Security Focus on Cable Modem Uncapping

Anonymous Coward writes "Cable modem uncapping allows broadband customers to boost their bandwidth to 6 or 7 times what they're paying for, by spoofing their modem's TFTP client into downloading a hacked DOCSIS configuration file. Kevin Poulsen at SecurityFocus reports that a new underground program called OneStep makes the process easy and fun for the whole family. Broadband companies are cutting off the uncappers that they catch, but things could get out of control soon."

Comments

Easy to catch

[CmdrTaco (editor)]

I've been reading the forums at DSLReports for a while now, and even found the software to do the uncapping myself. But, the stories about people who successfully uncapped their modems are always the same; the speeds were great for a couple days, and then BAM! No more internet connection.

It is awfully tempting to look at the benefits, but with cable being the only high speed connection in my area, I'm not willing to risk losing the service. Going back to 56k would just be torture. It doesn't matter how many people do this uncapping thing, as long as people realize that it could result in their broadband connection being terminated, their will never be enough to convince ISP's that maybe it shouldn't be a terminable offense.

I know ATTBI is planning on releasing a tiered pricing system for different speeds, so what I find more likely is that they will start charging you the rate for which you have uncapped yourself to. Could end up being pretty pricey if you've placed yourself in a business class service.

Re:Don't bother trying this...

[Rogerborg]

• motorola cable-modems are looking on both sides (cable and ethernet) for a TFTP server. Yes it's stupid... but they do

Yes, that's right, because they bring up the ethernet interface before they've brought up the cable side, negotiated the frequencies, been told where to get the docsis file, and received it on the cable interface.

No, wait... actually they don't, as can easily be veried by pinging one as it comes up and noting that it doesn't go live on the ethernet side until after negotiating on the cable side.

Also, providers don't "switch to DOCSIS". DOCSIS modems will do squat unless there's a DOCSIS compliant cable network for them to get their info from. That's another reason why this is just hackers mouthing off (or getting very, very confused): until a DOCSIS modem has been told what file to get and from where (from the cable side, after negotiating frequencies), it won't try and get it, nor will it forward packets.

Incidentally, it's true that Surfboards will bring up the ethernet interface eventually, but only for the limited purposes of acting as a DHCP server on a LAN, and only after cable side negotiation has failed.