Researchers Expose GPON Optical Network Eavesdropping via Modified ONU Devices at DEF CON
At DEF CON 34, two researchers demonstrated how inexpensive hardware modifications allow interception of downstream traffic in GPON fiber networks shared among multiple subscribers. The passive optical design means all clients connected to the same splitter receive identical data streams, with separation handled only at the ONU level through 12-bit GEM port identifiers. By acquiring Realtek RTL960x-based SFP modules and systematically bypassing built-in restrictions on GEM port reassignment, VLAN tagging, switch forwarding, and checksum validation, the team achieved access to traffic intended for up to 128 neighboring users. Exposed data includes DNS queries that can reveal occupancy patterns, unencrypted SIP voice traffic, and in some cases traffic from nearby cellular base stations. The researchers also identified exploitable vulnerabilities in the VSOL G100S OLT device that could grant root-level control and compromise provider routers. Additional coverage in the same Kaspersky report examined Head Mare's compromise of TrueConf servers, EvilFontTool font-based evasion, an OpenAI presentation on an accidental AI attack against Hugging Face, and the SCTPhantom Linux kernel flaw present for 18 years.
HabrAug 10, 2026Translated from Russian