Certain DOCSIS cable modems … had a similar flaw “With many users now using modified config files to uncap their modems, most cable modem service providers act

Certain DOCSIS cable modems … had a similar flaw “With many users now using modified config files to uncap their modems, most cable modem service providers acted to defeat this exploit by turning on the DOCSIS security feature that requires the CMTS to check the authenticity of the modem's config file during the registration process (this is explained in more detail in Chapter 9). As previously mentioned, this checksum is a HMAC-MD5 digest of the entire config file that uniquely iden- tifies its original contents, and it is constructed from the config file using a password chosen by the ISP. This defeats config file exploits because a user 8 Chapter 1| cannot create a checksum that would validate a modified config file without knowing the password that was used by the service provider when the original config file was created. Defeating the Message Integrity Check The fact that the systems of most ISPs had now been patched to prevent this type of uncapping was a challenge to be overcome. I began by attempting to hack the patch that the ISPs had implemented. My starting point was a phrase that was displayed in the modem's HTTP log page when the method described in the uncapping tutorial failed. The logs would read TFTP file complete-but failed Message Integrity check MIC. I wondered how I could bypass this message integrity check or MIC. One morning I awoke to frantic beeps coming from my computer; a member of my group was messaging me. He had the answer. The way to bypass the MIC was not to include the MIC! As simple as that might sound, I had no idea what he was talking about. He then sent me a copy of his config file and had me open it up in a basic hex editor (a program used to examine and modify binary files). The config file normally contained two different checksums at the end of the con- fig file: a standard MD5 checksum of the config, followed by another check- sum, the dreaded HMAC-MD5 (also known as the CmMic). He had simply trun- cated the config file, removing the HMAC-MD5 checksum and the two bytes before it (its header). Remarkably, this allowed any config to be used on any ISP. Once again, every ISP around the world was vulnerable to OneStep. NOTE This hack worked because the developers of the firmware used in the ISPs' routers, which process the config files and CMTS checksums sent from the modems, had not thoroughly tested the finished code. The basic config file processing function in the firmware would process operation codes (opcodes) that were present in the config file, including the CmMic opcode, and carry out the associated actions. But it would not check to confirm that the CmMic opcode had actually been sent (or even that the config file had success- fully authenticated). This flaw was severe because the ISP operators could not directly fix it in their routers; the only ones who could do so were the third-party vendors who supplied the firmware for the CMTSs. It would be a long time before the individual systems could be patched.”