I use a Zyxel P-660HN-T1A modem/residential gateway to connect to my home ADSL subscription.
I called my ISP today to inquire about upgrading to a faster broadband package. For some reason, my call was misinterpreted as a downstream speed complaint and my call was forwarded to a technician who carried out a BER test.
After doing this (and verifying that there were no issues), he mentioned the presence of 2 devices connected via WIFI and wanted to know if I knew about this as they might be downloading data unbeknownst to me. Of course, I was shocked at this.
Furthermore, he went on to suggest that I should secure my WLAN with a passphrase. I have unprotected WIFI for reasons of my own.
My obvious question: How did the tech support agent attain this information? Should we assume that the ISP has admin access to the device and is essentially on the local network at all times, despite me changing all default logins long ago (including the telnet login credentials)?
Please advise a concerned user.