Uncap Your Modem, Get Visit From the FBI
FlightSimGuy writes "The Blade wrote this article about how seven men were arrested by FBI agents with guns drawn and indicted by a local grand jury for allegedly "reconfiguring computer systems to access excessive amounts of bandwidth". Apparently the provider, Buckeye Cable Systems, wanted to make an example out of the men. According to the company's attourney, "Cyber crime is potentially very damaging to society. We are taking a firm position on that type of criminal activity. We hope these cases will have a deterrent value...""
first post!
and yeah, if you were steal something from a store you deal with police, not fbi agents.
stealing bandwidth is much less than stealing from a store, so what's the big deal?
Sounds to me like the FBI should go after the cable company for using up valuable resources for this kind of crap.
A cable company making an example out of customers, or fighting terrorism and REAL crime... Wonder which the FBI's resources would be better spent at...
"Nothing strengthens authority so much as silence." - Charles de Gaulle
*note to self : Do not switch to Buckeyes*
Did they send them some kind of e-mail, letter of something? I know that uncapping is done by software in some case. Did they really do with unauthorized use of computer, cable, or telecommunications property or they only installed some sort of software on THEIR machine.
I hope that case get trown out, cause otherwise a LOT of peoples are in trouble. I mean we see those uncap software ad banner everywhere on the net.
This is not the first time one of the defendants has flaunted the law:
"after a covert police surveillance operation videotaped him stealing coffee, creamer, and paper from village supplies."
Whew. I sure am glad people like Mr. Muhammed and Mr. Malvo can kill people all across this country while our law enforcement people are doing stakeouts on the guy taking some French Roast.
I tend to question this attorneys sanity and/or technical knowledge. Uncapping is not just a "additional software". It is additional software, probably hex-editing the original CM config file (which it downloads from a fixed IP during bootup, usually hosted by the provider), reonfiguring your machine to look like the ISPs download server, rebooting and tricking the modem into thinking your reconfigured box is the config file location and doing lots of unusual shit along the way.
This is certainly not in the definition of just "additional software". If that was the case he might be right, and get them out with some phony storys about "accidentally" installing this or something... But a real uncap is not a trivial task and it won't happen accidentally.
+++ath0
HAH! everybody equal.
first they should sort out stuff like the death penalty for things the FBI should actually be used to catch people for,
and make sentences appropriate to the crime. rapists and murderers get shorter sentences than some guy playing with computers and ALLEGEDLY stealing info.
Kevin mitnick comes to mind.
Explain to me how that is more serious than rape and murder?
That brings up an interesting parallel.
You see, "stealing cable," as the cable companies don't want you to know, means climbing their pole, entering their lock box, opening the neighborhood green base, and turning on your signal. Descramblers themselves are not illegal, as the 1934 Communications Act states that any citizen has the right to receive any broadcast signal. (The 1994 Communications Act modifies this to exclude the 800 MHz range to make analong cellular phone eavesdropping a punishable offense.) So long as you have not trespassed on the cable company's property, there is nothing illegal about "stealing cable."
So, if you own your modem and you modify its software to be uncapped, can they really go after you for "unauthorized access to a computer system" and that sort of crime? Obviously, they can ban you from their network, which is exactly what AT&T Broadband does (and makes me think twice about uncapping or modifying the cap limit), but can they seriously bring charges against you?
How might this be different than obtaining a signal via a decoder? After all, they're supplying the signal already.
Jory
How does this become a Federal crime?
Agreed!
I guess it just extends the old policy of allowing any cable TV issues to be held at the federal level. Maybe it's because CATV providers tend to be multi-state in nature, or maybe it's because the programming traverses state lines.
In my opinion, federal jurisdiction needs to be applied only when there is a need for it to be applied at the national level. Just because someone can find some aspect of a service that in some way makes use of resources in another state, that should not automatically mean it's in the federal jursidiction. In theory, you can claim just about anything as being within the federal jursidiction because there's always going to be something involved nowadays that involves another state.
