5 ms·

This is nothing new, really. Crappy SOHO routers have been proven to be vulnerable over and over again. The thing though is that in most countries you don't ac

by LeonM 7y ago

This is nothing new, really. Crappy SOHO routers have been proven to be vulnerable over and over again. The thing though is that in most countries you don't actually own the modem, it stays property of the ISP. And because of that you are locked out, and often you can't even run a firmware update even if you have the technical knowledge. Really, ISPs should be held responsible for this. It is their equipment so they should also maintain it. For me this is the reason my 'modem' is still in the original box, I've installed my own equipment which I maintain myself. Granted, I am lucky because I have a fiber connection to my home, so really all I needed was an SFP module for my Edgerouter. I also live in a country where ISPs are required to support running your own equipment. With cable this becomes a lot harder or even impossible due to all kinds of network specific systems such as DOCSIS.

behringer 7y ago
You make it sound like the providers giving you a modem is a bad thing. This is a good thing. You as the consumer just needs to buy a decent router, and it's your ISPs responsibility to maintain the modem. If you have a decent router you have nothing to worry about. You can simply consider an attack on your modem an attack on your ISP. All ISPs I've ever seen in the US allow you to use your own router.
- smileysteve 7y ago
  At a $5+/mo fee for items that normally sell for $60 it seems like profit seeking behavior. Comcast at least now made equipment returns easier though ups franchises, historically, it could take hours at an under staffed, low budget facility to return a item. And if you didn't you'd often expect to argue with collections.
  - behringer 7y ago
    5/mo is 120 over 2 years, which is imo the expected life on a modem. Now of course some last 5 years or more, but then some last 6 months. I think 60/year is a decent price for a 100 percent satisfaction guaranteed working modem.
    - heydabop 7y ago
      > which is imo the expected life on a modem Then buy better modems. My current modem is 4 years old and functions as well as it did on day 1. If they weren't making money on it they wouldn't sell it to you as an option. Sure the "insurance" might be nice, but overtime they're making money off of you.
    - mavhc 7y ago
      Where are you living where modems die every 2 years? My cable modem/wifi router from ISP is about 5 years old. Can't use your own cable modem in UK. They don't list providing of the modem as a line item on the bill either
      - tinus_hn 7y ago
        Officially the EU requires allowing customers to use their own modem if they want to. If the ISP setup requires registering MAC addresses they are obligated to register your personal modem and if a weird setup is required they have to document everything and notify you in advance of changes.
        gog 7y ago
        Do you have any more details about this? A link or what to search for would be also great.
        tinus_hn 7y ago
        The directive is 2008/63/EG. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32008L0063 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32...
        mavhc 7y ago
        Can only see one example of someone asking about that on google.
  - edoceo 7y ago
    Comcast in Washington is $10/mo
  - enobrev 7y ago
    Here's a fun trick Comcast is now playing with in Chicago. For unlimited data, it costs $50 a month if you're using your own modem, but using Comcast's modem, I get a "discounted" rate of $20 a month including the modem rental. It's their way of charging me to use my own modem (which I believe is illegal), hidden behind the ruse of it being a discount to rent theirs.
- LeonM 7y ago
  > You can simply consider an attack on your modem an attack on your ISP. Never thought about it that way. I agree. > All ISPs I've ever seen in the US allow you to use your own router. I'm not familiar with the US market, I was speaking from my personal experience with EU based ISPs. I should have made that clear.
  - Vrondi 7y ago
    In the USA, you can use your own router and your own modem, if you are aware enough to do so. Most common people just use whatever the ISP hands them, and pay $5 per month or more for years on end for the privilege of using boxes that never get updated.
- ken 7y ago
  Likewise, you make it seem like ISPs are competent enough to recognize an attacked modem, and repair or replace it on demand, and promptly. My experience is that when your internet connection goes down or becomes unusable, and you call and complain, it can be literally several weeks before they even respond to you. They may technically own the modem but you’re in your own to keep it running.
  - behringer 7y ago
    Not my experience. My parents are stuck with Comcast due to their monopoly and even they bend over backwards to fix my parents recent issues (hardware failure). Sure it took a couple weeks, but it a couple weeks of troubleshooting, testing, a couple visits, some hardware replacements. People expect these repair installers to be miracle workers, but sometimes an intermittent fault takes time.
  - derefr 7y ago
