Slashdot Mirror
Security Focus on Cable Modem Uncapping
Anonymous Coward writes "Cable modem uncapping allows broadband customers to boost their bandwidth to 6 or 7 times what they're paying for, by spoofing their modem's TFTP client into downloading a hacked DOCSIS configuration file. Kevin Poulsen at SecurityFocus reports that a new underground program called OneStep makes the process easy and fun for the whole family. Broadband companies are cutting off the uncappers that they catch, but things could get out of control soon."
Just because technology allows you to do something, does not mean that it is also legal.
I have been pwned because my
and they will be totally suprised when their cable company cuts them off at their knees:
r oo t=attbi~mode=flat
http://www.dslreports.com/forum/remark,3155491~
-zAmboni
Team Ars Technica Lamb Chop
Get your Unix fortune now!
The way the bandwidth limiting has been done in these modems, is completely similar to telling 5 year old kids to take only one candy, and then go yourself watch football to another room (or as a fin, Icehockey) - when you return after the match you can be sure that there is no candies - or bandwidth - left.
IMHO, the operators were just asking for this. NEVER trust the client.
it's capped at 15k or something, while I'm paying for 128 uploads
15k is exactly what you are paying for. The speeds that describe your line are in kbit/s, and 128kbit/s turns out to be 16kByte/s.
m
This is just great. And I thought our cable service was overloaded as it was. Never to worry, thought, they do send cease&desist nastygrams to everyone who exceeds an arbitary download quota as it is. In any case, you'd think it'd not be that difficult to monitor the bandwith usage per node and ..
Actually this reminds me of the a**wipes who used to download pr0n with threaded ftp clients from within the student network. We had a shared 512kbit line and you can see where this is leading to. Ditto for download managers with "segment" support. I fully realize I'm using making the download even slower for everyone else by using Getright to have 4 independent connections.. Some people are just more equal than others, dammit!
It just goes to show what's possible when a generation of clever minds is continually frustrated by their inability to develop a digital descrambler for the Playboy channel.
Give me something that I can actually use like...
A program that will cap my CS ping at 10ms.
A program that gets rid of my horrible packet loss.
A program that gives me reliable service without downtime every other day.
A program that will uncap my 1GB/mo limit on usenet download
A program that gives me customer service who knows what they are talking about.
A program that gets rid of my horrible Comcast service and gets my old (more reliable, lower priced, higher bandwidth, more featured) Mediaone service.
-zAmboni
Team Ars Technica Lamb Chop
A friend of mine, who also uncapped his modem but for a longer period received a letter from the cable company saying "Someone in your household has illegally attempt to modify one of the devices supplied by Telewest. Please desist or your service will be permanently withdrawn" or something like that.
My cable connection ocassionally gets uncapped for random periods, and I don't notice until I start downloading something (e.g. larger driver file) and get 300kbyte/sec.
If more information was available for customers to see how much bandwidth cost the ISP, then perhaps our expectations could be realistically scaled. Is having an uncapped 3 hour period between 2am and 5am feasible? I could simply schedule large downloads for that period. At present, I may as well just download at peak times, which probably is more irritating to the ISP receiving calls about slow web pages, or somesuch.
As far as I'm informed, Cable is a shared medium as for xDSL isn't. This means that with your cable modem you get the full bandwith unless you "restrict yourself".
DSL (Digital Subscriber Line) is not a shared medium: you are the only one that uses it up to the switch. So the switch is responsible for cutting you down. Client side security (okay, capping in this case) has never been a good security.
Anyway, even if I am wrong (which I doubt), I wouldn't uncap my DSL modem. Okay, I have the lowest possible rate where I live, but it's enough for all our family member to surf simultaneously at acceptable speeds.
Ahhh...the great dumpster continuum. Many a free computer will be found there. -- sowth (748135)
Here's another example: you may own your telephone handset, AND it may even be legal to modify it for the purpose of phone phreaking (maybe...DMCA?), but once you plug it into a live phone jack, you've surely committed a crime.