I really don't understand why the feds are so eager to expand their jurisdiction so much. Why take on additional work when the states can handle it on their own? And due to the vague commerce clause in the constitution, the courts have no choice but to uphold the constitutionality of it all.
Sorry for the rant, but this erosion of local and state governments really annoys me sometimes. The federal government is getting much too big.
I'm glad that I live in a country were someone wouldn't be charged with a felony if he raped me, but that he will be shipped off to the Pen if he dares to steal bandwidth from the cable company.
I'd rather have a full bottle in front of me than a full frontal lobotomy.
From the terms of service:
The Subscriber must not attach any device that permits access to services in violation of the Subscription Agreement. In addition, federal and state laws prohibit the possession, use, or attempted use of any equipment to receive any Buckeye services except as expressly provided by the Subscription Agreement.
The subscription agreement
17. Buckeye has no responsibility for, and is not liable for, the speed, content, or accuracy of any transmissions on the system.
And neither this, nor the Acceptible Use Policy state anything about what download speeds you're allowed.
You quitting proves that the karma kap worked. The most annoying of the whores shut up. --CmdrTaco
"Why could they even get additional bandwidth by changing their modem? If the provider wants to impose a limit, that should be done in their own hardware in their own end of the connection. If the system had been designed with this in mind, there wouldn't have been a case."
A very interesting point!
How about this: A customer who uses their own modem, ie, there is no cable company equipment inside the home at all. Most, if not all cable and DSL providers allow you to use/buy your own modem.
How could altering that be "unauthorized use of a computer device" or whatever, since the provider AUTHORIZED it to be connected to the network?
I think this is very, VERY thin as a criminal case. It'd be far stronger as a CIVIL case, ie: breech of contract.
But they don't send in the Federal jackboots to storm people's houses when you file a civil suit.
It's risky for even a monopoly like a cable company to do this, particularly in a larger area like Toledo. This could bite them in the ass, as people there can switch to satellite and get their local channels (as you can in most larger areas), and DSL is probably available (as well as other wireless broadband options).
I don't condone what they did, but neither do I condone what is definately a clear cut case of MISUSE of government power. This is a CONTRACT matter, not a criminal one!
Corporatism != Free Market
by Kris Olsen
Bored during my summer, I thought I would take this project on. I began my research on June 26, before 2600 published the article on uncapping. Through various methods (mainly IRC), I talked to several people and finally figured out how to uncap my modem. Well, it wasn't as easy as it seems.
I went to a lot of trouble that in the end left me without cable and nearly in jail.
My ISP, like many, uses a system called QoS, or Quality of Service. This means a few things.
1) You can't connect without a config that the ISP doesn't already have (i.e., you can't create a config file with a 10mbit/10mbit line if the cable company only offers 400/200 800/400 and 1.5/512). This means in order to uncap, you can only uncap to a better service plan (i.e., going from 400/200 to 1.5/512).
2) In order to uncap to a better service plan you must get the config for that service plan, as making one with those caps often will not work. Take note, this config file has a different name than the one sent to your modem, and since the TFTP protocol doesn't allow directory listing, you must either have once used the faster service and seen the config file, or you have to know someone who has it who can help you out. Should you manage to get this config file, your problems are still not over.
3) The QoS checks your modem's MAC address every 10-15 minutes (depending on the size of your node) to make sure that the parameters set in your modem are the ones that you pay for. Note: the MAC cannot be changed because you have to register your MAC with the ISP, s they inevitably know who you are. To get around the QoS resetting your modem, one may think "Well hay, let's just change the SNMP ports so they can't send the reboot command to me!" Hah! That pisses them off like nothing else, and yes, they can track that. All it takes is about a day to find your port. The default SNMP ports are 161 and 162. I changed minme to 9999999941 and 9999999942. In two days they were once again resetting via SNMP.
