4 ms·
Cable modem hacker faces up to 40 years in prison
- tptacek 17y agoThis isn't someone who modded cable modems for the joy of exploration. He tried to build a business on devices that stole service from Comcast.
- sown 17y agoIf he had molested a child he would probably serve less time.
- noonespecial 17y agoI doubt it. People have gone pretty batty when it comes to that particular offense. I hear that one's "prison experience" is somewhat different when its discovered that one is in for this particular crime as well.
- jsz0 17y agoExactly. There's no legitimate reason to modify a modem. At least with something like a mod chip for a console there's some (small) chance the person is using it to run homebrew code. In this case it's clear cut theft.
- stratomorph 17y agoWhile I agree that this guy is clearly a thief, I'd still disagree that there's no legitimate reason to modify a modem. I don't rent mine, I bought it, and it shouldn't be a crime to modify my own property. Maybe I'd like to change the firmware or remove the case to scavenge parts. Maybe I even want to change my MAC address. My old ISP made me re-enter my account info when I did that, and then it would work again. (Haven't tried it with the new one.) Nothing wrong with that.
- jsz0 17y agoI do see your point about modifying the hardware when it's no longer connected to a public network but cable infrastructure is a shared medium. The actions of one customer can effect hundreds of other customers. For example, we saw a specific firmware revision that caused the modem's burst modulator (upstream signal) to turn on a high power constant carrier in certain circumstances which would DoS all the modems on the same upstream offline. I've heard this was responsible for a massive outage in Phoenix last year due to 8 modems being upgraded before the code was fully tested. If you upgrade the firmware yourself it's putting other people at risk -- including digital phone subscribers who may be using their services as a life line. Changing your MAC address has some risk simply because MACs are supposed to be unique. You could accidentally DoS another customer offline by doing it although statistically the chances are pretty low you'd use another subscriber's MAC but it does happen from time to time when someone simply increments the last digit of the MAC address.
- papersmith 17y agoAssuming Comcast has a bandwidth cap, by spoofing real MAC addresses he's basically stealing other users' bandwidth. But then again, people steal wifi all the time.
- akamaka 17y agoWhen it comes to wifi, I'd drawn the line between stealing and innocent "borrowing" at the point when someone actually goes through the trouble of running a WEP password cracker, which is akin to what happened in this case.
- blasdel 17y agoThere's also no reason to spoof the MAC addresses of real subscribers. If your modem's external MAC isn't in Comcast's (global!) subscriber table, they give your modem a "walledgarden" default configuration file that causes it to reset frequently, and a poisoned DHCP DNS that directs all queries to their "Subscribe Now!" webserver. Some of the European ISPs have countermeasures that rotate the names of the configs frequently, but Comcast doesn't do that -- if you've modified your modem, all you have to do is have your modem ask for a different config file (the names of which it will sniff from your neighbors), and set a different DNS server on the modem's immediate clients.
- stratomorph 17y agoThough it makes you wonder what the sentence would be if he had built a business on stealing Comcast vans and selling them, instead.
- darien 17y agoGrand Theft Auto = Minimum 5 years x number of vans / Judge's consideration
- Tichy 17y agoTrue. However, he is in good company: didn't Steve Jobs and Steve Wozniak start out the same way when they sold their blue boxing devices? Imagine the iPad announcement coming from a prison cell...
- tptacek 17y agoPeople have done real prison time for phone phreaking.
- Tichy 17y agoI am not saying it's not a crime or that the hacker here shouldn't be punished. Just playing devil's advocate.
- tptacek 17y agoIt's also a different world now. You could make a couple bucks on the side in the late '70s and still (sometimes) get away with it, because the problems with our infrastructure hadn't been fully criminalized. We live in a world today where some significant percentage of all bank transactions in some countries are fraudulent. We've officially lost our sense of humor.
- lsc 17y agoI think some responsibility needs to be borne by those creating blatantly insecure systems. If I leave my garage door open and you come in and steal a server, sure, that's illegal, but if, say, I lock my garage door, (or otherwise take reasonable precautions) you break a window, and then steal the same server, your penalty will be greater. depending on equipment on the consumer premises to be secure (especially if your system is so weak as to just look at the mac address.) sounds to me a lot like leaving the garage door open. I think this goes doubly for the banking systems; right now, all I need in order to hover all the money out of your bank account is your checking account number (and a merchant account) and your checking account number is on every cheque you write. That's a ridiculously insecure system, and sure, it should be illegal to exploit that, but I think the banks are 'leaving the garage door open' here - they bear responsibility for not taking reasonable precautions.
- jacquesm 17y agoFirst off, I notice it says 'up to', there is no telling what he'll be sentenced to until it's done. But I find it a bit weird to see a sentencing guideline higher than second degree murder.
- tptacek 17y agoThere is virtually no chance he's going to prison longer than a murderer, regardless of what the article says.