Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacking millions of modems and investigating who hacked my modem

samcurry.net

Post reply on HN
Print view View original

201–210 of 282 posts

Re: Hacking millions of modems and investigating who hacked my modem

#201

Post by mrguyorama »

ryukoposting wrote: post #184
Bluecobra wrote: post #88

What sucks about this situation is when your ISP forces you to use their modem or router. For example, I have AT&T fiber and it does some kind of 802.1X authentication with certificates to connect to their network. If they didn't do this, I could just plug any arbitrary device into the ONT. There are/were workarounds to this but I don't want to go through all those hoops to get online. Instead, I ended up disabling e…

That's why I'm not an AT&T customer. Spectrum lets me bring my own hardware, and they're the only other option in my area, so Spectrum gets my business. Plain and simple. Unfortunately, not everyone has the palatable solution that I have.

Spectrum remote manages your hardware even if you bring your own modem. This nearly entirely consists of deploying firmware updates once a decade, but they can also command other things like modem reboots.

Re: Hacking millions of modems and investigating who hacked my modem

#202

Post by daghamm »

stonks wrote: post #140

Many routers require manual firmware updates. GL.iNet routers had several RCE (Remote Code Execution) vulnerabilities within the last 6 months. I advise you to have a quick look in your own router to ensure its not hacked, and possibly upgrade firmware. As a typical user the noticeable symptoms for me were: - internet speed noticeably slows down - WiFi signal drops and personal devices either don't see it, or struggl…

"As a typical user the noticeable symptoms for me were: - internet speed noticeably slows down - WiFi signal drops and..."

Could also be the neighbours and their big microwave oven :)

Re: Hacking millions of modems and investigating who hacked my modem

#203

Post by bongodongobob »

unclebucknasty wrote: post #189
bongodongobob wrote: post #131

Earlier quoted context omitted.

It's not the definition of extortion. If I walk past a business and notice the locks on their windows are rusted and I happen to be a lock guy and say hey, I noticed your locks are fucked, I'd be happy to consult for you and show you how and why they are broken, that's just doing business. Extortion is telling them, hey, your locks are fucked and I'm telling everyone unless you pay me. It requires a threat.

You just manufactured a completely different scenario. The comment I responded to was this: > it's only fair for them to financially award people that responsibly inform them of vulnerabilities instead of easily and anonymously selling those. That comment includes the threat ("instead of easily and anonymously selling those"). So, yes. That is the definition of extortion.

I think preventing people from having that incentive vs an actual threat are not the same, which is how I read the hypothetical.

Re: Hacking millions of modems and investigating who hacked my modem

#204

Post by sammy2255 »

mannyv wrote: post #122

An open question is still: how were the attackers able to grab his HTTP traffic? Some CPEs have a cloud Wireshark-like capability for debugging. I'm not sure if those are even on the Cox production firmware images. Usually there's a set of firmware for production and a set for test (which obviously makes it hard to test for problems in production). I suppose Cox could do a check to see what firmware versions are out…

Its HTTP not HTTPS, anyone or anything on the wire could see the request

Re: Hacking millions of modems and investigating who hacked my modem

#205

Post by mrguyorama »

bootsmann wrote: post #16
megous wrote: post #6

One of the reasons to not be excited about ISP provided cable modems with WiFi functionality and to have good endpoint/service security on your LAN. (TLS, DNS over TLS at least accross the modem/ISP) I just put it in bridge mode, disable wifi, and all network functionality is served by my own devices. The last modem I rented from ISP, the ISP didn't bother with any firmware updates for ~10 years. It was rock stable b…

Routers are the most exploited IoT devices on the planet, often vulnerabilities in the router firmware persist for years without getting patched because most endusers don't patch their routers. The ISP having a way to play patches onto router and recall unpatchable ones (because they own them) is a net gain for cyber security.

But ISPs DON'T patch routers. Plenty of spectrum modems still run a decade old firmware

Re: Hacking millions of modems and investigating who hacked my modem

#206

Post by unclebucknasty »

bongodongobob wrote: post #203
unclebucknasty wrote: post #189

Earlier quoted context omitted.

You just manufactured a completely different scenario. The comment I responded to was this: > it's only fair for them to financially award people that responsibly inform them of vulnerabilities instead of easily and anonymously selling those. That comment includes the threat ("instead of easily and anonymously selling those"). So, yes. That is the definition of extortion.