    > competent enough to recognize an attacked modem, and repair or replace it on demand The cable modems I've interacted with all seem to be immutable infrastructure: their state consists of 1. a signed firmware image; 2. a DOCSIS initialization packet received upon network registration (essentially equivalent to a cellular "carrier profile"); 3. a set of saved preferences; and 4. some volatile working state, like ARP tables or WPA encryption-stream key state. #4 gets trashed on reboot; #3 shouldn't be large enough (or executable) in a way where programs can run from it; #2 gets overwritten every time the network reconnects; and so the only place to put a persistent malware vector should be #1. And #1 can only be written to using signed code (sort of like Intel CPU microcode.) So what's the problem that can't be solved by rebooting the modem?
Lyrebirds 7y ago
You are unfortunately right about the reputation of SOHO routers and modems. The programming required to correct this issue is rather trivial, so hopefully patches should be easy to roll out. The unfortunate thing, is how the code has propagated from Broadcom across many vendors to even more ISPs, and how getting in touch with every affected ISP is a bit of a mess. Hence our attempt at branding, as this has a better chance of getting non-technical focus, which seems to be the way to reach many ISPs these days.
lawnchair_larry 7y ago
Most countries allow you to own a modem, and that’s why all the major retailers sell them. They are not property of the ISP. Only the ISP can upgrade them however.
ad_hominem 7y ago
If you have fiber you're probably plugging your SFP into an ONT which is already acting like a modem anyway. > With cable this becomes a lot harder or even impossible due to all kinds of network specific systems such as DOCSIS. You're probably on a PON which doesn't use DOCSIS exactly but it's still doing TDM and/or WDM multiplexing because you're sharing a laser diode with a bunch of your neighbors - the ONT transceives the multiplexed laser signal. You're still dealing with DOCSIS-like functionality.
- Hello71 7y ago
  By my reckoning, as long as the modem has no public- or customer-facing IP address, it's probably not going to be a vector for easy attacks. It might be accessible from within the ISP network, but if someone has access there then they can probably just tap your line directly, no need for additional exploits.
  - ad_hominem 7y ago
    ONTs typically terminate to Ethernet at the customer premises so it's effectively the exact same thing as a cable modem. So not any more secure than having cable and using the cable company's provided modem. If you tapped someone's fiber line, all the traffic between the ISP headend and customer premises (OLT and ONT if we're talking fiber) will be encrypted. In fact on a PON network using TDM it has to be, because if you stared down your own fiber you would be seeing all your neighbors' traffic as you're all time-sharing the same laser diode at the ISP headend (because it's a passive network, you will be seeing your neighbor's traffic when the diode is transmitting outside of your designated time cycle). Anyway my only point was to inform OP that contrary to their belief, they effectively are in the situation of having an ISP-owned modem.
    - solotronics 7y ago
      When I was setting this up for an ISP a few years ago the TDM was just a SFP that has its own MAC address inside. Its doing the TDM part inside the SPF itself. When we configured a new customer it was just adding the MAC to the config of an interface on an alcatel router at the hub side. You might not be able to transmit without interference but I bet you could spoof the MAC of a neighbor on the same fiber and listen in.
segfaultbuserr 7y ago
The problem gets worse when thing aren't just routers, but modems from your ISP. Unlike routers, which you are free to replace it (or install OpenWrt), using a modem is mandatory, and it's very likely that there is no alternative. Even if the modem uses a standard protocol like DOCSIS internally, it either has some vendor-lockins or proprietary/customized software by ISPs. A few years ago, I got my optical cable modem from my ISP, and I immediately found that the real admin account was locked from me, only accessible by the ISP. So I couldn't just PPPoE and gets my connection, but I had to use the NAT on the modem. After a quick websearch, I realized there are plenty of ISP/OEM management interfaces and backdoors in the modem. Although the documented backdoor has been disabled, I eventually found my way to a root shell, so I could change the mode to bridged w/ PPPoE. Meanwhile, I always use my own router behind the modem, with an additional firewall blocking all the incoming connections from the modem's IP address. I absolutely don't have the slightest trust on these modems. If I cannot change the modem, at least I can isolate the problem away from my routers (and use encrypted protocols as much as possible). Attackers are free to execute arbitrary code on my modem, I'll simply treat the modem as part of the untrusted Internet, which can be as dangerous as a hacked modem.
- tobenortobe 7y ago
  Letting the attackers be 'mittle in the man' is little bit too generous especially on dns side
  - labawi 7y ago
    Your ISP is has a MITM position whether they own your cable box or not¹. What you usually don't want is them having access to your LAN. ¹ As far as is relevant in this context.

