8 ms·

About adding a static route to my DOCSIS modem

127 points by azalemeth 5y ago

tedunangst 5y ago
The technical aspects of getting this done are pretty interesting, but I don't know why you'd do it. I'm not even sure I know what it does. I do all my routing on my router. The cable modem is just the box that turns the square cable into the round cable.
- tyingq 5y ago
  The make/model appears to be a COMPAL CH7465LG, and it's got a 1.2GHz dual core CPU, a RealTek RTL8365MB switch chip, 4 GBE ports and WiFi, so it's arguably enough of a router in it's own right.
- zrail 5y ago
  OP has a combined router and modem, presumably without the ability to put it in bridge mode to run their own router.
  - bombcar 5y ago
    And the route itself has 192.168.88 in it which smells mighty like MikroTik to me.
  - pilif 5y ago
    I am familiar with the looks of this device as it’s in use at two locations I‘m providing in-family support for. At least in those two cases (different ISPs), it’s possible to turn the device into bridging mode
    - iforgotpassword 5y ago
      From the screenshot at the top it looks like they're using unitymedia. The funny thing is, at least in the past, that thing resets entirely if you disconnect it from power for some time, booting up with some old firmware revision afterwards. If you power it on then and quickly access the web interface, you'll see the option for bridge mode. Then it magically updates, and the option is gone. (this was a few years ago)
      - db_admin 5y ago
        As far as I know vodafone uses the same modem/router for all DOCSIS connections, but disables some funcionality (such as bridge mode) for 'ex-unitymedia' connections. It seems like the integration of both networks is quite a task and the bridge-mode feature is not a priority. How the bridge-mode is affected by the network backbone is unclear to me. IPv6 delegation also does not work for me.
- dec0dedab0de 5y ago
  I think it's more about getting root than adding a route. I assume the author is aware that he can purchase a separate router. DOCSIS hacking is highly frowned upon by cable companies, and the FBI. It's probably better to have a practical reason to do it, instead of "I wanted to see if I could."
  - el_benhameen 5y ago
    I’m really curious about the fbi bit. Do you have any further reading?
    - xyzzy_plugh 5y ago
      I don't know about the FBI specifically but telecom equipment is regulated and in most places it's not legal to roll your own interface to the infrastructure. Even if you bring your own modem these days, it becomes administered remotely by your ISP. Similar to phreaking being a crime. Even if you have an agreement with your ISP, I'd expect you'd be breaking it and crossing into fraud or toll fraud at the least.
      - netr0ute 5y ago
        > telecom equipment is regulated This is tricky, because "telecom" only has POTS and cable TV within its scope. "Internet" service that just uses ethernet technologies are their own separate thing, and why "Ma Bell" megacorps can get away with their junk Internet service because it's regulated differently than POTS.
      - mschuster91 5y ago
        > I don't know about the FBI specifically but telecom equipment is regulated and in most places it's not legal to roll your own interface to the infrastructure. In the EU, the Directive 2015/2120 [1] enforces the ability of customers to bring their own modems, no matter if you are running fiber, xDSL or DOCSIS. [1]: https://eur-lex.europa.eu/legal-content/DE/TXT/?uri=celex%3A32015R2120 https://eur-lex.europa.eu/legal-content/DE/TXT/?uri=celex%3A...
- dave9 5y ago
  To add a static route to the modem's routing table.
  - zachberger 5y ago
    But why do this on the modem, why not on the router?
