15 ms·

Cable Haunt: A critical vulnerability found in cable modems

210 points by Aissen 7y ago

londons_explore 7y ago
Nobody should be trusting a modem. You don't put your private keys on a modem. Your credit card number isn't saved on the modem. So if hackers break into the modem, the worst they can do is shut off your internet. And if you really cared about reliability of your internet, you'd have two connections anyway. Really this is a non-issue.
- scoutt 7y ago
  > the worst they can do is shut off your internet I can imagine just a couple of more things about having complete control of the only internet gateway most of us have at home.
- edf13 7y ago
  There are considerable attack vectors opened up here... a quick glance at the front page shows: > Change default DNS server > Conduct remote man-in-the-middle attacks > Hot-swap code or even the entire firmware > Upload, flash, and upgrade firmware silently > Disable ISP firmware upgrade > Change every config file and settings > Get and Set SNMP OID values > Change all associated MAC Addresses > Change serial numbers > Be exploited in botnet A simple change in DNS servers combined with man-in-the-middle attacks is enough to fool many people into entering CC details into rogue sites for example. (Edit for typos!)
  - jonhendry18 7y ago
    "A simple change in DNS servers " Would this matter if the devices on the network are all themselves configured to use other DNS servers?
- LeonM 7y ago
  > the worst they can do is shut off your internet No, if your modem gets owned, you are in a whole lot of trouble. You become vulnerable for all sorts of MITM attacks. The attacker now also has access to your LAN, which is usually trusted by all devices on it.
  - pixl97 7y ago
    You mean you're not using end to end certificate based encryption for all your applications these days? And all the pushback we get from people here that DoH/DoT is a bad thing.
    - iso1631 7y ago
      You're implying we shouldn't bother with firewalls
    - satanspastaroll 7y ago
      Not all applications are, and there are specific automated downgrade attacks for encrypted comms that force some back to plaintext. Giving outsiders access to your internal network is rarely a good idea.
    - big_chungus 7y ago
      Many or most devices don't support this and the average consumer isn't capable of doing it himself.
    - MaxBarraclough 7y ago
      It's not my applications, but applications that auto-update over unencrypted HTTP. Also, IoT devices with software built by the lowest bidder.
  - MaxBarraclough 7y ago
    > You become vulnerable for all sorts of MITM attacks. The attacker now also has access to your LAN, which is usually trusted by all devices on it. Good points; these two issues are quite different. You could stop the network-access problem by putting an extra router (a secure one) between the modem and your local network, but that wouldn't save you from MITM.
- bb101 7y ago
  For most home users, the NAT on their router is also their firewall. It's akin to saying that it doesn't matter if someone can open your front door as they will only get access to the entrance hall...
- Lyrebirds 7y ago
  I see your point, but the vast majority of people who own a modem, have no idea that a private key does not refer to the one under their doormat. And even if the worst thing is shutting off peoples internet, I fail to see how, at this scale, it is not at least a tiny issue?
londons_explore 7y ago
I'm hoping someone secretly deploys tor nodes onto all of these 200 million connections, and tor (or something like it) becomes the defacto standard for connecting to the internet. Privacy matters more now than it did in the 1980's, and in todays age, having every website operator see your IP address isn't really cool.
- kryptiskt 7y ago
  Who would trust Tor if one party controls 200 million nodes?
  - arminiusreturns 7y ago
    I've theorized the 50 percent attacks have already been executed at the nation state level for a long time now, but that many nodes could reduce the effectiveness of the current 50 attack. Unless of course the same three letter did both...
    - gowld 7y ago
      I don't know if 50percent attacks exist on Tor, but in Tor, you don't need a 50percent attack, all you need is to attack the single Entry Guard a target uses. https://nakedsecurity.sophos.com/2015/08/03/can-you-trust-tors-entry-guards/ https://nakedsecurity.sophos.com/2015/08/03/can-you-trust-to...
      - arminiusreturns 7y ago
        I think 50 percent attacks apply to any supposedly decentralized service don't they?
- Cthulhu_ 7y ago
  I'm not comfortable with sharing my internet connection with other people. Also, some people are on metered and / or low bandwidth internet connections.
nanis 7y ago