by LeonM 7y ago

behringer 7y ago

You make it sound like the providers giving you a modem is a bad thing. This is a good thing. You as the consumer just needs to buy a decent router, and it's your ISPs responsibility to maintain the modem. If you have a decent router you have nothing to worry about. You can simply consider an attack on your modem an attack on your ISP. All ISPs I've ever seen in the US allow you to use your own router.

smileysteve 7y ago
At a $5+/mo fee for items that normally sell for $60 it seems like profit seeking behavior. Comcast at least now made equipment returns easier though ups franchises, historically, it could take hours at an under staffed, low budget facility to return a item. And if you didn't you'd often expect to argue with collections.
- behringer 7y ago
  5/mo is 120 over 2 years, which is imo the expected life on a modem. Now of course some last 5 years or more, but then some last 6 months. I think 60/year is a decent price for a 100 percent satisfaction guaranteed working modem.
  - heydabop 7y ago
    > which is imo the expected life on a modem Then buy better modems. My current modem is 4 years old and functions as well as it did on day 1. If they weren't making money on it they wouldn't sell it to you as an option. Sure the "insurance" might be nice, but overtime they're making money off of you.
  - mavhc 7y ago
    Where are you living where modems die every 2 years? My cable modem/wifi router from ISP is about 5 years old. Can't use your own cable modem in UK. They don't list providing of the modem as a line item on the bill either
    - tinus_hn 7y ago
      Officially the EU requires allowing customers to use their own modem if they want to. If the ISP setup requires registering MAC addresses they are obligated to register your personal modem and if a weird setup is required they have to document everything and notify you in advance of changes.
      - gog 7y ago
        Do you have any more details about this? A link or what to search for would be also great.
        tinus_hn 7y ago
        The directive is 2008/63/EG. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32008L0063 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32...
        mavhc 7y ago
        Can only see one example of someone asking about that on google.
- edoceo 7y ago
  Comcast in Washington is $10/mo
- enobrev 7y ago
  Here's a fun trick Comcast is now playing with in Chicago. For unlimited data, it costs $50 a month if you're using your own modem, but using Comcast's modem, I get a "discounted" rate of $20 a month including the modem rental. It's their way of charging me to use my own modem (which I believe is illegal), hidden behind the ruse of it being a discount to rent theirs.
LeonM 7y ago
> You can simply consider an attack on your modem an attack on your ISP. Never thought about it that way. I agree. > All ISPs I've ever seen in the US allow you to use your own router. I'm not familiar with the US market, I was speaking from my personal experience with EU based ISPs. I should have made that clear.
- Vrondi 7y ago
  In the USA, you can use your own router and your own modem, if you are aware enough to do so. Most common people just use whatever the ISP hands them, and pay $5 per month or more for years on end for the privilege of using boxes that never get updated.
ken 7y ago
Likewise, you make it seem like ISPs are competent enough to recognize an attacked modem, and repair or replace it on demand, and promptly. My experience is that when your internet connection goes down or becomes unusable, and you call and complain, it can be literally several weeks before they even respond to you. They may technically own the modem but you’re in your own to keep it running.
- behringer 7y ago
  Not my experience. My parents are stuck with Comcast due to their monopoly and even they bend over backwards to fix my parents recent issues (hardware failure). Sure it took a couple weeks, but it a couple weeks of troubleshooting, testing, a couple visits, some hardware replacements. People expect these repair installers to be miracle workers, but sometimes an intermittent fault takes time.
- derefr 7y ago
  > competent enough to recognize an attacked modem, and repair or replace it on demand The cable modems I've interacted with all seem to be immutable infrastructure: their state consists of 1. a signed firmware image; 2. a DOCSIS initialization packet received upon network registration (essentially equivalent to a cellular "carrier profile"); 3. a set of saved preferences; and 4. some volatile working state, like ARP tables or WPA encryption-stream key state. #4 gets trashed on reboot; #3 shouldn't be large enough (or executable) in a way where programs can run from it; #2 gets overwritten every time the network reconnects; and so the only place to put a persistent malware vector should be #1. And #1 can only be written to using signed code (sort of like Intel CPU microcode.) So what's the problem that can't be solved by rebooting the modem?

