5 ms·

About a year ago I left a cable modem and internet service (Time Warner) at an apartment I was moving out of while my friend continued to stay there. I had con

by maxk42 13y ago

About a year ago I left a cable modem and internet service (Time Warner) at an apartment I was moving out of while my friend continued to stay there. I had configured the thing in a manner I thought to be fairly secure -- strong password, no broadcast, etc.. One day the internet goes down and my friend doesn't know what to do. She calls the ISP and asks them what's wrong. They say they can't release any information about the service to her without my permission, so I suddenly get a three-way call explaining that my friend and the ISP representative are on the line and I need to give my authorization to access the account information. Being the person I am, I attempt to troubleshoot things over the phone before giving out any sort of account credentials. Eventually, I ask her to log into the router configuration page. She doesn't know the password and the first one I gave her doesn't work. The representative chimes in "That's fine -- I can just change it from here." "...What?" I was furious. Time Warner had left a backdoor in all their modems that gives them administrative access to my private connection. And yes -- she did alter the password remotely. She didn't seem to think there was anything wrong with this. I tried googling for relevant information, but wasn't able to find anything more than speculation at the time.

wtallis 13y ago
This is one of many reasons why routers should be purchased separately from modems, and modems should be configured to be as dumb as possible.
mutantmonkey 13y ago
Of course they can. The way DOCSIS is designed, your cable company has full access to your modem; your modem receives configuration data via TFTP from them and in most cases the firmware can only be updated over the coax interface. In fact, it's very rare that there's any configuration you can change on the DOCSIS modem side of things at all, even on the most expensive modems. Lately cable companies have been pushing these hybrid modem/router combinations with things like wifi support built in. From a consumer standpoint, this seems very convenient, but the cable companies do this because it makes it easier for then. If you call up with an issue with "your Internet," they can remotely diagnose it and reset your modem/router. Make no mistake; they have more control over these than you do. If you want to stop your ISP from having administrative access to your "private connection" (I assume you mean your wifi), then don't put the modem and the router in the same box. There's no other way around this.
- ryanhuff 13y ago
  That wasn't my experience with Time Warner and my Motorola cable modem, at least as far as dealing with modem issues (firmware). They referred me to Motorola.
  - mutantmonkey 13y ago
    Were you able to get your firmware upgraded? My understanding is that firmware upgrades can only be done over coax (there's certainly nothing on the web interface), but Time Warner Cable will not upgrade your firmware; so if you need a firmware upgrade you're pretty much out of luck.
mukundmr 13y ago
I had a problem of DNS poisoning on my router + modem for a long time even though remote access was disabled and my computers were clean. The DNS entries kept changing to bad ones (even after a factory reset). I ended up switching the modem to bridge mode and using a router of my own to resolve the problem.
qthrul 13y ago
You and others that are curious about what end user equipment management controls are possible might enjoy reading about specs like TR-069, etc. http://www.lightreading.com/tr-069-still-sexy-after-all-these-years/a/d-id/706234 http://www.lightreading.com/tr-069-still-sexy-after-all-thes...
superuser2 13y ago
>Time Warner had left a backdoor in all their modems that gives them administrative access to my private connection Yes, their modems. On the connection that they provide for you. A cable modem is considered CPE (customer premise equipment), meaning it is part of the infrastructure a telco uses to provide you with connectivity. Usually they own it, but in any case they have full control over it, as they should - it's part of their network. They may choose to delegate some configuration via a web GUI, but that's at their discretion -it's theirs to administer. Business telecom has a formalized notion of a demarc (demarcation point), the place where the telco network ends and yours begins. AT&T owns and is responsible for the fiber/T1/POTS lines as they come through the wall, as well as the CPE (often a large rackmount Cisco router) to which it connects. Their contract is to provide connectivity on specific ethernet ports/fibre GBICs/whatever of that CPE. Whatever happens downstream of those ports is your problem, and whatever happens upstream is their problem. Both sides will treat this connection as hostile - you'll have your own NATing router up and the telco's router, if it even has a configuration interface listening on your NIC, won't let you in. It would be inappropriate for AT&T to have any sort of access to the router you own and inappropriate for you to attempt any sort of access to AT&T's CPE. Time Warner has been shifting recently towards placing WiFi on their side of the (logical) demarc. Which makes sense, since most people would rather not be responsible for administering any infrastructure - they just want Time Warner to deliver them WiFi. It sounds like you have this kind of setup, in which case Time Warner's access is not "backdoor" but "building owner" - you're renting a room. If you'd prefer, you can (have them) turn off their WiFi, go buy a nice wireless router, and connect it to the modem. In this case Time Warner is providing you with a connection on an ethernet port; the device you've plugged in is your own (your side of the demarc) and they have no right to touch its configuration, nor are they responsible for it working correctly. EDIT: The obvious analogy that would have simplified much of this is that a cable modem is like an electrical meter.
- keithnoizu 13y ago
  Yeah, this is why I just shell out for my own docsys 3 cable modem whenever possible.
  - 13y ago
dspillett 13y ago
That is very common with provider issued equipment. Anything you get from your ISP should be considered their equipment rather than yours and your's should assume therefore that they maintain some sort of control over it. For serving very non-technical home users this is actually an advantage. Over here when you are BT's FTTC setup through any ISP the vDSL modem that hangs off your master socket (which can do more but is used in this arrangement to simple pick up the connection from the phone line and provide PPPoE on the ethernet port) is very definitely BT/OR's: they tell you not to mess with it, people who want to mess with it have to use hacks to get access to the UI (which is otherwise locked off), and if you plug something else in at that point you are officially not supported. If the router that you plug in to that came from your ISP then that is their's (usually you have to return it when you leave). If you buy your own router (or "make" your own, people who have a small Linux machine on 24/7 for various things just set that up to talk PPPoE directly and skip the router altogether, neatly avoiding the limits of many "consumer grade" units (shoddy IPv6 support for instance) without shelling out for a much better device) only then do you truly have control of security at that point in the topology. But some ISPs won't support you if you don't use the provided router (though if you know enough to purchase your own router you might not find such an ISP's tech support much help anyway).
jauer 13y ago
Many (most?) large providers use TR-069 in the CPE that they provide. This is how they push out firmware & config updates and provide some managed services to SoHo customers. You might be surprised at how much a provider support rep can see with this. Here's two screenshots from Cisco's product to give you a idea: http://images.newsfactor.com/images/super/larger-12-ClearAccess-scrn1.jpg http://images.newsfactor.com/images/super/larger-12-ClearAcc... http://cdn-static.zdnet.com/i/story/60/01/072589/clearaccess.png http://cdn-static.zdnet.com/i/story/60/01/072589/clearaccess... Moral of the story: Use the most basic cable/dsl modem that they'll give you, make it as close to bridge mode as you can, and use your own router.
blueskin_ 13y ago
I've heard from others that the passwords are stored in plaintext and viewable by support too, at least at some ISPs. Now combine that with the typical user's tendency towards password reuse...
tylerkahn 13y ago
I had to call Comcast in order to disable the Wifi radio on my modem. Not really a backdoor, just remote administration.
muyuu 13y ago
Proprietary software, firmware and hardware ultimately means you don't own the stuff you use. Goes on at all levels and people interiorise it to the point that they will take it as a given and justify uses that are not truly justifiable. ISPs do not need this kind of policy to operate, regardless what you'll read in this thread.