I haven't read the full report, but, the PoC[1] and the explanations I have seen before seem to indicate one has to be on the "local" side of the cable modem to run the exploit. That is, it doesn't seem like this is exploitable remotely. That is, the attacker either needs to have been allowed to connect to your WiFi (either through another vulnerability or voluntarily) or attached a cable to your WiFi router or your cable modem. This is not impossible (not even requiring reliance on the fact that Google, Apple, and Microsoft among them have pretty much everyone's WiFi passwords[2]), but a wave of attacks based on this is much less feasible than if they could be carried en masse on the internet. [1]: https://github.com/Lyrebirds/sagemcom-fast-3890-exploit/blob/deb542553a90d84c6c5ffba59eaeab8bc126aadd/exploit.py#L32 https://github.com/Lyrebirds/sagemcom-fast-3890-exploit/blob... [2]: https://tourkick.com/advice-tips-howto/myth-busting-windows-10-wi-fi-sense-google-wireless-mapping/ https://tourkick.com/advice-tips-howto/myth-busting-windows-...
- ffffasd33 7y ago
  > That is, the attacker either needs to have been allowed to connect to your WiFi (either through another vulnerability or voluntarily) or attached a cable to your WiFi router or your cable modem. no you just have to visit a malicious link, through dns rebinding any local attack against a router can be done remotely.
- stedaniels 7y ago
  This is incorrect. It's accessed with websockets, that can be run from any webpage, so all you'd have to do is follow a malicious link. From the article: > Accessing the Endpoint > The endpoint, which serves a tool called spectrum analyzer, uses a websocket for communication with the graphical frontend displayed in a browser. Whereas CORS would restrict access to such an endpoint for HTTP requests, websocket is not protected by this protocol. Therefore, it is up to the server to verify the relevant request parameters added by the browser. Because these parameters are never inspected by the cable modem, the websocket will accept requests made by javascript running in the browser regardless of origin, thereby allowing attackers to reach the endpoint. It should be noted that the exploit is not limited to run in a browser. Any place where running code can reach an IP on the local network, can be used to exploit Cable Haunt.
LeonM 7y ago
This is nothing new, really. Crappy SOHO routers have been proven to be vulnerable over and over again. The thing though is that in most countries you don't actually own the modem, it stays property of the ISP. And because of that you are locked out, and often you can't even run a firmware update even if you have the technical knowledge. Really, ISPs should be held responsible for this. It is their equipment so they should also maintain it. For me this is the reason my 'modem' is still in the original box, I've installed my own equipment which I maintain myself. Granted, I am lucky because I have a fiber connection to my home, so really all I needed was an SFP module for my Edgerouter. I also live in a country where ISPs are required to support running your own equipment. With cable this becomes a lot harder or even impossible due to all kinds of network specific systems such as DOCSIS.
- behringer 7y ago
  You make it sound like the providers giving you a modem is a bad thing. This is a good thing. You as the consumer just needs to buy a decent router, and it's your ISPs responsibility to maintain the modem. If you have a decent router you have nothing to worry about. You can simply consider an attack on your modem an attack on your ISP. All ISPs I've ever seen in the US allow you to use your own router.
  - smileysteve 7y ago
    At a $5+/mo fee for items that normally sell for $60 it seems like profit seeking behavior. Comcast at least now made equipment returns easier though ups franchises, historically, it could take hours at an under staffed, low budget facility to return a item. And if you didn't you'd often expect to argue with collections.
    - behringer 7y ago
      5/mo is 120 over 2 years, which is imo the expected life on a modem. Now of course some last 5 years or more, but then some last 6 months. I think 60/year is a decent price for a 100 percent satisfaction guaranteed working modem.
debian3 7y ago
Does someone know if I can « unlock » my modem speed with this exploit?
- leetbulb 7y ago
  Even if you could, it's super illegal to do so.
  - tyingq 7y ago
    Most US cable providers let you use your own DOCSIS modem. I doubt there are any legal consequences for changing config on your own modem. Channel bonding has to be configured on both sides though.
    - lawnchair_larry 7y ago
      You’d be wrong. People have been raided and charged for that in the US.
      - vlan0 7y ago
        Eh, people have been raided and charged for the distribution modems and running websites. But cases of theft of service for running a hacked modem are nearly non-existent.
  - debian3 7y ago