4) So you figure, "Well, that means I have one or two days of uncapped modem, right?" Wrong. There is another way they can reset you that you can do nothing about. In order for your modem to stay connected to the server it must "ping" the server and get responses back. I say "ping" in quotations since it is not your normal 52 byte packet ping. It is a special CMTS type ping. What the ISP can do, should they notice that you are indeed using a faster config, is "suspend" the "pings," meaning that they are lost, and none come back to the modem. This will force an "HFC: Async Error Range Failed" error on your modem's long, which will be followed by "HFC: Shutting Upstream Down," and then "BOOTING: (firmware version)."
So now, this doesn't seem that bad. You may be thinking, "Why is this guy even writing this stuff - if there is a will there is a way." That is true, but my purpose is to show you that if your ISP does use QoS (examples of some that do are: Blueyonder, ATTBI, Cableone, Charter, Comcast, and NTL) then if you ever attempt ot uncap, they will notice and they will call you.
I received my first call the morning after I requested tech support to come out and fix the signal strength of my line (it was way out of spec and kept resetting my modem). Well, as protocol they watch your line to see what they can diagnose before the tech arrived at your house. Well that morning (the 10th of July), I uncapped and within ten minutes I had a call from the headquarters of my ISP, some 600 miles away. This was a "tap on the wrist" type conversation. They said basically, we see that you are uncapping, and that violates our Terms of Service agreement. Don't do it again. So I didn't for a while.
A couple of weeks went by and I used Ethereal, I common network "sniffer", to determine whether or not my ISP was watching my MAC address. Later I learned they were on the entire time and when they saw me "Sniffing" for info, they simply hid themselves behind the IP address 255.255.255.254. Not knowing that information, I decided it was safe to uncap again. And so I did and continued to be reset with HFC errors. I tried various methods to get around it, installed hacked firmware, sent various SNMP commands, even attempted to fake a CMTP server so that the CM would send the "pings" to a computer on my LAN, all to no avail. So when my modem would go back to normal, I would send it a new config, and the process went on and on like that for two weeks or so.
I left early on a Friday morning for a little weekend getaway. While I was out of town, I didn't even think about the status of my cable. No, I did not leave it uncapped when I left the house, but the damage had already been done. My ISP had all the evidence they needed to shut my cable off, and press misdemeaner charges, mainly based on cyber theft.
I returned to find a message on my answering machine from an "Internet Engineer" at the ISP's headquarters. He was not very pleased. The message was over 15 minutes long and contained a great deal of threats and comments obviously designed to scare an uncapped. It worked. I was terrified. After hearing the message, I went out to check the mail. In there was an envelope from my ISP containing a "Declaration of Termination of Service." In this letter were several items, including possible criminal charges to be pressed, two pages dealing every time I uncapped from July 10 to the present, and a long, long list of how I violated the Terms of Service with my ISP. Sure enough, when I went to contact the Internet Engineer by email, (the only contact information that was listed), my Internet service did not work. As a routing check, I looked at my modem's long file only to find this disturbing messsage: 7-Information D509.0 Retreived TFTP Config TRMNT.cm SUCCESS.
I twas clear. My service had been terminated. But my problems were not over yet.
The following day (August 5) I received another call from him, telling me that the ISP wanted to press charges. As soon as I was off the phone I immediately called my lawyer and told him the entire situation. My lawyer spent the rest of the day on the phone with my ISP and came to an agreement that for the two months that I uncapped, I would have to pay for the better service.
In the end, uncapping got me these final results:
Pros:
Cons:
The choice is up to you. This was just my experience.
----
Reprinted from 2600: The Hacker Quarterly, Volume 19, Number 3, Fall 2002 without permission. Even though Olsen's account obviously has some glaring mistakes (52-byte ping? Since when is the payload fixed? He probably means an ICMP ping.), I believe it provides an interesting account into what can happen if you're uncapped. Maybe not as drastic as the visit from the FBI in this Slashdot article, but certainly uncapping is still not worth it. Especially when your cable provider is a monopoly!
