Kill any Fiber Connection in Denmark for 100€ or less
I came home to a curious surprise from a short vacation last week. A package in front of my door and my network connection was dysfunctional. I didn't connect the two at first, but discovered that it's incredibly easy to sabotage any fiber internet connection in Denmark (apparently).
Not cool.
A Timeline of Events
- Friday 18:30: We come home and discover that the network is down, even after repeated restarts of fiber modem and router (our fiber cable terminates inside the flat)
- Saturday 09:00: We contact support, they only have chat available, support agent realises that another modem is registered on our connection after receiving a picture of the installed modem. They ask for the modem ID and fix the connection. They refuse to send an email with the conversation and redirect me to the cable/network owners, the main Danish telco "TDC".
- Saturday 09:44: I have a closer look at the package we received and it shows our address, but a different name. I write on our buildings facebook group (don't ask) where I can deliver it, tagging the recipient.
- Saturday 23:31: I deliver the package to the recipient and ask them to tell their provider to update their address.
- Monday 14:15: I call "TDC" the dudes owning the cables, not the reseller, am told to not contact them but to have my provider reach out to them. They refused to understand how I was not the party temporarily terminating my own connection.
- Monday 14:29: I call my provider (reseller) and ask them what can be done about the situation, they give no further info, but let me know I don't need to worry about it.
This all left me baffled. Both parties shoved the responsibility either onto me (who hasn't even done anything) or each other.
This is the modem ID that my direct provider requested.
These are screenshots from the chat with the Fastspeed support agent, who did fix the connectivity issue, but was otherwise not helpful in providing useful answers to the process or forwarding our chat via email, stating that they were "too busy for such things".
They were basically telling me that it's my responsibility to reach out to other resellers and ask them to close the second connection (I have no idea who my neighbor ordered from).
Sabotage Potential
Now, problematically none of these things were self-service. I can not log into my internet provider and set a modem ID, which is only available to their limited support staff. Their support is limited to work days and work hours, assuming their number is of course also limited by the time I spent in a queue.
Not that cool.
The real problem is that arbitrary people, who are not part of my household, can disconnect my internet connection by messing up a form, intentionally or not.
Not. Cool.
I can also not "lock" my connection to selected devices. Anyone that knows my address can sabotage my connection for less than 100€. Apparently as often as they want? Both TDC and Fastspeed did not see this as a problem and Fastspeed support assured me this is the first time they encounter this case.
Also I was told off by TDC to not call them directly and that the instructions given by Fastspeed were wrong (giving me their number) as I'm only indirectly a customer with them.
If you look at the current entry level fiber plans in Denmark, you can sign up paying less than 100€ to shut down any persons internet connection by simply knowing their address, which is the case for a large number of Danes. You can do this by signing them up with another provider and nuking their old modem off the list. I'm assuming that this is a problem across providers, but please do send me an email if you know otherwise by working for any of them.
This is a drastic architectural oversight in the trust based frictionless system the ISPs apparently have agreed on with TDC the infrastructure provider without having any ID verification and simply over-writing some horrid shared backoffice database (assumption) with some new value and without auditability (assumption, since the history could not be viewed).
Imagine this as if someone was able to re-register your car into their name by just knowing your license plate. That's essentially what the current infrastructure lets you do. Also nobody would know who did what why and when.
Delimitations
This method MIGHT only work for consumer connections, but it's not impossible that business offerings are affected as well, which sounds like an expensive problem to have.
I'm sure someone is going to pick this up and try it out. If anyone wants to contract me for continuing my pro-bono quality assurance, just send me an email!
I assume this to be super not the case and I guess they know what's wrong with their system, just that nobody cares to fix it, because nobody has exploited it at scale (yet).
In order to test this out at scale one would have to make use of any of the following providers and order a new fiber plan to an address (that might, or might not be their own):
or any other of at least a dozen providers and fill out a form like this, with a (stolen or legit credit card):
The infrastructure provider (TDC) emphasised many times during our call that they are required to support multiple providers by law (they were sentenced to not monopolying up the market a few years ago), which I fully support. They just should provide appropriate infrastructure.
There could be an email sent to a customer that alerts them to their connection no longer working or other event handling, but apparently we just discovered a very ugly and badly functioning bit of glue-software that keeps half the country connected.