## 4 Attack Surface Analysis
### Gateway to Internet Service Provider
#### 4.3.2 Sessions with Zero Internet Activity  
This experiment was carried out to inspect the type of data packets that pass through the router when devices are idle. No mobile devices were connected to the router, as it is very hard to limit the Internet activity of such devices. Hence, only two laptops were used. The devices were left idle for 40 min and the web browsers were not opened to make the environment as activity-neutral as possible. The results of the experiment are shown in Table 8.  
Most of the data packets present in Table 5 were also present during this session. Some unique data packets were found on each router, which are shown in Table 8. The ISP router only had an additional data packet, which was for updating the ARP cache of the network devices. The personal router had a different ARP protocol data packet and also had data packets for NetBIOS name registration and deregistration. The unique data packets in \begin{table}
\begin{tabular}{c l l} \hline
**Protocol** & **Information** & **Packet Description** \\ \hline ICMPv6 & Multicast listener query & Used by routers for finding interest in devices for joining certain \\  & & multicast groups. \\ \hline ICMPv6 & Router solicitation & A message is sent by devices to routers for identification, and the router \\  & & responds with a router advertisement message. \\ \hline IGMPv2 & Membership query, general & Query sent by multicast routers to all devices on the network for \\  & & identifying which multicast group the devices want to receive data from. \\ \hline SSDP & NOTIFY * HTTP/\(1.1\) & Message sent by a device to other devices on the network to inform them \\  & & of their availability. * means broadcast to all. \\ \hline LLTD & Discover & Link-Layer Topology Discovery (LLTD) message that helps map the \\  & & network’s physical topology. \\ \hline LLTD & Reset & Message used to reset the topology discovery process. \\ \hline \end{tabular}
\end{table} 
Table 7: Data packets found during experiment with Internet activity in personal router. each router are also due to the different firmware and configuration of the routers. No suspicious data packets were found to pass through the router. Overall, the experiments with both Internet activity and no Internet activity on the user end help us to conclude that the ISP is not exchanging any dubious data packets through the router, and hence the data gathering that the ISP conducts is not occurring at the user end. The user data are being collected in the ISP architecture, and therefore it cannot be specified which data the ISP is collecting. There is no non-intrusive method to find which types of data the ISP is gathering and how much information about each user is stored by them. The purpose of this research is not to verify the current data collected by the ISP but rather to investigate the capability of APTs to access the WLAN. To achieve this, we will explore two scenarios. The APT Has Access to Both the ISP and the Router, Which Is Equipped with ISP Firmware  
This firmware enables the collection of data on devices within the WLAN. As stipulated in the service agreement, this data collection is acknowledged. This situation mirrors the concerns discussed earlier regarding compromised network equipment. Technically, this firmware could be considered a backdoor, through which the APT could transfer data using transmission protocols like HTTP or exploit side channels such as DNS [84]. The APT Has No Access to ISP, or a Personal Router Is Used  
If the APT lacks direct access to the ISP or if a personal router is used, it can still accumulate significant data by intercepting HTTP and HTTPS packets within the WLAN. By scrutinizing the destinations of these packets, the APT can discern the types of devices utilized within the network, thereby facilitating the planning of future attacks. Additionally, the APT can execute various Man-in-the-Middle (MitM) attacks [85] to gain access to the WLAN.