4 ms·

Yep, they still run Motorola firmware. I discovered a few months ago Comcast is able to push firmware updates to customer owned modems without permission. So

by Washuu 11y ago

Yep, they still run Motorola firmware. I discovered a few months ago Comcast is able to push firmware updates to customer owned modems without permission. So even if the backdoor is not present now there is no way to trust it will never be pushed to the devices.

tomschlick 11y ago
Thats worrisome. I knew they could ping for info/reboot it but had no idea they had write access to the device.
- wmf 11y ago
  Cable modems are based on a pre-Carterphone philosophy that the modem is an extension of the ISP and is completely owned (and 0wned), configured, updated, etc. by the ISP. They let you buy your own, but that doesn't change the protocol.
  - deleted 11y ago
    [deleted]
    - nitrogen 11y ago
      https://en.wikipedia.org/wiki/Carterfone#Landmark_regulatory_decision https://en.wikipedia.org/wiki/Carterfone#Landmark_regulatory...
- tomschlick 11y ago
  Makes sense. If they were to update something in their auth protocol or need to patch a security issue most people wouldn't have the tech chops to update firmware.
  - ikeboy 11y ago
    It should be auto-update but with the option to disable updates. So only technical people will turn that off.
    - johncolanduoni 11y ago
      How does this change anything? You can accept the update, or just let it will stop working with their network. And how is the new update any different in terms of trust than the initial carrier-specific update the modem gets when you activate?
oakwhiz 11y ago
From what I've seen, most ISPs running DOCSIS networks are able to do this with CPE (Customer Premises Equipment.)
deleted 11y ago
[deleted]
- tdicola 11y ago
  Wow that sounds like an awesome way for the NSA or anyone else to take over your home network. Splice into your home cable from outside, send down some nasty modem firmware, then patch the connection back up and you'll never know the difference.
  - ethbro 11y ago
    If someone lets a piece of ISP-provided hardware sit on the trusted side of their network then either they don't care or they're an idiot. Would you take a laptop from a stranger, plug it into your home network, and just let it sit there running?
    - tdicola 11y ago
      That's the thing, it's part of the DOCSIS standard so if you buy your own modem that the ISP never touches they can still change its firmware.
- userbinator 11y ago
  If you can figure out how to flash your CM on your own, it will still be overwritten with the firmware that gets pushed from your provider Not if you also figure out how to disable the firmware update feature, which I'd guess - I've never done anything with CMs other than plugging them in - is also code in the firmware itself. As long as the firmware running on the CM has full control of the hardware, it can be "configured" to refuse such updates, and maybe even spoof the fact that it was updated successfully. (Unless there's also some remote-attestation type stuff happening too. I'm not sure, I don't work in this area.)

by Washuu 11y ago

tomschlick 11y ago

Thats worrisome. I knew they could ping for info/reboot it but had no idea they had write access to the device.

wmf 11y ago
Cable modems are based on a pre-Carterphone philosophy that the modem is an extension of the ISP and is completely owned (and 0wned), configured, updated, etc. by the ISP. They let you buy your own, but that doesn't change the protocol.
- deleted 11y ago
  [deleted]
  - nitrogen 11y ago
    https://en.wikipedia.org/wiki/Carterfone#Landmark_regulatory_decision https://en.wikipedia.org/wiki/Carterfone#Landmark_regulatory...
tomschlick 11y ago
Makes sense. If they were to update something in their auth protocol or need to patch a security issue most people wouldn't have the tech chops to update firmware.
- ikeboy 11y ago
  It should be auto-update but with the option to disable updates. So only technical people will turn that off.
  - johncolanduoni 11y ago
    How does this change anything? You can accept the update, or just let it will stop working with their network. And how is the new update any different in terms of trust than the initial carrier-specific update the modem gets when you activate?

oakwhiz 11y ago

From what I've seen, most ISPs running DOCSIS networks are able to do this with CPE (Customer Premises Equipment.)

deleted 11y ago

[deleted]

tdicola 11y ago
Wow that sounds like an awesome way for the NSA or anyone else to take over your home network. Splice into your home cable from outside, send down some nasty modem firmware, then patch the connection back up and you'll never know the difference.
- ethbro 11y ago
  If someone lets a piece of ISP-provided hardware sit on the trusted side of their network then either they don't care or they're an idiot. Would you take a laptop from a stranger, plug it into your home network, and just let it sit there running?
  - tdicola 11y ago
    That's the thing, it's part of the DOCSIS standard so if you buy your own modem that the ISP never touches they can still change its firmware.
userbinator 11y ago
If you can figure out how to flash your CM on your own, it will still be overwritten with the firmware that gets pushed from your provider Not if you also figure out how to disable the firmware update feature, which I'd guess - I've never done anything with CMs other than plugging them in - is also code in the firmware itself. As long as the firmware running on the CM has full control of the hardware, it can be "configured" to refuse such updates, and maybe even spoof the fact that it was updated successfully. (Unless there's also some remote-attestation type stuff happening too. I'm not sure, I don't work in this area.)