Summary: It's not about how you handle your equipment, it's where you have permission to stick it.
Slashdot: rejecting tech news in favor of rubber band guns since 1997.
Download speeds aren't the problem.
I think we all assume that the download is maxed or we don't care.
It's the limited upload speeds that people want to get around. Now I know that the uploads are sometimes limited to reduce 'network collisions'... but low upload speeds are screwing real users.
You don't need to be hosting pr0n or warez. What if you want to put up a password protected mp3 server so you can listen at work, etc.
Remote desktops in XP - X11/VNC for linux users... there are real reasons.
Browse over to freshmeat and check out all the cool ass servers.
Get your Unix fortune now!
The Motorola scheme is based on a bad implementation that should never have passed certification in the first place. Read Cable-Modems.Org for some slightly more in-depth/serious information.
People have done much more amazing hacks than that on DVD players, such as the Apex AD600A, despite the use of a non-standard microprocessor. Hacking the firmware of a cable modem should be quite simple by comparison.
That's the sort of reverse-engineering I used to do quite often, but now I get little opportunity due to the DMCA. It doesn't seem like service provider or cable modem vendor can use the DMCA to ban reverse-engineering of the cable modem, since the features in question aren't involved in copy protection. But the trend seems to be to sue first and try to justify it later.
Eric
[*] Better in the sense of being less detectable. I'm not suggesting that doing this is legal or ethical.
You are correct.
To be more specific, each cable modem in your neighborhood receives and sends all data that goes through your neighborhood.
Each cable modem has a timeslice to pay attention to data being sent to it. When receiving, there are multiple way of multiplexing, be it giving each modem on the network a timeslice to send a burst, or frequency division multiplexing
And just because something is illegal, doesn't mean it's wrong...
Americans, in particular, seem to have trouble with that one. Brainwashed, the lot of 'em...
You can't successfully legislate morality!
Don't forget video conferencing. Being capped at 15KB/s limits you to some pretty ugly video quality. I want to use my cable modem to do video conferencing with family and friends around the country. Right now it is one step away from intolerable and usually not worth the effort.
When information is power, privacy is freedom.
Unless you want to see how easy it is to produce convicing and very elaborate documentation of a fundamentally flawed exploit.
For those who won't bother reading the link (most of you), the exploit is this:
It looks really pretty until this last point, where it enters the realms of fantasy. The people who wrote the docsis spec aren't idiots. Cable modems will not look on the ethernet side for a TFTP server. TFTP'ing is done just after the cable side network discovery (so you have to have the cable side plugged in when you reset) and the modem knows which side is cable and which is ethernet. No, pinging the modem's ethernet IP from the PC doesn't help. It's just not that stupid; it knows that it has two interfaces, and it knows which one is which.
So go ahead and try this. You won't damage your modem, because it will simply ignore your TFTP server. What will happen is that you'll spend a couple of hours following the steps, getting all excited, then getting increasingly frustrated as you just can't get that last step to work. Rest assured, you're not doing anything wrong, other than following the instructions of a delusional wannabe hacker with a tiny amount of network knowledge and a real problem dealing with reality.
If you were blocking sigs, you wouldn't have to read this.
This would also encourage off peak usage. It'd be far better to squeeze out that 2 gig download quickly when it has no real impact on others versus taking hours due to a cap during peak.
I'm guessing you just can't reprovision the cable boxes that quickly and dynamically everywhere, but damn, it makes sense and I still don't understand why caps aren't implemented using some QOS type service at the head-end anyway...
First: No. Same goes for the Euromodem Cable standard which is also ATM based.
Second: It should not work on properly designed DOCSIS Cable Modems either. A cable modem should not accept tftp uploads and config from anywhere but its cable interface which is not available to the casual hacker.
Third: It will not work on properly configured newer DOCSIS 1.1 and later networks either.