    I guess we don’t have the same definition of « super illegal ».
- deleted 7y ago
  [deleted]
- lima 7y ago
  Super illegal, AND all ISPs have bandwidth accounting that will quickly spot the manipulation.
Eikon 7y ago
I'm wondering, how prevalent is DSL in the US? In France, cable is basically non-existent except in a few large cities. DSL is everywhere as legacy infrastructure and fiber coverage over the whole country is increasing at a fast rate. Is the US in a somewhat similar situation or is cable found pretty much anywhere?
- ljoshua 7y ago
  Cable is probably the leader in most markets in the US. DSL hasn’t been given the same innovation love, so in markets where it is still marketed (primarily by AT&T) the speeds are almost always lower/capped at 50Mbps down. In more rural areas DSL still has a stronger foothold. But in general, yes, cable is quite prevalent.
  - lotsofpulp 7y ago
    I haven’t seen DSL at more than 2-3mbps down even around the biggest US cities. The only real high bandwidth download option is cable (coaxial), and the only high bandwidth download and upload is fiber.
    - caspper69 7y ago
      AT&T markets a hybrid DSL technology under their UVerse brand name. They run FTTN (fiber to the node), then split from the node via standard DSL, albeit at much closer distances (and hence much higher speeds). This product can provide "DSL" in the 50-200Mb/s range (currently), but it is not the regular DSL that most people associate with the technology.
      - WorldMaker 7y ago
        From what I gather, FTTN itself illustrates the bootstrap problem the US market faces in that in some cases they should have fiber already run to the nodes decades previously, but didn't until the early days of DSL. US Telecoms are nothing if not procrastinators on infrastructure upgrades. The irony though is that if you are building FTTN new as much of AT&T has been doing the last decade and a half, it's not that much harder to at the same time push all the extra few dozen feet into the Home for FTTH, which Verizon figured out years back and AT&T only finally got a clue much more recently. (AT&T also hurts their case by charging basically the exact same prices for bad POTS DSL and FTTN DSL, despite the huge variance in speeds, and tend to be not entirely forthright about which option is serviced to a particular address, leaving a lot of US consumers with an overall distrust of DSL.)
peter_d_sherman 7y ago
I think it's high time for an FPGA-based, open hardware, open software, auditable-by-everyone, cable modem project... Even if it isn't immediately DOCSIS compatible... Heck, just get a single packet of data over a cable from point A to point B using an open FPGA-based design... Put that on the Internet... that's the starting point... Let it evolve from there...
- kortex 7y ago
  Well there's this: https://github.com/ucsdsysnet/corundum https://github.com/ucsdsysnet/corundum But that's more intended for optical networks. Useful reference at the very least. Really, we need more fiber optic everywhere. It's easier to hack on, because cable modems are technically radios, and run into the usual FCC red tape. Plus, fiber is just better.
- rabryan35 7y ago
  Good luck with that. I think you’d be better off leveraging an existing open SDR board for the different waveforms these modems support. Even still I don’t think there are any affordable SDRs out there that can support the high order QAM modes of even just the old DOCSIS specs much less 3.0 and above
- Fnoord 7y ago
  DSL has the same issue. You can run a PCI DSL modem (Sangoma S518 [ADSL1], Sangoma S519 [ADSL2], VigorNIC 132 [VDSL]) but it either uses a proprietary binary blob for the firmware, or it abstracts the interface to a generic RTL8139 or whatever (which works with many OSes).
  - blattimwind 7y ago
    The VigorNIC is really just a Vigor130 on a PCI card. It has it's own Linux-based modem/router firmware running on it and you configure it by accessing the usual web interface exposed on the virtual ethernet port.
- raintrees 7y ago
  Our ISP (Spectrum) refuses to work with customer-supplied equipment. Even when I have proven their equipment to be faulty - I still had to wait a day or two for a technician. And having a business account, at least it was that quick. My residential neighbors can sometimes wait up to a week for remedy, and are frequently told things like "check with your neighbors to see if they have service" when reporting service problems.
jwr 7y ago
For years now I insisted on getting a modem operating in bridge mode, with a Ubiquiti Unifi USG doing the actual routing and Unifi access points providing Wi-Fi. I never trusted the crappy modems, especially the ones provided by the cable company. Ubiquiti cares much more about frequent software updates and the general security and reliability of their gear. The cable companies push trash, because they can get away with it in most cases. In this particular case, I don't know if my modem is affected, but I don't really care: it's part of the operator's network, beyond the security boundaries of my network.
