5 ms·

I have an Arris modem. Is there a way to mitigate this risk short of buying a new modem?

by iamthepieman 11y ago

throwaway2048 11y ago
no, as the nature of it forces it to be on your network edge.
- lstamour 11y ago
  That said, it's possible that your cable company could protect you (and their other customers) at the expense of you possibly losing access to port forward SSH, etc.
- mhurron 11y ago
  Wouldn't putting the Arris modem in bridging mode mitigate it? It should no longer be accessible via an outside IP at that point.
  - throwaway2048 11y ago
    it almost certainly still has an externally accessible ip at that point for management purposes. (bridge 2 interfaces, add a virtual interface to the bridge)
    - mhurron 11y ago
      I don't believe management from the CableCo is done over IP and the other management end requires being plugged into the LAN port.
      - throwaway2048 11y ago
        as the article states, scans found wan acessible modem uis
        mhurron 11y ago
        Yes, but by default a modem from your ISP is acting as a NAT device routing to a private IP space. By default, it has an externally available IP address and will answer on that or those addresses. Many can, however, be configured as a bridge, which turns the device into just a converter between physical mediums. You now need another device to route and act as your gateway. In that setup you shouldn't be able to find it with an IP connection scan, because it doesn't have one.
        simoncion 11y ago
        > Yes, but by default a modem from your ISP is acting as a NAT device routing to a private IP space. Not in my experience. The default modem provided by both Comcast and Knology (who is -I guess- now WOW!) is (or was, in the case of Knology) a bridge device that requires you to provide your own router. You have to ask for a modem that's also a router to get something that's not a bridge. That doesn't mean that the modem doesn't have an IP address, mind. AIUI, on Comcast's network the modem gets an IPv6 address so that they can do network management stuff to it.
      - feld 11y ago
        I know of a cable co now doing management over v6, but I think there's a non-IP protocol too
      - solotronics 11y ago
        Management for the DOCSIS modems is definitely done over IP. It isnt over SSH but via a webapp controller. This webapp is used to push the firmwares which have the speed limits set in them.
lstamour 11y ago
I'm not sure I'd trust Arris products at this point. From another blog post in 2014: "It is worth noting that on previous FW revisions the CGI calls did NOT require any authentication and could be called without providing a valid "credential" cookie." http://console-cowboys.blogspot.ca/2014/09/arris-cable-modem-backdoor-im.html http://console-cowboys.blogspot.ca/2014/09/arris-cable-modem... With mistakes like that, and three layers of backdoors, I'm half expecting discoveries of hardware backdoors next ...
ilurk 11y ago
I skimmed trough it so it wasn't clear to me. But if you ssh and have root access, then you should be able to change the password. As well as edit a startup script to move/delete the backdoor files. Try it at your own risk.
- mark-r 11y ago
  The whole point of a backdoor is that changing the password is ineffective. And the backdoor isn't a file you can delete, it's just a couple of extra instructions buried in the code - the article made that clear.

I have an Arris modem. Is there a way to mitigate this risk short of buying a new modem?

throwaway2048 11y ago

no, as the nature of it forces it to be on your network edge.

lstamour 11y ago
That said, it's possible that your cable company could protect you (and their other customers) at the expense of you possibly losing access to port forward SSH, etc.
mhurron 11y ago
Wouldn't putting the Arris modem in bridging mode mitigate it? It should no longer be accessible via an outside IP at that point.
- throwaway2048 11y ago
  it almost certainly still has an externally accessible ip at that point for management purposes. (bridge 2 interfaces, add a virtual interface to the bridge)
  - mhurron 11y ago
    I don't believe management from the CableCo is done over IP and the other management end requires being plugged into the LAN port.
    - throwaway2048 11y ago
      as the article states, scans found wan acessible modem uis
      - mhurron 11y ago
        Yes, but by default a modem from your ISP is acting as a NAT device routing to a private IP space. By default, it has an externally available IP address and will answer on that or those addresses. Many can, however, be configured as a bridge, which turns the device into just a converter between physical mediums. You now need another device to route and act as your gateway. In that setup you shouldn't be able to find it with an IP connection scan, because it doesn't have one.
        simoncion 11y ago
        > Yes, but by default a modem from your ISP is acting as a NAT device routing to a private IP space. Not in my experience. The default modem provided by both Comcast and Knology (who is -I guess- now WOW!) is (or was, in the case of Knology) a bridge device that requires you to provide your own router. You have to ask for a modem that's also a router to get something that's not a bridge. That doesn't mean that the modem doesn't have an IP address, mind. AIUI, on Comcast's network the modem gets an IPv6 address so that they can do network management stuff to it.
    - feld 11y ago
      I know of a cable co now doing management over v6, but I think there's a non-IP protocol too
    - solotronics 11y ago
      Management for the DOCSIS modems is definitely done over IP. It isnt over SSH but via a webapp controller. This webapp is used to push the firmwares which have the speed limits set in them.

lstamour 11y ago

I'm not sure I'd trust Arris products at this point. From another blog post in 2014: "It is worth noting that on previous FW revisions the CGI calls did NOT require any authentication and could be called without providing a valid "credential" cookie." http://console-cowboys.blogspot.ca/2014/09/arris-cable-modem-backdoor-im.html http://console-cowboys.blogspot.ca/2014/09/arris-cable-modem... With mistakes like that, and three layers of backdoors, I'm half expecting discoveries of hardware backdoors next ...

ilurk 11y ago

I skimmed trough it so it wasn't clear to me. But if you ssh and have root access, then you should be able to change the password. As well as edit a startup script to move/delete the backdoor files. Try it at your own risk.

mark-r 11y ago
The whole point of a backdoor is that changing the password is ineffective. And the backdoor isn't a file you can delete, it's just a couple of extra instructions buried in the code - the article made that clear.