by maxk42 13y ago

wtallis 13y ago

This is one of many reasons why routers should be purchased separately from modems, and modems should be configured to be as dumb as possible.

mutantmonkey 13y ago

Of course they can. The way DOCSIS is designed, your cable company has full access to your modem; your modem receives configuration data via TFTP from them and in most cases the firmware can only be updated over the coax interface. In fact, it's very rare that there's any configuration you can change on the DOCSIS modem side of things at all, even on the most expensive modems. Lately cable companies have been pushing these hybrid modem/router combinations with things like wifi support built in. From a consumer standpoint, this seems very convenient, but the cable companies do this because it makes it easier for then. If you call up with an issue with "your Internet," they can remotely diagnose it and reset your modem/router. Make no mistake; they have more control over these than you do. If you want to stop your ISP from having administrative access to your "private connection" (I assume you mean your wifi), then don't put the modem and the router in the same box. There's no other way around this.

ryanhuff 13y ago
That wasn't my experience with Time Warner and my Motorola cable modem, at least as far as dealing with modem issues (firmware). They referred me to Motorola.
- mutantmonkey 13y ago
  Were you able to get your firmware upgraded? My understanding is that firmware upgrades can only be done over coax (there's certainly nothing on the web interface), but Time Warner Cable will not upgrade your firmware; so if you need a firmware upgrade you're pretty much out of luck.

mukundmr 13y ago

I had a problem of DNS poisoning on my router + modem for a long time even though remote access was disabled and my computers were clean. The DNS entries kept changing to bad ones (even after a factory reset). I ended up switching the modem to bridge mode and using a router of my own to resolve the problem.