- Arie 7y ago
  My cable modem is in bridge but I can also reach its web interface the management IP. In that case, you should find out if the modem is vulnerable because an exploited modem could still be messing with your traffic.
  - jwr 7y ago
    Messing how? I mean, yes, it is a problem, but so is any networking device anywhere on the Internet — as soon as the traffic leaves my network, all bets are off. The point is not to allow operator-managed crappy devices (like cable modems) into my network.
onesmallcoin 7y ago
I recently had the frustration of trying to use a Vodafone ISP Supplied modem. It had a propietary interface which didn't allow using the modem as a bridge to a network not on a vlan. Along with the help of the awesome team at hack-technicolor we managed to find a command execution exploit in the dyndns updater which allowed us to free the Vodafone UltraHub Technicolor DGA0130VDF modem along with others. The device is a cool box running a Dual Core Broadcom 400MHz CPU with 256MB DDR3 RAM it's a DSL/WAN router with ADSL/VDSL, Wi-Fi 11b/g/n/ac 5GHz/2.4GHz, And SIP support for two phones. Also now a working WAN port to a non-vodafone gateway. The device was running openwrt; We also figured out how to keep persistance on the device after a firmware update to an unexploitable version meaning you can even have SSH running on the latest kernel from Vodafone too. In all had a great time working on this box and feels awesome to free an otherwise awesome device from the trash-heap! https://github.com/kevdagoat/hack-technicolor/issues/68 https://github.com/kevdagoat/hack-technicolor/issues/68
merpnderp 7y ago
Why are the admin pages of all these cable modems written with websockets if they can be accessed via a websocket request from any rando website you visit? Is this just a bunch of massive mistakes or is there a good reason?
- thrower123 7y ago
  I'm sure that this kind of thing is farmed out to the lowest bidder.
zaroth 7y ago
As mentioned by several comments, an import defensive step that most home users can take is to ensure you have a firewall rule in your router blocking any traffic on your LAN from accessing the modem on its LAN port, and any traffic originating from the modem LAN IP from getting onto your LAN. This could be a default setting when going through a setup wizard on most routers, detecting the MAC of the modem is easy, and automatically blocking any LAN traffic to that MAC which is not merely using it as a next-hop. I think the only challenge is that very rarely you will want to access your modem’s LAN IP for debugging purposes. But I suppose the average user will have no clue how to do this anyway... Unfortunately this is just the tip of the iceberg for so many ways these SOHO devices are vulnerable, this level of defense in depth is nice in theory but perhaps just a finger in the dike.
- bscphil 7y ago
  > As mentioned by several comments, an import defensive step that most home users can take is to ensure you have a firewall rule in your router blocking any traffic on your LAN from accessing the modem on its LAN port, and any traffic originating from the modem LAN IP from getting onto your LAN. Yep, most of this vulnerability is (very) old news. There used to be a vulnerability for the very popular Motorola / Arris SB series where any website could CSRF into the modem's webpage and do a "reset", which would shut off your internet for up to half an hour until it could reprovision with your ISP. There was even a proof of concept site that did this (with a big red warning first), I really wish I could remember the domain name. Anyway, I used that modem and of course I just completely blocked access to its IP address on my router's firewall. It's really incredibly unfortunate that even today you have to be tech savvy to protect yourself from the devices running in your home. Basic security should come default. Here's a another vulnerability for you. On my grandparents' DSL, the ISP supplied combined modem/router has a config page that is (mostly) not password protected. You can see the passwords for every SSID without logging in, you can reset the router, see information on other devices connected to the network, etc etc. Absolute insanity. Edit: I did find the website, but it was eventually taken down by the creator after (most?) ISPs patched the problem. https://web.archive.org/web/20160921191154/http://www.rebootmymodem.net/ https://web.archive.org/web/20160921191154/http://www.reboot...
thrower123 7y ago
I do not allow Comcast modems or routers on my network. I think this still saves me $9/month or something, foregoing the rental charge for their hardware, but even if it didn't I wouldn't trust them.

