I noticed this a couple of years ago. I informed Telstra to no avail. The Australian Cyber Security Centre referred the matter to the Department of Defence (who told me it was a corporate matter and not one of national security.)

Actually, it very much is a national security matter. Telstra have medicore default modem/router passwords (as do most other telcos), often the username is “admin” and so is the password. Even if you change it, they will use the TR-069 remote access program to perform “maintenence” on your modem, and in the process reset it to factory default settings, including the admin password.

The decade old laptop I am typing on is easily capable of scanning 1,000+ IP addresses per second targeted towards any Telstra-owned subnet. Plain language, anybody can perform a remote scan from home and get a list of home networks that can be accessed remotely. I found 10-25% of networks could be entered to varying degrees. Often a homepage of  login page was visible, many of these had either a security vulnerability or used default passwords.

Taking advantage of either method, entry could be gained to the home network and the computer, devices, phones, CCTV, and more. With a few tweaks to the settings, the DNS servers (which convert the text URL like “www.google.com” into a numerical IP address) would tamper with that Google URL and have the page sent to the end home user be a different page entirely. It might be a few ads injected into the traffic (the VPN HotSpot Shield does this – avoid it. ALso avoid NordVPN for similar reasons, and do not allow the University of Wollongong (or anywhere) install remote management software on your computer. Regarding universities, their remote exam monitoring (“proctoring”) software is actually spyware and a remote access trojan. It functions as one, only difference is you are knowingly installing it. And they can be abused.

Given UOW, the NSW Department of Justice, NSW Police Force, and more have recently had mass leaks of data compromising accounts, passwords, and financial details, as well as government personnel contact details leaked as well as classified files, you cannot trust others to keep you safe.

The DOJ and NSWPF matters were raised two years ago by myself. The contact details remain available. Confirmed accurate as I emailed the state Police commissioner, two hours later, I was contacted by the Australian Signals Directorate (part of Defense, the Australian equivalent of the United States’ NSW or the UKs’ GCHQ.)