    - deleted 5y ago
      [deleted]
    - detaro 5y ago
      It is the router.
    - stephen_g 5y ago
      Looking at the screenshots of the admin panel (and the fact that pictures further down seem to show switch ports) it seems that this is a modem/router/switch combo. Unlike many providers that just provide a modem with no router functionality and just an Ethernet port. It still would be easier to just put it into bridge mode if that's an option and use a better router, it is still an interesting hacking project!
deleted 5y ago
[deleted]
your_username 5y ago
Really interesting and I have no idea why it has to be this hard. Fun nonetheless, though cynically, I was holding out hope that hope that after all the work he'd find the feature in the web interface.
alufers 5y ago
Oh I remember this tutorial, because I followed it once to get telnet to this exact device. I even bought a special transcend sd card reader that was said to support 1-bit mode, but what worked for me in the end was the cheapest and crappiest looking adapter I had. The funny thing is that you can use this method to illegaly increase your internet speed, since it is limited by the modem, not by the ISP's equipment.
- tentacleuno 5y ago
  > The funny thing is that you can use this method to illegaly increase your internet speed, since it is limited by the modem, not by the ISP's equipment. No way. I wonder if this works with ADSL modems. That's absolutely insane.
  - toast0 5y ago
    ADSL modems are a totally different beast. With *DSL, you have a point to point connection with the telephone company equipment. It doesn't make sense to limit speed with the customer premises equipment, since the company equipment can easily do it (usually by limiting the negotiated sync speeds) With cable, it's a broadcast medium, so it's a lot simpler to let the network equipment be simple and have the CPE limit speeds. OTOH, network equipment capabilities have increased a lot since the early days.
  - Terry_Roll 5y ago
    Not in the UK, its set by the cabinet which in my case is a Broadcom running version 12.3.16. So one of the reasons why its set by the cabinet is they charge different fees for different connection speeds. So in the UK if you are limited to say a 40Mb or 80Mb download and whatever upload, when your adsl router/modem connects or negotiates a speed (max DSLAM throughput), even if you could negotiate a 100Mb speed, you would be throttled to whatever you package speed is and then with things like TR069 (https://en.wikipedia.org/wiki/TR-069 https://en.wikipedia.org/wiki/TR-069) they can remote control your router. So that will include disconnecting your ADSL connection, reconnecting and giving you a new IP address if you dont pay for a fixed ip address. One ISP I tested could reset the connection and give you new IP address every second, it was literally as quick as the device could handle getting the new ip address in bridge mode. Some firewall products also do throttling, its part of what is called traffic shaping as explained here (some reasonable docs) https://forum.netgate.com/topic/20089/how-to-using-squid-for-bandwidth-throttling https://forum.netgate.com/topic/20089/how-to-using-squid-for... Traffic Shaping in general https://docs.netgate.com/pfsense/en/latest/trafficshaper/limiters.html https://docs.netgate.com/pfsense/en/latest/trafficshaper/lim... AFAIK the adls cabinets also have a separate RF communication channel possibly as an independent backup if the mainlines go down but power still remains. I know if the engineers so much as opens the door to a cabinet, it phones home possibly over the RF or maybe using both network and RF, havent established that yet, but things are quite joined up here from what I've been able to