210 points by Aissen 7y ago

Nobody should be trusting a modem. You don't put your private keys on a modem. Your credit card number isn't saved on the modem. So if hackers break into the modem, the worst they can do is shut off your internet. And if you really cared about reliability of your internet, you'd have two connections anyway. Really this is a non-issue.

scoutt 7y ago
> the worst they can do is shut off your internet I can imagine just a couple of more things about having complete control of the only internet gateway most of us have at home.
edf13 7y ago
There are considerable attack vectors opened up here... a quick glance at the front page shows: > Change default DNS server > Conduct remote man-in-the-middle attacks > Hot-swap code or even the entire firmware > Upload, flash, and upgrade firmware silently > Disable ISP firmware upgrade > Change every config file and settings > Get and Set SNMP OID values > Change all associated MAC Addresses > Change serial numbers > Be exploited in botnet A simple change in DNS servers combined with man-in-the-middle attacks is enough to fool many people into entering CC details into rogue sites for example. (Edit for typos!)
- jonhendry18 7y ago
  "A simple change in DNS servers " Would this matter if the devices on the network are all themselves configured to use other DNS servers?
LeonM 7y ago
> the worst they can do is shut off your internet No, if your modem gets owned, you are in a whole lot of trouble. You become vulnerable for all sorts of MITM attacks. The attacker now also has access to your LAN, which is usually trusted by all devices on it.
- pixl97 7y ago
  You mean you're not using end to end certificate based encryption for all your applications these days? And all the pushback we get from people here that DoH/DoT is a bad thing.
  - iso1631 7y ago
    You're implying we shouldn't bother with firewalls
  - satanspastaroll 7y ago
    Not all applications are, and there are specific automated downgrade attacks for encrypted comms that force some back to plaintext. Giving outsiders access to your internal network is rarely a good idea.
  - big_chungus 7y ago
    Many or most devices don't support this and the average consumer isn't capable of doing it himself.
  - MaxBarraclough 7y ago
    It's not my applications, but applications that auto-update over unencrypted HTTP. Also, IoT devices with software built by the lowest bidder.
- MaxBarraclough 7y ago
  > You become vulnerable for all sorts of MITM attacks. The attacker now also has access to your LAN, which is usually trusted by all devices on it. Good points; these two issues are quite different. You could stop the network-access problem by putting an extra router (a secure one) between the modem and your local network, but that wouldn't save you from MITM.
bb101 7y ago
For most home users, the NAT on their router is also their firewall. It's akin to saying that it doesn't matter if someone can open your front door as they will only get access to the entrance hall...
Lyrebirds 7y ago
I see your point, but the vast majority of people who own a modem, have no idea that a private key does not refer to the one under their doormat. And even if the worst thing is shutting off peoples internet, I fail to see how, at this scale, it is not at least a tiny issue?

londons_explore 7y ago

I'm hoping someone secretly deploys tor nodes onto all of these 200 million connections, and tor (or something like it) becomes the defacto standard for connecting to the internet. Privacy matters more now than it did in the 1980's, and in todays age, having every website operator see your IP address isn't really cool.

kryptiskt 7y ago
Who would trust Tor if one party controls 200 million nodes?
- arminiusreturns 7y ago
  I've theorized the 50 percent attacks have already been executed at the nation state level for a long time now, but that many nodes could reduce the effectiveness of the current 50 attack. Unless of course the same three letter did both...
  - gowld 7y ago
    I don't know if 50percent attacks exist on Tor, but in Tor, you don't need a 50percent attack, all you need is to attack the single Entry Guard a target uses. https://nakedsecurity.sophos.com/2015/08/03/can-you-trust-tors-entry-guards/ https://nakedsecurity.sophos.com/2015/08/03/can-you-trust-to...
    - arminiusreturns 7y ago
      I think 50 percent attacks apply to any supposedly decentralized service don't they?
Cthulhu_ 7y ago
I'm not comfortable with sharing my internet connection with other people. Also, some people are on metered and / or low bandwidth internet connections.