qthrul 13y ago

You and others that are curious about what end user equipment management controls are possible might enjoy reading about specs like TR-069, etc. http://www.lightreading.com/tr-069-still-sexy-after-all-these-years/a/d-id/706234 http://www.lightreading.com/tr-069-still-sexy-after-all-thes...

superuser2 13y ago

>Time Warner had left a backdoor in all their modems that gives them administrative access to my private connection Yes, their modems. On the connection that they provide for you. A cable modem is considered CPE (customer premise equipment), meaning it is part of the infrastructure a telco uses to provide you with connectivity. Usually they own it, but in any case they have full control over it, as they should - it's part of their network. They may choose to delegate some configuration via a web GUI, but that's at their discretion -it's theirs to administer. Business telecom has a formalized notion of a demarc (demarcation point), the place where the telco network ends and yours begins. AT&T owns and is responsible for the fiber/T1/POTS lines as they come through the wall, as well as the CPE (often a large rackmount Cisco router) to which it connects. Their contract is to provide connectivity on specific ethernet ports/fibre GBICs/whatever of that CPE. Whatever happens downstream of those ports is your problem, and whatever happens upstream is their problem. Both sides will treat this connection as hostile - you'll have your own NATing router up and the telco's router, if it even has a configuration interface listening on your NIC, won't let you in. It would be inappropriate for AT&T to have any sort of access to the router you own and inappropriate for you to attempt any sort of access to AT&T's CPE. Time Warner has been shifting recently towards placing WiFi on their side of the (logical) demarc. Which makes sense, since most people would rather not be responsible for administering any infrastructure - they just want Time Warner to deliver them WiFi. It sounds like you have this kind of setup, in which case Time Warner's access is not "backdoor" but "building owner" - you're renting a room. If you'd prefer, you can (have them) turn off their WiFi, go buy a nice wireless router, and connect it to the modem. In this case Time Warner is providing you with a connection on an ethernet port; the device you've plugged in is your own (your side of the demarc) and they have no right to touch its configuration, nor are they responsible for it working correctly. EDIT: The obvious analogy that would have simplified much of this is that a cable modem is like an electrical meter.

keithnoizu 13y ago
Yeah, this is why I just shell out for my own docsys 3 cable modem whenever possible.
- 13y ago

dspillett 13y ago

That is very common with provider issued equipment. Anything you get from your ISP should be considered their equipment rather than yours and your's should assume therefore that they maintain some sort of control over it. For serving very non-technical home users this is actually an advantage. Over here when you are BT's FTTC setup through any ISP the vDSL modem that hangs off your master socket (which can do more but is used in this arrangement to simple pick up the connection from the phone line and provide PPPoE on the ethernet port) is very definitely BT/OR's: they tell you not to mess with it, people who want to mess with it have to use hacks to get access to the UI (which is otherwise locked off), and if you plug something else in at that point you are officially not supported. If the router that you plug in to that came from your ISP then that is their's (usually you have to return it when you leave). If you buy your own router (or "make" your own, people who have a small Linux machine on 24/7 for various things just set that up to talk PPPoE directly and skip the router altogether, neatly avoiding the limits of many "consumer grade" units (shoddy IPv6 support for instance) without shelling out for a much better device) only then do you truly have control of security at that point in the topology. But some ISPs won't support you if you don't use the provided router (though if you know enough to purchase your own router you might not find such an ISP's tech support much help anyway).

jauer 13y ago

Many (most?) large providers use TR-069 in the CPE that they provide. This is how they push out firmware & config updates and provide some managed services to SoHo customers. You might be surprised at how much a provider support rep can see with this. Here's two screenshots from Cisco's product to give you a idea: http://images.newsfactor.com/images/super/larger-12-ClearAccess-scrn1.jpg http://images.newsfactor.com/images/super/larger-12-ClearAcc... http://cdn-static.zdnet.com/i/story/60/01/072589/clearaccess.png http://cdn-static.zdnet.com/i/story/60/01/072589/clearaccess... Moral of the story: Use the most basic cable/dsl modem that they'll give you, make it as close to bridge mode as you can, and use your own router.

blueskin_ 13y ago

I've heard from others that the passwords are stored in plaintext and viewable by support too, at least at some ISPs. Now combine that with the typical user's tendency towards password reuse...

tylerkahn 13y ago

I had to call Comcast in order to disable the Wifi radio on my modem. Not really a backdoor, just remote administration.

muyuu 13y ago

Proprietary software, firmware and hardware ultimately means you don't own the stuff you use. Goes on at all levels and people interiorise it to the point that they will take it as a given and justify uses that are not truly justifiable. ISPs do not need this kind of policy to operate, regardless what you'll read in this thread.