Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacking millions of modems and investigating who hacked my modem

samcurry.net

Post reply on HN
Print view View original

231–240 of 282 posts

Re: Hacking millions of modems and investigating who hacked my modem

#231

Post by utensil4778 »

Biganon wrote: post #222
mrguyorama wrote: post #201

Earlier quoted context omitted.

Spectrum remote manages your hardware even if you bring your own modem. This nearly entirely consists of deploying firmware updates once a decade, but they can also command other things like modem reboots.

If it's your own hardware, what's stopping you from closing the port they connect to?

How do you propose blocking a port between the cable network and your modem? You'd have to build your own custom firmware that doesn't acknowledge upstream firmware update requests.

AFAIK, they can/will kick you off the network if your modem is running unverified firmware. I think this is a regulatory requirement, but don't take my word for it. They don't want anyone to have free access to the network, you could do things like spoof your MAC address to get free service. I'm sure you could also do something much more malicious like crash parts of the network.

Re: Hacking millions of modems and investigating who hacked my modem

#232

Post by MyFedora »

biosboiii wrote: post #32

Holy hell, but how are your laws in the US aligned so doing something like this is okay? In Germany you would get minimum 3 years in jail for this, people got in front of court for way way way way less.

You should advocate for laws that enable security research.

Re: Hacking millions of modems and investigating who hacked my modem

#233

Post by thrwaway1985882 »

indymike wrote: post #185
thrwaway1985882 wrote: post #166

Earlier quoted context omitted.

Have you ever worked as a front-line support agent? I'm guessing not. I have many years ago, and for an ISP too. If I bought an Amazon share back then for every time a customer called support because they were "hacked", I'd not be posting here during a boring meeting because I'd own my own private island. The two best conversations I can recall were when we changed a customer's email address about a half dozen times…

> The author's mistake was not posting somewhere like NANOG or Full-Disclosure with a detailed write-up. This is an organizational equivalent of a code smell. Something is off when support people aren't writing up the anomalies and escalating them. Some of the most serious security issues I've ever had to deal with started with either a sales rep getting a call or a very humble ticket with a level one escalating it u…

> Something is off when support people aren't writing up the anomalies and escalating them.

What is described in the article is a fantastic hack. Given my organization's structure and skills, you'd need to send it straight past three layers of support and several layers of engineering before you find someone who'd be able to assemble a team to analyze the claims. We'd spend four figures an hour just to confirm the problem actually exists - then we'd all go "oh shit, how do we get in touch with the FBI, because this is miles above our paygrade."

An average cable internet user walks into a retail ISP location, sets a cable modem on the counter, and says "this is hacked". What is the probability you'd assign to them being correct? How much of your budget are you willing to spend to prove/disprove their theory? How often are you willing to spend that - remembering Cox has 3.5 million subscribers.

Friction is good. Hell, it's underrated! Introduce it to filter out fantastic claims: the stupid and paranoid are ignored quickly, leaving the ones that make it through as more likely to be real.

Re: Hacking millions of modems and investigating who hacked my modem

#234

Post by rtev »

underlogic wrote: post #194

Did they * pay* him? He kind of saved them, tipped them off to a complete compromise of their security infrastructure which was not trivial to discover. Looks like he got nothing in return for "doing the right thing". How insulting is that? What is their perception of someone walking in to their offices with this essential information? I guarantee his self image and their perception are very different. They see an ov…

Sam is a very famous security researcher, so I would be shocked if he wasn’t making upwards of $350,000 a year. These articles he writes make him a significant amount of money via reputation boost.

Re: Hacking millions of modems and investigating who hacked my modem

#235

Post by unclebucknasty »

depressedpanda wrote: post #127
unclebucknasty wrote: post #109

Earlier quoted context omitted.

No, they aren't obligated. So, if there's no bug bounty program in place, then they should either go to the beach or be willing to find bugs for the public good. The idea that the company owes them anything for their unsolicited work is misguided. And, if they present the bugs for money under the implicit threat of selling the information to people who would harm the company, then it's extortion.

1. Companies are amoral entities, and given the opportunity have few qualms about screwing people over if they can profit from it. Why do you expect people to behave ethically towards entities that most likely won't treat them ethically? 2. If said person doesn't present the bug to the company, but just goes straight to selling it to the highest bidder it's not extortion. If the company does not provide the right inc…

You seem to be saying it's essentially "justified extortion" and not immoral because you've adjudicated them guilty. We disagree.

Not to mention them getting "pwnd" creates a lot of collateral damage in the form of innocent customers.

Re: Hacking millions of modems and investigating who hacked my modem

#236

Post by ImPostingOnHN »

phs318u wrote: post #2

What a great article. Very easy to follow. The best part was that instead of attacking the messenger and denying any problem, Cox seem to have acted like the very model of responsible security response in this kind of situation. I'd love to read a follow up on what the bug was that intermittently permitted unauthorised access to the APIs. It's the kind of error that could easily be missed by superficial testing or de…

> I'd love to read a follow up on what the bug was that intermittently permitted unauthorised access to the APIs

I would, too. Not sure we will ever learn. Maybe a load balancer config that inadvertently included "test" backends which didn't check authorization?

Re: Hacking millions of modems and investigating who hacked my modem

#237

Post by whatwhaaaaat »

akskakskaksk wrote: post #155
whatwhaaaaat wrote: post #132

Earlier quoted context omitted.

Even if you buy your own modem they can push firmware to it (and do). The config file your modem downloads includes a cert that allows the isp to do this. You can flash special firmware (used to be called force ware) to prohibit this.

Is it safe enough to buy a separate router and put the ISP modem on the "internet" side of it?

It depends. The tr069 managed devices are typically router wifi combo type devices. If you can get a dumb modem that would would likely remove any tr069 vulnerabilities.

The firmware on whatever is doing docsis is going to be updatable by the ISP generally.

Two different mechanisms. The tr069 management and snmp triggered firmware upgrade

Re: Hacking millions of modems and investigating who hacked my modem

#238

Post by hsbauauvhabzb »

toast0 wrote: post #138
Bluecobra wrote: post #88

What sucks about this situation is when your ISP forces you to use their modem or router. For example, I have AT&T fiber and it does some kind of 802.1X authentication with certificates to connect to their network. If they didn't do this, I could just plug any arbitrary device into the ONT. There are/were workarounds to this but I don't want to go through all those hoops to get online. Instead, I ended up disabling e…

If you have the att fiber with the ONT separate from the modem, it's really easy to bypass 802.1X. Plug an unmanaged switch in between the modem and the ONT; let the modem auth; disconnect the modem. You'll likely need to do that again if the ONT reboots, but at least for me, ATT a UPS for the ONT, so reboot frequency should be low. Personally, I built up a rube goldberg of software and hardware with bypass nics so i…

How does that bypass 802.1x? Are the 802.1x packets are responded to by the official modem still? I was under the impression all packets were encrypted or signed with 802.1x, but Ive never had to implement or test it so I could be wrong.

Re: Hacking millions of modems and investigating who hacked my modem

#240

Post by Lammy »

thrwaway1985882 wrote: post #166
oasisbob wrote: post #150

Earlier quoted context omitted.

I would expect a front-desk worker to be trained to escalate issues within the org, and supported in doing so.

Have you ever worked as a front-line support agent? I'm guessing not. I have many years ago, and for an ISP too. If I bought an Amazon share back then for every time a customer called support because they were "hacked", I'd not be posting here during a boring meeting because I'd own my own private island. The two best conversations I can recall were when we changed a customer's email address about a half dozen times…

> they were "under surveillance by the NSA"

Where's the lie? We all are.

Post reply on HN