nanis 7y ago

I haven't read the full report, but, the PoC[1] and the explanations I have seen before seem to indicate one has to be on the "local" side of the cable modem to run the exploit. That is, it doesn't seem like this is exploitable remotely. That is, the attacker either needs to have been allowed to connect to your WiFi (either through another vulnerability or voluntarily) or attached a cable to your WiFi router or your cable modem. This is not impossible (not even requiring reliance on the fact that Google, Apple, and Microsoft among them have pretty much everyone's WiFi passwords[2]), but a wave of attacks based on this is much less feasible than if they could be carried en masse on the internet. [1]: https://github.com/Lyrebirds/sagemcom-fast-3890-exploit/blob/deb542553a90d84c6c5ffba59eaeab8bc126aadd/exploit.py#L32 https://github.com/Lyrebirds/sagemcom-fast-3890-exploit/blob... [2]: https://tourkick.com/advice-tips-howto/myth-busting-windows-10-wi-fi-sense-google-wireless-mapping/ https://tourkick.com/advice-tips-howto/myth-busting-windows-...

ffffasd33 7y ago
> That is, the attacker either needs to have been allowed to connect to your WiFi (either through another vulnerability or voluntarily) or attached a cable to your WiFi router or your cable modem. no you just have to visit a malicious link, through dns rebinding any local attack against a router can be done remotely.
stedaniels 7y ago
This is incorrect. It's accessed with websockets, that can be run from any webpage, so all you'd have to do is follow a malicious link. From the article: > Accessing the Endpoint > The endpoint, which serves a tool called spectrum analyzer, uses a websocket for communication with the graphical frontend displayed in a browser. Whereas CORS would restrict access to such an endpoint for HTTP requests, websocket is not protected by this protocol. Therefore, it is up to the server to verify the relevant request parameters added by the browser. Because these parameters are never inspected by the cable modem, the websocket will accept requests made by javascript running in the browser regardless of origin, thereby allowing attackers to reach the endpoint. It should be noted that the exploit is not limited to run in a browser. Any place where running code can reach an IP on the local network, can be used to exploit Cable Haunt.

LeonM 7y ago

This is nothing new, really. Crappy SOHO routers have been proven to be vulnerable over and over again. The thing though is that in most countries you don't actually own the modem, it stays property of the ISP. And because of that you are locked out, and often you can't even run a firmware update even if you have the technical knowledge. Really, ISPs should be held responsible for this. It is their equipment so they should also maintain it. For me this is the reason my 'modem' is still in the original box, I've installed my own equipment which I maintain myself. Granted, I am lucky because I have a fiber connection to my home, so really all I needed was an SFP module for my Edgerouter. I also live in a country where ISPs are required to support running your own equipment. With cable this becomes a lot harder or even impossible due to all kinds of network specific systems such as DOCSIS.

behringer 7y ago
You make it sound like the providers giving you a modem is a bad thing. This is a good thing. You as the consumer just needs to buy a decent router, and it's your ISPs responsibility to maintain the modem. If you have a decent router you have nothing to worry about. You can simply consider an attack on your modem an attack on your ISP. All ISPs I've ever seen in the US allow you to use your own router.
- smileysteve 7y ago
  At a $5+/mo fee for items that normally sell for $60 it seems like profit seeking behavior. Comcast at least now made equipment returns easier though ups franchises, historically, it could take hours at an under staffed, low budget facility to return a item. And if you didn't you'd often expect to argue with collections.
  - behringer 7y ago
    5/mo is 120 over 2 years, which is imo the expected life on a modem. Now of course some last 5 years or more, but then some last 6 months. I think 60/year is a decent price for a 100 percent satisfaction guaranteed working modem.

debian3 7y ago

Does someone know if I can « unlock » my modem speed with this exploit?

leetbulb 7y ago
Even if you could, it's super illegal to do so.
- tyingq 7y ago
  Most US cable providers let you use your own DOCSIS modem. I doubt there are any legal consequences for changing config on your own modem. Channel bonding has to be configured on both sides though.
  - lawnchair_larry 7y ago
    You’d be wrong. People have been raided and charged for that in the US.
    - vlan0 7y ago
      Eh, people have been raided and charged for the distribution modems and running websites. But cases of theft of service for running a hacked modem are nearly non-existent.
- debian3 7y ago
  I guess we don’t have the same definition of « super illegal ».
deleted 7y ago
[deleted]
lima 7y ago
Super illegal, AND all ISPs have bandwidth accounting that will quickly spot the manipulation.

