BT Home Hub

BT Home Hub

The BT Home Hub v2.0
Manufacturer Technicolor SA
Gigaset
Operating system GNU/Linux
Connectivity
Dimensions

The BT Home Hub is a wireless residential gateway router distributed by BT. It is based on the Wi-Fi 802.11n standard, and is also backwards compatible with 802.11g and 802.11b. All Models of the Home Hub prior to the Home Hub 3.0 support VoIP Internet calls via BT's Broadband Talk service and are compatible with existing DECT handsets. This was significant as it marked BT’s departure away from traditional telecommunications services and towards Internet and media products.

It works with the existing BT Fusion service and works with the BT Vision video on demand service.[1] The BT Home Hub 1.0, 1.5 & 2.0 devices connect to the Internet using a standard ADSL connection. The New BT Home Hub 3.0 device can accept connections via ADSL and via vDSL, which is also known as BT's New FTTC/FTTP Network (BT Infinity). Since the release of the BT Home Hub, there have been several improvements to the firmware of the device.

The BT Home Hub 2.0 is much smaller in size than its predecessor, and the Home Hub 3.0 is even smaller than the 2.0. However, the Home Hub version 3 has been found to have serious security flaws for users.

Contents

Features

The BT Home Hub 2.0 is a wireless router and combined phone. It supports wireless internet access through 802.11b/g or n with the Hub 2.0, with the WPA security protocol.[2] It supports many of BT's services such as BT Fusion, BT Vision and BT Broadband Anywhere. It can also be used as a VOIP phone through BT Broadband Talk.

The new BT Home Hub 3.0 incorporates the WPS functionality, seen on other routers, which enables you to connect with "one-touch". And also includes Smart wireless, which automatically chooses the channel to give the strongest possible wireless signal.[3]

Hub Phone

The BT Hub Phone is an optional handset that can be bought to work in conjunction with the Home Hub 2.0. It uses Hi-Def sound technology when calls between Hub Phones are made. It calls using the BT Broadband Talk service, and may sit in a dock in the front of the Home Hub or be used on its own stand. A normal telephone which supports DECT can be used in place of the Hub Phone.

With each Home Hub released up to 2.0, a new phone was made to accompany it:

Home Hub Version 3 does not work with the BT Broadband Talk service.

The phones are only partially compatible with newer or older versions of the hub - able to make and receive calls, but with loss of many features.

The use of a DECT or Hub Phone was removed from the Home Hub 3.0.

Undocumented features

The Home Hub includes a USB-A port which has no documented function. It has been found that some devices (such as printers and USB mass storage devices) connected to this port can be shared on that Hub's network. Storage devices (hard disks and flash drives) must be formatted to FAT32, and hard disk drives must have an external power supply. It can also be used to charge iPods/phones through a USB cable.

Design

There have been five different versions of the BT Home Hub so far:

As of mid 2008 BT finished rolling out the black, curved Home Hub 2.0 to all new BT total Broadband customers; existing customers can purchase the new Home Hub or get the new Home Hub as a free replacement for their old white one if they sign a new 12 month contract.

There were two different manufacturers of the Version 2 hub; Thomson make the 2A (Type A hub) and Gigaset (now Sagem Communications, Sagem having acquired the Gigaset broadband business in July 9) makes the 2B (Type B hub). Whilst the looks and functionality appear to be identical, the Type 2A has been plagued with problems relating to poorly tested Firmware upgrades which among other problems cause the Hub 2A to restart when uploading files using the wireless connection.

The Home Hub 3.0: DECT phones are no longer supported, and as such, BT Broadband Talk will no longer be provided as part of BT's broadband packages after 29th of January 2011.

History

The BT Home Hub can only be used with the BT Total Broadband package without modification; the 1.0, 1.5, and 2.0A versions can be unlocked.[4] The BT Home Hub configuration software is compatible with both Mac and Windows operating systems, and although is required to install the supplied software on computers attached to the Home Hub, Computers without the installed BT Software will be able to connect to the Router and browse the Interent normally.

The hardware contained within the HomeHub v1.0 and v1.5 was manufactured by Inventel, and is equivalent to other Inventel produced and third-party branded routers such as the Orange LiveBox and Thomson Speedtouch 7G and the ST790. Consequently the v1.0 can be flashed with some firmware such as that for the 7G, however full functionality cannot be achieved using this method. The v1.5 firmware whilst not hardware locked as previously claimed does have extra locks in the bootloader which can now be circumvented and full functionality achieved.

There are 2 versions of the BT Home Hub 2.0. The A and the B model. The hardware contained within the HomeHub v2.0A was manufactured by Thomson Speedtouch, who had bought out Inventel and all their hardware and software rights. This model is electronically identical to the Thomson Speedtouch TG797n.

The hardware contained within the HomeHub v2.0B was manufactured by Siemens' Gigaset division in Germany. The middleware was developed by Jungo a subsidiary of NDS, and is based on their openRGTM product. The product is very similar to the smartBox sold by orange Israel

Until recently, the Type A Hub suffered from a flaw whereby it would reset when the user was performing uploads whilst connected wireless to the Hub. After months of customer complaints BT has now released a software patch for the faulty hubs.