Lyrebirds 7y ago

You are unfortunately right about the reputation of SOHO routers and modems. The programming required to correct this issue is rather trivial, so hopefully patches should be easy to roll out. The unfortunate thing, is how the code has propagated from Broadcom across many vendors to even more ISPs, and how getting in touch with every affected ISP is a bit of a mess. Hence our attempt at branding, as this has a better chance of getting non-technical focus, which seems to be the way to reach many ISPs these days.

lawnchair_larry 7y ago

Most countries allow you to own a modem, and that’s why all the major retailers sell them. They are not property of the ISP. Only the ISP can upgrade them however.

ad_hominem 7y ago

If you have fiber you're probably plugging your SFP into an ONT which is already acting like a modem anyway. > With cable this becomes a lot harder or even impossible due to all kinds of network specific systems such as DOCSIS. You're probably on a PON which doesn't use DOCSIS exactly but it's still doing TDM and/or WDM multiplexing because you're sharing a laser diode with a bunch of your neighbors - the ONT transceives the multiplexed laser signal. You're still dealing with DOCSIS-like functionality.

Hello71 7y ago
By my reckoning, as long as the modem has no public- or customer-facing IP address, it's probably not going to be a vector for easy attacks. It might be accessible from within the ISP network, but if someone has access there then they can probably just tap your line directly, no need for additional exploits.
- ad_hominem 7y ago
  ONTs typically terminate to Ethernet at the customer premises so it's effectively the exact same thing as a cable modem. So not any more secure than having cable and using the cable company's provided modem. If you tapped someone's fiber line, all the traffic between the ISP headend and customer premises (OLT and ONT if we're talking fiber) will be encrypted. In fact on a PON network using TDM it has to be, because if you stared down your own fiber you would be seeing all your neighbors' traffic as you're all time-sharing the same laser diode at the ISP headend (because it's a passive network, you will be seeing your neighbor's traffic when the diode is transmitting outside of your designated time cycle). Anyway my only point was to inform OP that contrary to their belief, they effectively are in the situation of having an ISP-owned modem.
  - solotronics 7y ago
    When I was setting this up for an ISP a few years ago the TDM was just a SFP that has its own MAC address inside. Its doing the TDM part inside the SPF itself. When we configured a new customer it was just adding the MAC to the config of an interface on an alcatel router at the hub side. You might not be able to transmit without interference but I bet you could spoof the MAC of a neighbor on the same fiber and listen in.

segfaultbuserr 7y ago

The problem gets worse when thing aren't just routers, but modems from your ISP. Unlike routers, which you are free to replace it (or install OpenWrt), using a modem is mandatory, and it's very likely that there is no alternative. Even if the modem uses a standard protocol like DOCSIS internally, it either has some vendor-lockins or proprietary/customized software by ISPs. A few years ago, I got my optical cable modem from my ISP, and I immediately found that the real admin account was locked from me, only accessible by the ISP. So I couldn't just PPPoE and gets my connection, but I had to use the NAT on the modem. After a quick websearch, I realized there are plenty of ISP/OEM management interfaces and backdoors in the modem. Although the documented backdoor has been disabled, I eventually found my way to a root shell, so I could change the mode to bridged w/ PPPoE. Meanwhile, I always use my own router behind the modem, with an additional firewall blocking all the incoming connections from the modem's IP address. I absolutely don't have the slightest trust on these modems. If I cannot change the modem, at least I can isolate the problem away from my routers (and use encrypted protocols as much as possible). Attackers are free to execute arbitrary code on my modem, I'll simply treat the modem as part of the untrusted Internet, which can be as dangerous as a hacked modem.

tobenortobe 7y ago
Letting the attackers be 'mittle in the man' is little bit too generous especially on dns side
- labawi 7y ago
  Your ISP is has a MITM position whether they own your cable box or not¹. What you usually don't want is them having access to your LAN. ¹ As far as is relevant in this context.