Eikon 7y ago

I'm wondering, how prevalent is DSL in the US? In France, cable is basically non-existent except in a few large cities. DSL is everywhere as legacy infrastructure and fiber coverage over the whole country is increasing at a fast rate. Is the US in a somewhat similar situation or is cable found pretty much anywhere?

ljoshua 7y ago
Cable is probably the leader in most markets in the US. DSL hasn’t been given the same innovation love, so in markets where it is still marketed (primarily by AT&T) the speeds are almost always lower/capped at 50Mbps down. In more rural areas DSL still has a stronger foothold. But in general, yes, cable is quite prevalent.
- lotsofpulp 7y ago
  I haven’t seen DSL at more than 2-3mbps down even around the biggest US cities. The only real high bandwidth download option is cable (coaxial), and the only high bandwidth download and upload is fiber.
  - caspper69 7y ago
    AT&T markets a hybrid DSL technology under their UVerse brand name. They run FTTN (fiber to the node), then split from the node via standard DSL, albeit at much closer distances (and hence much higher speeds). This product can provide "DSL" in the 50-200Mb/s range (currently), but it is not the regular DSL that most people associate with the technology.
    - WorldMaker 7y ago
      From what I gather, FTTN itself illustrates the bootstrap problem the US market faces in that in some cases they should have fiber already run to the nodes decades previously, but didn't until the early days of DSL. US Telecoms are nothing if not procrastinators on infrastructure upgrades. The irony though is that if you are building FTTN new as much of AT&T has been doing the last decade and a half, it's not that much harder to at the same time push all the extra few dozen feet into the Home for FTTH, which Verizon figured out years back and AT&T only finally got a clue much more recently. (AT&T also hurts their case by charging basically the exact same prices for bad POTS DSL and FTTN DSL, despite the huge variance in speeds, and tend to be not entirely forthright about which option is serviced to a particular address, leaving a lot of US consumers with an overall distrust of DSL.)

peter_d_sherman 7y ago

I think it's high time for an FPGA-based, open hardware, open software, auditable-by-everyone, cable modem project... Even if it isn't immediately DOCSIS compatible... Heck, just get a single packet of data over a cable from point A to point B using an open FPGA-based design... Put that on the Internet... that's the starting point... Let it evolve from there...

kortex 7y ago
Well there's this: https://github.com/ucsdsysnet/corundum https://github.com/ucsdsysnet/corundum But that's more intended for optical networks. Useful reference at the very least. Really, we need more fiber optic everywhere. It's easier to hack on, because cable modems are technically radios, and run into the usual FCC red tape. Plus, fiber is just better.
rabryan35 7y ago
Good luck with that. I think you’d be better off leveraging an existing open SDR board for the different waveforms these modems support. Even still I don’t think there are any affordable SDRs out there that can support the high order QAM modes of even just the old DOCSIS specs much less 3.0 and above
Fnoord 7y ago
DSL has the same issue. You can run a PCI DSL modem (Sangoma S518 [ADSL1], Sangoma S519 [ADSL2], VigorNIC 132 [VDSL]) but it either uses a proprietary binary blob for the firmware, or it abstracts the interface to a generic RTL8139 or whatever (which works with many OSes).
- blattimwind 7y ago
  The VigorNIC is really just a Vigor130 on a PCI card. It has it's own Linux-based modem/router firmware running on it and you configure it by accessing the usual web interface exposed on the virtual ethernet port.
raintrees 7y ago
Our ISP (Spectrum) refuses to work with customer-supplied equipment. Even when I have proven their equipment to be faulty - I still had to wait a day or two for a technician. And having a business account, at least it was that quick. My residential neighbors can sometimes wait up to a week for remedy, and are frequently told things like "check with your neighbors to see if they have service" when reporting service problems.

jwr 7y ago

For years now I insisted on getting a modem operating in bridge mode, with a Ubiquiti Unifi USG doing the actual routing and Unifi access points providing Wi-Fi. I never trusted the crappy modems, especially the ones provided by the cable company. Ubiquiti cares much more about frequent software updates and the general security and reliability of their gear. The cable companies push trash, because they can get away with it in most cases. In this particular case, I don't know if my modem is affected, but I don't really care: it's part of the operator's network, beyond the security boundaries of my network.