tell. Other factors will which affect the DSL speed are the stability settings, so do you have little to no interference and error checking for max speed or do you go cautious and have lots of interference mitigation enabled on the adsl modem/router. Think of adsl as loads of radio stations all transmitting down a wire, to get more speed you tune into and listen to more radio stations all at the same time. For slower speeds you tune into just a couple radio stations. The frequency of the "radio" station also counts, like listening to poor radio quality on Long wave which can bounce around the planet, Medium Wave which can cover a sizable area or Frequency Modulation which you need to be close by to get. Same as mobile phone 2G, 3G, 4G & 5G. The bubble or area of 2G is massive, where as 5G is tiny, but that tiny bubble can transmit alot unlike 2G which is slower. Same sort of concept just transmitted & contained down a wire instead of over the air. One reason hard coding the route in the modem is it can prevent random accesses to the GUI from malware in the computer or in other network devices and then other network security can come into play. There's a lot of info in this post, and will be similar and thus relevant for hacking other devices.
marcan_42 5y ago
Just a terminology nit in the article: this isn't really exploiting anything. Exploitation means breaking intended security, but there is no security here; obviously this device was not designed to attempt to stop you from tinkering with eMMC directly. Hacking is the more general term for what this is :-) Cable modems in general don't seem to really make much of an attempt at physical-access security, even though they rely on being "secure from the owner" to enforce ISP bandwidth limits. Back when I was on cable, my cable router didn't have an official bridge mode, but there was a way to get telnet by uncommenting a hidden settings field in the HTML (lol) and then you could use an undocumented command to enable it. Later, the ISP broke this in an update, possibly inadvertently: bridge mode was still there, but enabling it caused some process to crashloop and destroyed performance. I got tired of that nonsense, found an old firmware image, and directly flashed it to the SPI flash chip on the board (except I left the version metadata as the higher one, so it wouldn't try to update itself again). Worked fine until I moved out of that place and stopped using cable. The DOCSIS cert and private key were right there in the flash too, I'm pretty sure I still have a backup somewhere.
fn1 5y ago
A tip, since i see a UPC modem: The puma6 chipset has a bug which causes various latency issues and connection drops on Wifi. Better use a different WifiRouter behind the modem.
- MonaroVXR 5y ago
  Do you have a source? I'm very curious.
Fnoord 5y ago
If its vulnerable (I'd first look at wireless comms and remote open ports) I'd just get a better/different router instead of this one. There's some quality ones out there. AVM sells a Fritz!box which has DOSCIS, and if you don't fancy Fritz!OS (fair enough) you can install something else like OpenWrt. If provider doesn't deliver these, QQ about it in public, or switch provider. I used to run my own PCI DSL modem (read: router) on a Soekris. Sanoma S518 was ADSL1 only and difficult to get working FOSS drivers for (IIRC didn't work on *BSD). Sanoma S519 worked for ADSL2, but used a RTL8139 externally while it ran proprietary firmware for the DSL part. I ditched it when I got VDSL(2). Later on, I found a Draytek Vigor (IIRC with the numbers 130 or 132 in it) which did work with VDSL but I already gave up and ran a Fritz!box instead. Which used to be hackable, in the sense that you could get root on it, and mod it ('Freetz').