Here is why:
First: In DSL the speed is largely controlled by the DSLAM. Some modems do some minimal QoS and capping but it is hardly ever used. No need to.
Second: design fault. Typical of telco manufacturing. No comment needed. Can be fixed by a single software upload which the provider can trigger on any software upgradeable modem. As a result it will no longer be possible to uncap it.
Third: You can hog bandwidth in an unlimited fashion only on a DOCSIS 1.0 and incorrectly configured newer networks. DOCSIS 1.1 introduced the concept of a transmit map. The cable modem termination system tells you when you can transmit and when you cannot (it can also slice bandwidth exactly on per consumer/application basis). As a result a properly configured 1.1 or newer network should have no need for CPE capping. Of course, US has a boatload of non-docsis proprietary networks so dunno about these.
Baker's Law: Misery no longer loves company. Nowadays it insists on it
http://www.sigsegv.cx/
Ok after sniffing around IRC (including the said hackers channel) and various boards this secret "underground" program the securityfocus guy quotes doesn't exist , its vapourware.
what does exist is a kludge of tftp servers,query utils and glorified DOCSIS editors that with 20minutes and a *lot* of messing about you can change your config settings and then only until the ISP check your modem (automated) via SNMP , deny this and your cut off, accept it and it will detect your hacked config and cut you off...permanently
so you are screwed either way.
not to mention that most of the cable modem companies are using MD5 hashes to validate the config files integrity (MIC (Message Integrity Check)), other than a severe hardware hack your not going to crack much with this verification.
i came accross tco-iso's website quite a while ago and after a few visits over the months it seemed to of ground to a halt when they realised that MD5 was involved, they even mentioned the possibility of brute forcing the hash which raised a smile from a few of us.
They point to their IRC channel for files but the *only* files that exist are just mirrors of the files their site links to, no "onestep" or 30mb files and certainly nothing special in the files (other than someone knows how to use a hexeditor on PD software)
some people dont understand how uncapping really works but i think speedguide's article seems to sum it up nicely.
Doesn't work that way. Consider this: The government provide the roads. I pay the government to provide roads, and they keep up their end of the bargain by giving me nice, long, straight motorways to drive on. However, the conditions of use, as it were, state that there's a maximum speed limit of 70mph on the motorway.
Now, the government doesn't supply the car. I went out and bought the car. I have a Citroen, you may have a Ford, or a Vauxhall, or whatever you like. They're all *capable* of going faster than 70mph, but if I get caught doing that, I get a speeding fine, and points on my licence. I can't argue that "I bought the car, I paid for it, so I'll use it any way I want".
Broadband internet useage is turning out to be a real life demonstration of the tragedy of the commons for some.
For those who have not studied Sociology, I'll summarise.
In a village, there is a common patch of land. General consences decreed that the land was free for any to graze their animals on. After a while, many people decided to graze as many animals as they physicaly could on the patch of land. Eventualy the commons becomes a muddy barran field due to over grazing. (Note, actualy, in large scale, this can, and has, turned grassland in to wasteland and even desert.)
The point is, many people have been saying 'Its the Internet, you paid for a connection, you have the right to use it to the full!' for so long. (ref, countless slashdot articles) Now people belive that bandwidth restrictions are artificial, that the cable companies are just trying to get as much money as they can. (Actualy, the Cable companies rent bandwidth in turn from companies which did speculative investment in laying high bandwidth cables. So if they need to increase bandwidth, they have to pay more.) This results in people asuming they have a right, and even a moral obligation, to take as much bandwidth as they can and 'share stuff'.
As another example, it would be wrong to take up two seats on an airliner when you only bought one ticket.
This scam is the equivelent of forgeing an airline ticket. Crude, and likely to end you up in hot water.
OK, how's this for an idea?