In the standard firmwares Telnet is available in earlier firmware versions (up to 6.2.2.6) on the v1.0 with appropriate user permissions, and is identical to the custom shell used in the Speedtouch range of routers allowing an almost identical software feature set to them, albeit with a few notable exceptions (e.g. PPP authentication is locked on BT firmware). This of course is not the case in the unlocked versions as full telnet is available.

Technical specifications

The BT Home Hub package includes:[5]

Spec Hub 1.0/1.5[6] Hub 2.0[2] Hub 3.0
Modem ADSL2+ ADSL2+ ADSL2+ (can receive VDSL for BT Infinity[7])
Wi-Fi 802.11 b/g 802.11 b/g/n 802.11 b/g/n (now with Smart Wireless, explained above)
Wireless
Security
WEP and WPA-PSK/WPA2-PSK/RADIUS All previous features but now with WPS
Ports 2x Ethernet 10/100 Mbit/s
1x USB 1.1
2x RJ11 (broadband in and phone)
4 x 10/100 Mbit/s Ethernet sockets (RJ45)
1x USB (Not enabled for use ????)
1x Broadband In (RJ11)
1x telephone socket
3 x 10/100 Mbit/s Ethernet sockets (RJ45)
1 x 10/100/1000 Mbit/s Ethernet socket (RJ45)
1x USB (Now is enabled for use)
1x Broadband In (RJ11)
1x BT Infinity In
Dimensions
(w x d x h)
- 175 x 88 x 182mm 18.5cm x 11cm (w x h)
Software 6.2.6.H[8] 8.1.H.U (Type A), 4.7.5.1.83.3.18 (Type B) 4.7.5.1.83.8.57.1.3 (Type A) - as at 23 Apr 2011

Criticism

Security

The security of the BT Home Hub has been questioned[9] several times by GNUCITIZEN. In October 2007, Adrian Pastor warned[9] the security and BT Broadband community regarding critical vulnerabilities he discovered in the Home Hub. The details of such research were released later in November 2007 and demonstrated how to fully compromise (get root privileges) on the BT Home Hub by simply tricking a BT Home Hub user to visit a webpage crafted by the attacker.[10]

Such research garnered a significant amount of media attention[11] and even led to Adrian Pastor being invited to BBC Radio 4 where he counter-argued Dave Hughes, director of BT Wireless Broadband. Mr Hughes argued that GNUCITIZEN's vulnerability research only covered a theoretical attack. Mr Pastor, on the other hand, stated that although GNUCITIZEN wasn't aware of such vulnerabilities being exploited in the wild, the attack is fully practical as demonstrated by the exploit code released at www.gnucitizen.org. Furthermore, Mr Pastor argued that the security of the BT Home Hub wasn't sufficient enough to support the newly-introduced Wi-Fi sharing FON service.

The device has also been known to 'kick' users off the internet if too much data is downloaded in a certain timeframe. This problem was identified on BBC Radio 4's You and Yours Show.

It has been found that the BT Home Hub v3 has ports 161 & 4567 permanently open (not closed or stealthed) as default from the factory and the Hub Manager settings do not allow these ports to be turned off. Port 161 is an SNMP port, and should not be open unless a user has specifically opened that port for a remote device to work. It appears that these open ports are used by BT to "monitor and configure" the BT Home Hub v3 without the users consent.[12] This constitutes a significant security threat for those accessing the internet via a BT Home Hub v3 as the SNMP protocol is a frequent target for hacking.

GPL Violation

The device runs software which uses the Linux kernel, released under the GNU GPL. As a token gesture and, in an attempt to claim adherence to the GPL, BT have released some source code for the device which can be downloaded here. However in violation[13] of the GPL, BT have not published the scripts necessary to compile and install custom firmware to the device.

References

  1. ^ BT Home Hub Page - Use with BT Fusion and Vision services. Retrieved 14 February 2007.
  2. ^ a b "The New BT Home Hub". http://www.homehub.bt.com/. Retrieved 2010-03-28. 
  3. ^ Bt - The Home Hub's Official Page [1]
  4. ^ "Psidoc.com". http://www.psidoc.com/forum.php. 
  5. ^ BT Home Hub Package - Items included with the BT Home Hub. Retrieved 14 February 2007.
  6. ^ BT Home Hub Package - BT Home Hub Specifications. Retrieved 14 February 2007.
  7. ^ BT Infinity Home Page [2]
  8. ^ [3] - 6.2.6.H Home Hub Firmware Update. Retrieved 26 May 2008.
  9. ^ a b "BT Home Flub: Pwnin the BT Home Hub". "Adrian Pastor". http://www.gnucitizen.org/blog/bt-home-flub-pwnin-the-bt-home-hub/. Retrieved 2008-10-22. 
  10. ^ "BT Home Flub: Pwnin the BT Home Hub". http://www.gnucitizen.org/blog/bt-home-flub-pwnin-the-bt-home-hub-4/. Retrieved 2008-07-03. 
  11. ^ "The Register — BT home router wide open to hijackers". http://www.theregister.co.uk/2007/10/09/bt_home_hub_vuln/. Retrieved 2008-07-03. 
  12. ^ "BT Community Forum". http://community.bt.com/t5/BB-Speed-Connection-Issues/port-161-open-on-home-hub-3/td-p/133207. 
  13. ^ [4] Source code requirements of GPL

External links