127 points by azalemeth 5y ago

The technical aspects of getting this done are pretty interesting, but I don't know why you'd do it. I'm not even sure I know what it does. I do all my routing on my router. The cable modem is just the box that turns the square cable into the round cable.

tyingq 5y ago
The make/model appears to be a COMPAL CH7465LG, and it's got a 1.2GHz dual core CPU, a RealTek RTL8365MB switch chip, 4 GBE ports and WiFi, so it's arguably enough of a router in it's own right.
zrail 5y ago
OP has a combined router and modem, presumably without the ability to put it in bridge mode to run their own router.
- bombcar 5y ago
  And the route itself has 192.168.88 in it which smells mighty like MikroTik to me.
- pilif 5y ago
  I am familiar with the looks of this device as it’s in use at two locations I‘m providing in-family support for. At least in those two cases (different ISPs), it’s possible to turn the device into bridging mode
  - iforgotpassword 5y ago
    From the screenshot at the top it looks like they're using unitymedia. The funny thing is, at least in the past, that thing resets entirely if you disconnect it from power for some time, booting up with some old firmware revision afterwards. If you power it on then and quickly access the web interface, you'll see the option for bridge mode. Then it magically updates, and the option is gone. (this was a few years ago)
    - db_admin 5y ago
      As far as I know vodafone uses the same modem/router for all DOCSIS connections, but disables some funcionality (such as bridge mode) for 'ex-unitymedia' connections. It seems like the integration of both networks is quite a task and the bridge-mode feature is not a priority. How the bridge-mode is affected by the network backbone is unclear to me. IPv6 delegation also does not work for me.
dec0dedab0de 5y ago
I think it's more about getting root than adding a route. I assume the author is aware that he can purchase a separate router. DOCSIS hacking is highly frowned upon by cable companies, and the FBI. It's probably better to have a practical reason to do it, instead of "I wanted to see if I could."
- el_benhameen 5y ago
  I’m really curious about the fbi bit. Do you have any further reading?
  - xyzzy_plugh 5y ago
    I don't know about the FBI specifically but telecom equipment is regulated and in most places it's not legal to roll your own interface to the infrastructure. Even if you bring your own modem these days, it becomes administered remotely by your ISP. Similar to phreaking being a crime. Even if you have an agreement with your ISP, I'd expect you'd be breaking it and crossing into fraud or toll fraud at the least.
    - netr0ute 5y ago
      > telecom equipment is regulated This is tricky, because "telecom" only has POTS and cable TV within its scope. "Internet" service that just uses ethernet technologies are their own separate thing, and why "Ma Bell" megacorps can get away with their junk Internet service because it's regulated differently than POTS.
    - mschuster91 5y ago
      > I don't know about the FBI specifically but telecom equipment is regulated and in most places it's not legal to roll your own interface to the infrastructure. In the EU, the Directive 2015/2120 [1] enforces the ability of customers to bring their own modems, no matter if you are running fiber, xDSL or DOCSIS. [1]: https://eur-lex.europa.eu/legal-content/DE/TXT/?uri=celex%3A32015R2120 https://eur-lex.europa.eu/legal-content/DE/TXT/?uri=celex%3A...
dave9 5y ago
To add a static route to the modem's routing table.
- zachberger 5y ago
  But why do this on the modem, why not on the router?
  - deleted 5y ago
    [deleted]
  - detaro 5y ago
    It is the router.
  - stephen_g 5y ago
    Looking at the screenshots of the admin panel (and the fact that pictures further down seem to show switch ports) it seems that this is a modem/router/switch combo. Unlike many providers that just provide a modem with no router functionality and just an Ethernet port. It still would be easier to just put it into bridge mode if that's an option and use a better router, it is still an interesting hacking project!

deleted 5y ago

[deleted]

your_username 5y ago

Really interesting and I have no idea why it has to be this hard. Fun nonetheless, though cynically, I was holding out hope that hope that after all the work he'd find the feature in the web interface.

alufers 5y ago

Oh I remember this tutorial, because I followed it once to get telnet to this exact device. I even bought a special transcend sd card reader that was said to support 1-bit mode, but what worked for me in the end was the cheapest and crappiest looking adapter I had. The funny thing is that you can use this method to illegaly increase your internet speed, since it is limited by the modem, not by the ISP's equipment.

