Hacking PPPoE

My first exploration of Ethernet — enjoying free internet, even taking down the city’s network.

In 2005, bored with high school life, I threw myself into learning Ethernet.

Early that year, I tried another packet sniffer: Iris.

It was less famous than Ethereal, but it had one feature I loved — it could edit captured packets and replay them. That made learning much faster. I could tweak a few fields, send the packet back out, and watch how the other side responded.

With Iris, I quickly learned how PPPoE worked and even wrote a simple BRAS of my own. Around the same time, I also started learning C, which was far better suited than VB for packet handling.

Once I had a fake BRAS, I could respond to PPPoE dial-up requests in my neighborhood before the real server did, redirecting them to my own machine. Better yet, usernames and passwords were transmitted in plaintext, and multiple buildings shared the same broadcast domain, which gave me access to hundreds of accounts.

I wrote a small tool that scanned for idle accounts and dialed them automatically. As long as the owner stayed offline, I could keep using the account; the moment they came back, the tool would disconnect and switch to another.

Naturally, I wanted more.

My next idea was to dial multiple accounts at once, aggregate the bandwidth, and then redistribute it — partly to myself, partly back to the account owners. In effect, I was imagining a kind of underground ISP.

It was complicated, though, and I had less and less time to use a computer, so I didn’t finish that idea until years later, when I was in college.

This tool let me use the internet for free for many years — not only at home, but later in college as well.

That summer, I stumbled onto an even more serious flaw in the ISP’s network.

Their BRAS seemed to care only about the PPPoE session ID, not the source MAC address. In other words, the source could be spoofed freely. That meant I could forge termination frames.

A PPPoE session ID is only two bytes long — at most 65,536 possibilities. So I wrote a prank program that brute-forced session IDs and sent termination frames, disconnecting every user behind a given BRAS.

To affect more users, I spent a few days collecting as many BRAS addresses as I could. Once the list was large enough, I brute-forced them sequentially, kicking every user in the city offline.

The core of the program was only about ten lines:

// ...
pkt.pppoe.code = PPPOE_ACTIVE_DISCOVERY_TERMINATE;

while (1) {
    for (int i = 0; i < BRAS_NUM; i++) {
        pkt.ether.dst_mac = BRAS_MAC[i];

        for (int sid = 0; sid < 65536; sid++) {
            pkt.pppoe.session_id = sid;
            pcap_sendpacket(fp, &pkt, sizeof(pkt));
        }
    }
}

At the time, many of my classmates used the same ISP. Once the program started, the avatars in our chat groups would turn gray one by one. As long as it kept running, no one could reconnect.

Of course, in the real version, I added one condition to exclude my own session ID, so I was the only one left unaffected.