I think preventing people from having that incentive vs an actual threat are not the same, which is how I read the hypothetical.

>I think preventing people from having that incentive vs an actual threat are not the same, which is how I read the hypothetical.

The following two sentences read the same to me:

"To remove my incentive to harm you, you should pay me".

"To remove my incentive to share information with others who may harm you, you should pay me".

And, the threat is pretty clear IMO.

Re: Hacking millions of modems and investigating who hacked my modem

#207

Post by underlogic »

downrightmike wrote: post #196
underlogic wrote: post #194

Did they * pay* him? He kind of saved them, tipped them off to a complete compromise of their security infrastructure which was not trivial to discover. Looks like he got nothing in return for "doing the right thing". How insulting is that? What is their perception of someone walking in to their offices with this essential information? I guarantee his self image and their perception are very different. They see an ov…

Its Cox, probably lucky if they don't sue him for fixing their mistake

It happens. This is the type of revelation where heads roll and a scapegoat is very useful for the CSO, general liability of the company and PR.

Re: Hacking millions of modems and investigating who hacked my modem

#208

Post by bongodongobob »

unclebucknasty wrote: post #206
bongodongobob wrote: post #203

Earlier quoted context omitted.

I think preventing people from having that incentive vs an actual threat are not the same, which is how I read the hypothetical.

> I think preventing people from having that incentive vs an actual threat are not the same, which is how I read the hypothetical. The following two sentences read the same to me: "To remove my incentive to harm you, you should pay me". "To remove my incentive to share information with others who may harm you, you should pay me". And, the threat is pretty clear IMO.

Do you not lock your doors because you feel you shouldn't have to worry about people stealing your stuff because it's morally wrong to steal or do you do it to mitigate risk? Suggesting someone should mitigate potential risk is all we are talking about.

Re: Hacking millions of modems and investigating who hacked my modem

#209

Post by leptons »

indymike wrote: post #185
thrwaway1985882 wrote: post #166

Earlier quoted context omitted.

Have you ever worked as a front-line support agent? I'm guessing not. I have many years ago, and for an ISP too. If I bought an Amazon share back then for every time a customer called support because they were "hacked", I'd not be posting here during a boring meeting because I'd own my own private island. The two best conversations I can recall were when we changed a customer's email address about a half dozen times…

> The author's mistake was not posting somewhere like NANOG or Full-Disclosure with a detailed write-up. This is an organizational equivalent of a code smell. Something is off when support people aren't writing up the anomalies and escalating them. Some of the most serious security issues I've ever had to deal with started with either a sales rep getting a call or a very humble ticket with a level one escalating it u…

"Code smell" as a programming term is often a red herring that causes conflicts within development teams (I've seen this happen too many times), because anyone can call anything they don't like about a coworkers code as a "code smell". Your comment is a "code smell". See how easy that was?

And "code smell" doesn't apply in a similar or metaphorical way towards cable modem support personnel. Those people aren't supposed to know how to escalate a case of a customer bringing in suspected hacked modem. If they did that for every idiot customer that brought in a "suspicious" modem, the company's tech support staff wouldn't be able to get anything done. 99.999999999999% of the cases would not in fact be a hacked modem, so there really shouldn't be any pathway to escalate this as a serious issue.

Re: Hacking millions of modems and investigating who hacked my modem

#210

Post by outworlder »

Bluecobra wrote: post #88

What sucks about this situation is when your ISP forces you to use their modem or router. For example, I have AT&T fiber and it does some kind of 802.1X authentication with certificates to connect to their network. If they didn't do this, I could just plug any arbitrary device into the ONT. There are/were workarounds to this but I don't want to go through all those hoops to get online. Instead, I ended up disabling e…

Like someone else mentioned, at some level you need to rely on your ISP and it is also a good idea to have a router in between anyway.

I would like to bypass the BGW320 because not only it is a large, power hungry box, but it also requires me to jump through hoops to get IPV6 working with VLANs. I need to either use multiple physical links (simulating multiple devices) or simulate that using a VRRP hack, otherwise AT&T will not give out multiple ranges at all (and will not care about what I request). Under Comcast I didn't have to do any of that, I'd just carve out smaller IPV6 ranges, as many as needed.

Post reply on HN