Arie 7y ago
My cable modem is in bridge but I can also reach its web interface the management IP. In that case, you should find out if the modem is vulnerable because an exploited modem could still be messing with your traffic.
- jwr 7y ago
  Messing how? I mean, yes, it is a problem, but so is any networking device anywhere on the Internet — as soon as the traffic leaves my network, all bets are off. The point is not to allow operator-managed crappy devices (like cable modems) into my network.

onesmallcoin 7y ago

I recently had the frustration of trying to use a Vodafone ISP Supplied modem. It had a propietary interface which didn't allow using the modem as a bridge to a network not on a vlan. Along with the help of the awesome team at hack-technicolor we managed to find a command execution exploit in the dyndns updater which allowed us to free the Vodafone UltraHub Technicolor DGA0130VDF modem along with others. The device is a cool box running a Dual Core Broadcom 400MHz CPU with 256MB DDR3 RAM it's a DSL/WAN router with ADSL/VDSL, Wi-Fi 11b/g/n/ac 5GHz/2.4GHz, And SIP support for two phones. Also now a working WAN port to a non-vodafone gateway. The device was running openwrt; We also figured out how to keep persistance on the device after a firmware update to an unexploitable version meaning you can even have SSH running on the latest kernel from Vodafone too. In all had a great time working on this box and feels awesome to free an otherwise awesome device from the trash-heap! https://github.com/kevdagoat/hack-technicolor/issues/68 https://github.com/kevdagoat/hack-technicolor/issues/68

merpnderp 7y ago

Why are the admin pages of all these cable modems written with websockets if they can be accessed via a websocket request from any rando website you visit? Is this just a bunch of massive mistakes or is there a good reason?

thrower123 7y ago
I'm sure that this kind of thing is farmed out to the lowest bidder.

zaroth 7y ago

As mentioned by several comments, an import defensive step that most home users can take is to ensure you have a firewall rule in your router blocking any traffic on your LAN from accessing the modem on its LAN port, and any traffic originating from the modem LAN IP from getting onto your LAN. This could be a default setting when going through a setup wizard on most routers, detecting the MAC of the modem is easy, and automatically blocking any LAN traffic to that MAC which is not merely using it as a next-hop. I think the only challenge is that very rarely you will want to access your modem’s LAN IP for debugging purposes. But I suppose the average user will have no clue how to do this anyway... Unfortunately this is just the tip of the iceberg for so many ways these SOHO devices are vulnerable, this level of defense in depth is nice in theory but perhaps just a finger in the dike.

bscphil 7y ago
> As mentioned by several comments, an import defensive step that most home users can take is to ensure you have a firewall rule in your router blocking any traffic on your LAN from accessing the modem on its LAN port, and any traffic originating from the modem LAN IP from getting onto your LAN. Yep, most of this vulnerability is (very) old news. There used to be a vulnerability for the very popular Motorola / Arris SB series where any website could CSRF into the modem's webpage and do a "reset", which would shut off your internet for up to half an hour until it could reprovision with your ISP. There was even a proof of concept site that did this (with a big red warning first), I really wish I could remember the domain name. Anyway, I used that modem and of course I just completely blocked access to its IP address on my router's firewall. It's really incredibly unfortunate that even today you have to be tech savvy to protect yourself from the devices running in your home. Basic security should come default. Here's a another vulnerability for you. On my grandparents' DSL, the ISP supplied combined modem/router has a config page that is (mostly) not password protected. You can see the passwords for every SSID without logging in, you can reset the router, see information on other devices connected to the network, etc etc. Absolute insanity. Edit: I did find the website, but it was eventually taken down by the creator after (most?) ISPs patched the problem. https://web.archive.org/web/20160921191154/http://www.rebootmymodem.net/ https://web.archive.org/web/20160921191154/http://www.reboot...

thrower123 7y ago

I do not allow Comcast modems or routers on my network. I think this still saves me $9/month or something, foregoing the rental charge for their hardware, but even if it didn't I wouldn't trust them.