmyBGood]

---

@Rockingit wrote:

and then proceeded to tell me the machine names involved - in other words they were monitoring/able to access the private LAN side of the router and log traffic. 

---

Being able to see WINS or similar names of devices talking to or through the Hub is not the same thing as monitoring or logging traffic content.

It's perhaps problematic if a user has chosen to name a device 'bathroom_spycam_3'  ; )

[JimM1]

@Rockingit As you are a business acount with sky you should talk to the business manager for your account at sky!

[Mr+Slant]

Depends on what service you have in terms of what's available. VDSL2/G.fast/FTTP will all have different options.

Main thing is to ensure the router supports DHCP Option61 (sometimes erroneously referred to as MER) so it'll connect to Sky. Not all do.

[Osmond]

If you are concerned about privacy, are technically minded and have a spare bare metal machine you could create your own router using OPNSense.

[jamesn123]

@Rockingit 

Sky cannot see your LAN traffic directly, they can see device names (Which also appear in the Sky broadband diagnostics area on the website) and router traffic statistics e.g. WAN speed, number of tx/rx packets, dropped packets etc.