HALNY PRODUCT SECURITY

Most security issues in home-user and operator networks arise not from the Internet access side (WAN), but from the end-user side (LAN). Therefore, it is important to have the appropriate knowledge and awareness of the device used every day. Most of the devices offered are managed and configured by operators (ISPs), so we will begin our recommendations with topics relevant to them.

A. Dedicated management interface:

The device software includes a management interface (WAN0), which is separated from the others. Its configuration and management depend on the device type:

• • ONT
    The interface can only be configured from the OLT side using the so-called ip-host. It cannot be configured or verified via the web interface.

• • Router
    By default, the WAN0 interface is assigned VLAN 3890 with a DHCP client enabled on it. Because there is no upstream device as in the case of an ONT, its configuration is available via the web interface from the “admin” account.

In addition to dedicated management and access, WAN0 is used by default by remote device-management and configuration services such as XML provisioning, TR-069, and REST API.

Consequently, the following ports are open by default: 80 (web access), 22666 (SSH — diagnostic access available only to the manufacturer), 48625 (REST API v1), and 48626 (REST API v2).

FIBRAIN recommendations:

1. 1. Use a dedicated VLAN for the management interface (WAN0) that operates only within a local network (private addressing), is separated from the rest of the operator’s network, and is not routed/NATed to the Internet
   2. Regularly monitor the management VLAN and analyze traffic
   3. Change default passwords, especially for the “admin” account
   4. Change the web-management port from the default port 80 to another port
   5. If these services are not used, block the ports on the firewall
   6. Restrict addresses on the firewall
   7. Use secure HTTPS/FTPS communication for management services

B. Access to the device and internal network from the WAN side.

By default, access to the device’s web interface or any other service/application is not open on any WAN1–7 interface (except WAN0 described above). However, HALNy software allows specific access to be configured for the device itself and for other devices behind it:

1. 1. Remote access on a WAN interface operating in (or including) INTERNET and TR069 mode
   2. Port forwarding
   3. DMZ
   4. UPnP

FIBRAIN recommendations:

1. 1. When enabling remote access to a HALNy device on a service WAN interface, select a non-standard port and always set a time limit for access
   2. If you only need port forwarding temporarily, remember to disable it when you are finished
   3. Use a DMZ, which forwards all ports, only as a last resort
   4. Remember that port-forwarding rules have a higher priority than the DMZ
   5. When configuring port forwarding or a DMZ, always check the device to which the forwarding/DMZ leads, because that device then assumes responsibility for the security of the port or ports. Optionally, assign a static address or a reservation to the DMZ host
   6. Enable UPnP only when you truly need it; otherwise, the service will dynamically open specific ports beyond your control

C. Access to the device from the LAN (physical and Wi-Fi):

Most problems with network devices originate on the end-user side and from devices connected to the network.

• • IP address:
    By default, out of the box, ONT devices use the address 192.168.33.1/24, while routers use 192.168.34.1/24. Changing the device operating mode to Switch changes the device’s IP address to 168.33.254 (unless this is changed manually). Similarly, when operating in Mesh Agent mode, the device has no assigned address; instead, it starts a DHCP client and attempts to obtain an IP address from the Mesh Controller.

• • Login:
    Each device has two user accounts. Depending on the device type, the login credentials are:
    
    • • ONT:
        admin / default or set password
        useradmin / [PASSWORD_FROM_LABEL]
    • • Router:
        admin / [PASSWORD_FROM_LABEL] + “S3c”
        useradmin / [PASSWORD_FROM_LABEL]

• • Access via HTTP port 80

• • Wi-Fi login:
    The device has a dynamically generated SSID and password shown on the label. WPS login is also available, but we recommend using it with caution. This feature makes connection easier, but its convenience may also allow unauthorized persons to connect.

FIBRAIN recommendations:

1. 1. Change the default login credentials, especially on ONT devices and for the admin account. Although the password printed on the label is generated, we recommend changing it to your own. Remember the following rules for creating a secure password:
      
      • • It should not be meaningful, especially not names or dates associated with the user
      • • It should not be a sequence of adjacent keyboard characters
      • • It should be at least 8 characters long, but preferably follow a minimum length of 12–16 characters
      • • It should contain lowercase and uppercase letters, digits, and special characters
   2. Use the “useradmin” account for basic changes. If spyware is present on your device, it will then gain access only to an account with restricted permissions

Regularly check the list of connected devices and investigate any unknown devices. Remember all household devices connected to the network, such as refrigerators, washing machines, vacuum cleaners, etc.

D. Additional notes:

• • The device’s LAN address is always accessible, even when interfaces are in bridge mode. Therefore, even if the entire device operates only in bridge mode, the security rules listed above still apply.

• • Before configuring a specific service or access to/through the device, consider the security implications carefully. Check messages received from the device, as they may warn or inform you about important security matters.

• • Regularly check the manufacturer’s website for new software versions (adres_strony_z_softami.fibrain.pl) and security matters (security_network_active_devices.fibrain.pl). It is the best source of information about current security issues affecting HALNy products.

• • (This point does not directly concern the security of HALNy devices.) Ensure that servers hosting management systems, FTP files, DHCP, or PPPoE services are properly secured. If an attacker compromises them and replaces your data with their own data that is technically valid, the device will also accept it. Security must therefore be considered at every step and for every device in your network.