The config file is uploadable through the ethernet port, and seems to be able to specify the upstream and downstream frequencies, along with the maximum bandwidth rates etc. What would happen if you joined two cable modems with an F-to-F connector cable, and send config files to them so that the receive frequency of one was set to the transmit frequency of the other? And, how far from each other could they be? I know that the sub-headend that supplies my cable modem is only about 1/4 of a mile away, but I'm sure they work over a greater distance.
Any thoughts?
See, they're going about this all wrong. What they really should do is develop a way to uncap your neighbors' cable modems. Then, they'll get tossed off the network and you can have it all to yourself.
Free Mac Mini
Just because they didn't realize I was going to steal from them shouldn't allow them to stop letting me steal from them.
When I signed up for service, I knew this hack was available. That means when I signed up for service, I had every reason to believe that I would get unlimited bandwidth forever.
When will these companies get it. They are going to piss so many thieves off that sooner or later they are only going to have paying customers that follow the rules, or aren't heavy enough users to worry about. And then what will they do, besides make money. I mean what good is a network that isn't crawling on its knees from all the MP3 and warez sites. Some people just don't get it.
Someone buy these guys a ticket, so they can hop on the clue train.
I've worked with both DOCSIS 1.0 and 1.1. The MAP MAC message is an integral part of both 1.0 and 1.1. It is not new in 1.1. The cable modem needs to specify a COS ( class of service ) during it's registration process to the CMTS ( cable modem termination system ) in both versions of the standard. The CMTS enforces the COS in both version of the standard. The only major changes I recall between 1.0 and 1.1 with regard to how COS was handled was the introduction of dynamic classes of service for cable modems to accomidate telephony services.
Someone violates his TOS by uncapping his modem for the purpose of abusing his connection, gets caught in short order, and is banned from every abusing that internet provider again. I fail to see the problem here. The REASON these modems are capped in the first place are because of these very abusers. Granted, AT&T as well as other cable providers probably don't want to lose a bunch of customers, but the heavy warez/movie trading crowd they would happily do without as they tend to overuse their bandwidth allocation regardless, as well as creating potential legal liabilities.
This gives them an easy out. If they're able to detect an uncapped cable modem in a matter of hours after its been uncapped, then this is a great way to relieve yourself of a bunch of unwanted customers. And they don't even have to monitor bandwidth content. Just have to check the speed going over the physical maximum.
This should also be a wakeup call for parents who "share" their internet connection with their kids. Better let your children be aware that if ever they do something this foolish there will be serious hell to pay. PAY ATTENTION to what your children are doing. You don't know?? Then don't let them have internet access. When they turn 18, let them get their own account, and they can use or abuse it as they see fit.
Or if you REALLY need that extra bandwidth, pay for an account that provides for it. MOST companies, even cable providers have accounts that provide greater upstream bandwidth, but they don't cost $49, and they're rarely parts of a promotional deal.
-Restil
Play with my webcams and lights here
Last weekend I tried this guy's surfboard hack and I ran into one big problem
... THATS A FUCKLOAD MORE THEN WHAT I HAVE. As for my download - well, 100x faster then 56k - well, we know its not REALLY 56 and I forget what it is but I never got better then 40kbit/s so lets go with that as the cealing - 100x faster is 4000 kbit/s. - I am CAPPED @ 3000/256 but yet if I were to hit their MAX of 100x faster I would have to be capped @ 4000/3360. I know 100x means if all the planets are alligned but its absolutely 100% impossible to get 100x more then a 56k. That is false advertising. I see no reason why I can not take my modem to what they advertise.
The Docsis files are md5 signed and if I dont sign them, then I am SOL. I followed the steps, spoofed the tftp, wathced the modem grab the config - but yet my upload was still no better then 256kbits/second
As for the whole legality - All I am going to do is make my cable modem "up to 100x faster then 56k modem" because right now I am @ 3mbit/s and 256k/s. A 56k modem has a limit of 33.6 kbit/s for upload SO 100x faster is 3360 kbit/s second
Discuss.
The ultimate network admin tool needs HELP!