tentacleuno 5y ago
> The funny thing is that you can use this method to illegaly increase your internet speed, since it is limited by the modem, not by the ISP's equipment. No way. I wonder if this works with ADSL modems. That's absolutely insane.
- toast0 5y ago
  ADSL modems are a totally different beast. With *DSL, you have a point to point connection with the telephone company equipment. It doesn't make sense to limit speed with the customer premises equipment, since the company equipment can easily do it (usually by limiting the negotiated sync speeds) With cable, it's a broadcast medium, so it's a lot simpler to let the network equipment be simple and have the CPE limit speeds. OTOH, network equipment capabilities have increased a lot since the early days.
- Terry_Roll 5y ago
  Not in the UK, its set by the cabinet which in my case is a Broadcom running version 12.3.16. So one of the reasons why its set by the cabinet is they charge different fees for different connection speeds. So in the UK if you are limited to say a 40Mb or 80Mb download and whatever upload, when your adsl router/modem connects or negotiates a speed (max DSLAM throughput), even if you could negotiate a 100Mb speed, you would be throttled to whatever you package speed is and then with things like TR069 (https://en.wikipedia.org/wiki/TR-069 https://en.wikipedia.org/wiki/TR-069) they can remote control your router. So that will include disconnecting your ADSL connection, reconnecting and giving you a new IP address if you dont pay for a fixed ip address. One ISP I tested could reset the connection and give you new IP address every second, it was literally as quick as the device could handle getting the new ip address in bridge mode. Some firewall products also do throttling, its part of what is called traffic shaping as explained here (some reasonable docs) https://forum.netgate.com/topic/20089/how-to-using-squid-for-bandwidth-throttling https://forum.netgate.com/topic/20089/how-to-using-squid-for... Traffic Shaping in general https://docs.netgate.com/pfsense/en/latest/trafficshaper/limiters.html https://docs.netgate.com/pfsense/en/latest/trafficshaper/lim... AFAIK the adls cabinets also have a separate RF communication channel possibly as an independent backup if the mainlines go down but power still remains. I know if the engineers so much as opens the door to a cabinet, it phones home possibly over the RF or maybe using both network and RF, havent established that yet, but things are quite joined up here from what I've been able to tell. Other factors will which affect the DSL speed are the stability settings, so do you have little to no interference and error checking for max speed or do you go cautious and have lots of interference mitigation enabled on the adsl modem/router. Think of adsl as loads of radio stations all transmitting down a wire, to get more speed you tune into and listen to more radio stations all at the same time. For slower speeds you tune into just a couple radio stations. The frequency of the "radio" station also counts, like listening to poor radio quality on Long wave which can bounce around the planet, Medium Wave which can cover a sizable area or Frequency Modulation which you need to be close by to get. Same as mobile phone 2G, 3G, 4G & 5G. The bubble or area of 2G is massive, where as 5G is tiny, but that tiny bubble can transmit alot unlike 2G which is slower. Same sort of concept just transmitted & contained down a wire instead of over the air. One reason hard coding the route in the modem is it can prevent random accesses to the GUI from malware in the computer or in other network devices and then other network security can come into play. There's a lot of info in this post, and will be similar and thus relevant for hacking other devices.

marcan_42 5y ago

Just a terminology nit in the article: this isn't really exploiting anything. Exploitation means breaking intended security, but there is no security here; obviously this device was not designed to attempt to stop you from tinkering with eMMC directly. Hacking is the more general term for what this is :-) Cable modems in general don't seem to really make much of an attempt at physical-access security, even though they rely on being "secure from the owner" to enforce ISP bandwidth limits. Back when I was on cable, my cable router didn't have an official bridge mode, but there was a way to get telnet by uncommenting a hidden settings field in the HTML (lol) and then you could use an undocumented command to enable it. Later, the ISP broke this in an update, possibly inadvertently: bridge mode was still there, but enabling it caused some process to crashloop and destroyed performance. I got tired of that nonsense, found an old firmware image, and directly flashed it to the SPI flash chip on the board (except I left the version metadata as the higher one, so it wouldn't try to update itself again). Worked fine until I moved out of that place and stopped using cable. The DOCSIS cert and private key were right there in the flash too, I'm pretty sure I still have a backup somewhere.

fn1 5y ago

A tip, since i see a UPC modem: The puma6 chipset has a bug which causes various latency issues and connection drops on Wifi. Better use a different WifiRouter behind the modem.

MonaroVXR 5y ago
Do you have a source? I'm very curious.

Fnoord 5y ago

If its vulnerable (I'd first look at wireless comms and remote open ports) I'd just get a better/different router instead of this one. There's some quality ones out there. AVM sells a Fritz!box which has DOSCIS, and if you don't fancy Fritz!OS (fair enough) you can install something else like OpenWrt. If provider doesn't deliver these, QQ about it in public, or switch provider. I used to run my own PCI DSL modem (read: router) on a Soekris. Sanoma S518 was ADSL1 only and difficult to get working FOSS drivers for (IIRC didn't work on *BSD). Sanoma S519 worked for ADSL2, but used a RTL8139 externally while it ran proprietary firmware for the DSL part. I ditched it when I got VDSL(2). Later on, I found a Draytek Vigor (IIRC with the numbers 130 or 132 in it) which did work with VDSL but I already gave up and ran a Fritz!box instead. Which used to be hackable, in the sense that you could get root on it, and mod it ('Freetz').