Earlier this week we pointed out an nbn ad that was advertising speeds that, for anyone not on a satellite connection, were less than spectacular. And it’s been a bit of a rollercoaster ride for the ad: the ad went up, NBN Co took it down, and then it was re-uploaded.
For the most part, the ad that was re-uploaded is identical to what went online earlier this week. Except for one thing.
As users pointed out this morning via email, there’s a detail in the original Speedtest beyond the 598ms ping and the download/upload speed. For comparison, here’s the feature image again:
And an image I took from the original ad before NBN Co pulled it from YouTube:
As you can see, the difference is the visible IP address in the bottom left.
Normally this wouldn’t be an issue, except for the fact that Skymesh issues static IPs to customers across all their services. A Skymesh representative confirmed over the phone that the static IPs issued across all their services are permanent, with users notified if that IP is to be changed for whatever reason.
Put simply, your IP address is a permanent marker for other devices and computers to find you on the internet. Knowing an IP address is like knowing someone’s home address; you know where to find them, but that doesn’t mean you’ll be able to break down their front door. But by displaying the IP in the ad, NBN inadvertently exposed a potentially vulnerable connection. Not everyone is expected to have a good handle on internet security, especially if you live in the middle of the bush where internet connectivity is more of a luxury, and NBN Co shouldn’t be publicising IP addresses anyway.
If you’re a Skymesh customer and you’re issued a private IP, you’d expect it to stay private.
I emailed NBN Co asking three things:
• Did the IP address displayed in the original ad belong to a user, or business, and were they notified beforehand?
• Why did NBN Co display a full IP in the advert in the first place?
• And will NBN Co take steps in the future to avoid displaying IP addresses in their adverts going forward?
If I get a response on any of the above questions, I’ll let you know.
Update (12:33 PM): An NBN Co representative has replied with a statement:
An error was identified in the clip post-publication. As soon as we became aware of the error, nbn took immediate steps and can confirm the IP address used in the original clip is not active.
They didn’t answer whether it was active at the time the ad was published, mind you.
Comments
17 responses to “NBN Exposed A Skymesh Static IP In Their Ad [Update]”
NBN cannot get one thing right….
To be fair, they have gotten one thing right.
Fucking up the NBN.
That are giving a fucking masterclass on how to fuck up an important project
Wait…
To say that they got that right, you’re saying that was their plan all along, to fuck it up?
Well since the original plan was fttp. Yes the libs plan was to Fuck up the NBN.
Not only fucking up the NBN, but they’ve also fucked up the prospect of anyone ever getting a better connection made available in the future by another company.
They’ve burnt down the forest and then salted the earth for good measure.
The eternal struggle of a two party system where each party would rather fuck the other parties idea up so that neither of them can claim a victory.
It’s happened before the NBN and it will happen again. And that’s not to say labors NBN wouldn’t have been just as much of a crapshoot.
I waited four days to get a customer’s address changed in NBN’s system (they’d literally never moved, but NBN had the wrong address some-fucking-how).
So we send an email saying “yo, change the address from xyz to abc pls”
Four days later, I get “Hi, this address is XYZ [completely wrong address] in our portal. Is this correct?”
With a one word reply, I screenshotted the original email, included it in the reply and simply said “No”. That was two days ago. They haven’t gotten back to me yet.
So NBN exposed the IP, took it down, then you put it back up???
Nothing can be undone on the internet.
The IP’s been deactivated.
I would certainly hope so!
Hypocrisy much? Why be sanctimonious about this and then re-publish the offending material? Journalism 101 fail.
ISPs can change static IPs quickly enough if they need to. The point of this is to illustrate the mistake and lack of forethought. It works a lot better when you can visually point out the mistake, and the IP was deactivated partially because of the attention that was brought to the ad.
Side note, hypocrisy and Hippocrates are completely unrelated. The former is a compound word meaning ‘under-distinction’, the latter is the founder of scientific medicine.
But y’all weren’t going to point out this service was satellite when you’re dragging its respectable satellite ping through the mud?
I’ve run NBN’s statements when they were supplied and mentioned that the service was satellite up front in the last two stories. In the first sentence, too.
@zombiejesus had to point it out for you Alex.
were you just not aware earlier than that?
Point was more about why the NBN were advertising that performance in the first place; whenever you highlight a speedtest, people are going to compare it against the performance of their own service (NBN or otherwise). The audience that will have satellite aren’t likely to be watching the ad anyway (it’s on YouTube) and the ad also wasn’t super clear that it was a satellite service in the first place.
Plenty of people in the know understand the details, but the ad was talking to millions of people who are going to be moved onto the nbn in the next few years, and they’ll be looking at that performance wondering why the NBN is so proud of it when it’s comparable at best, or worse, than their current connection.
It was never about the performance, but more the marketing. Be proud of the satellite performance, sure. But if you’re going to put that performance in front of millions who will be on a different service entirely, advertise the performance those people are likely to get.
Given Australia now has mandatory reporting of any unauthorised disclosure will nbn now be making a report ? Their response is typical of nbn, evasive at best.
It isn’t personally identifiable information…it is just an IP and you don’t know who it belongs to.
Pick pretty much any four numbers between 0 and 255 and it will give you a valid IP which is being used by someone. It is like guessing a valid telephone number…that on it’s own is not an unauthorised disclosure.
This article and it’s comments are full of fear mongering and bad information.
1. You could type in pretty much any set of 4 numbers between 0 and 255 and get an IP that is used by someone somewhere. (Aside from a small portion of those which are reserved for local networks and other things)
2. Exposing a single IP is a complete non-story, with very little digging you could find what blocks of IP’s pretty much any ISP uses. Someone with a bit of time could find and post the entire list of IP’s that are being used by Skymesh.
3. What do you think someone is going to do with that IP? My IP is 180.150.4.220. Have at it.
4. IP’s are not personally identifiable information. It isn’t like they posted someones name and phone number or address or their TFN number.
5. My favourite part of your article was “Knowing an IP address is like knowing someone’s home address”. No it isn’t… it is like knowing that there is a building in the downtown of a city. Like land in the downtown of a city, the IPv4 space is almost exhausted, so if you pick any valid IPv4 IP then the chances are it belongs to someone and has a modem on the other end of it.
6. If you guys think this is a security risk then you are wrong. You are not likely to get exploited by someone who is targeting just you. You are likely going to get exploited by someone who is running automated scans against entire ip ranges. Your modem or whatever gateway is between you and the internet is getting targeted several times an hour. The reason for this is because it is a lot more efficient to target tons of IPs automatically and reap the benefits of the low hanging fruit rather than spending a lot of effort to target an individual IP.