"The lesson to be learned is not to take the comments on slashdot too literally." --Vinnie Falco, BearShare
OK, we can say that cable ISP's should have better security that stops uncapped modems working, and I agree that uncapping your modem is bad, worse then stealing cable TV. I pay my monthly fee, and make full use of my bandwidth.
I also understand that my cable ISP has xMBPS going into them, and if too many people use the system, I suffer.
If I wanted to double my bandwith, I'd pay the extra $15. The ISP can sue part of this to pay for more bandwidth to the cable network, and no-one loses. I'm happy to share my bandwidth to the rest of my house, and if a neighbour buys me an 802.11b access point, they can use it too.
I wouldnt dream of using bandwidth I didnt pay for. Excusing it as "modifying your own hardware" is the equivelent of "modifying your own jumper to steal goods from a store". This isnt copyright infringment. Thsi isnt stealing cable tv (with a decent box that doesnt effect anyone else) The extra bandwidth you use does have a marginal cost.
Having said that, I think that FBI agents is extreme. Sure arrest them, put them in the cells for a few days, then give them 100 hours community service, and stop them using cable modems for a year. That's an appropiate sentence for a first offence, even that's probably extreme.
I thought this type of fraud/theft of cable service fell under the jurisdiction of the Secret Service?
Since 1984, our investigative responsibilities have expanded to include crimes that involve financial institution fraud, computer and telecommunications fraud, false identification documents, access device fraud, advance fee fraud, electronic funds transfers, and money laundering
Emphasis is mine. Is this going to happen more in the future, I wonder, with agencies hopping jurisdiction lines whenever they want to? Perhaps this was routed to the FBI because attention was wanted drawn to this. I can't recall ever hearing about the Secret Service in the news except in regards to the President.
-- El Sacarino tiene gusto de la chocha
I completely agree.. The first rule of computer/application security: Never trust the user. Once a piece of hardware is installed on customer premesis (or in some cases, customer-installed hardware that they purchased on their own), the ISP should never trust that hardware. Any security mechanisms (authentication, authorization, bandwidth caps, IP address assignment, etc.) need to exist on the ISP side, not the customer side.
But on the flip side, the nature of some cable networks makes some of this fairly difficult. Satellite TV is in the same situation: they can't flip a switch on a satellite and keep that satellite signal from being received at your home. Instead, they have to resort to tricks with smart cards and encryption on the client end to keep their customers honest. There will always be the possibility of emulation and unauthorized modification of this equipment, though, and as a result, we have laws like these in place to protect them.
I do oppose companies (cable or otherwise) taking these laws for granted and refusing to do the obvious to secure things on their end instead of just relying on the FBI to prosecute customers that take advantage of what may be fairly trivial mechanisms to get around provider restrictions.
greeted at the door by armed FBI agents with guns drawn
There is no factual data supporting this that we've seen. The only thing that mentions the FBI having their guns drawn is the article submitter's sensationalistic summary of the story. You'll note that the article only indicates the FBI confiscated equipment. It does not mention how.
Is it just me, or are companies really trying to screw their customers over in any possible way? One would expect a bit of respect from corporations for their customers, be it quality of service and goods, or just ethical and friendly ('human') behavior...
It seems Internet, media, music and entertainment companies are working on a system of income without uhm... well, customers. Because that's where they're headed.
And if it's that easy to uncap their modem, well, doesn't that just as much point to a flaw in their own products and services, as in the moral of their customers... Ofcourse people want to get the maximum out of the money they spend. With all the problems my ISPs have had over the last years (network outage, (too) slow connectivity, system crashes, dns misconfiguration, sudden extra restrictions on bw/mailsize/mailboxsize, administrative fuck-ups,...), I'm not surprised some customers do these kind of things.
It's wrong, ofcourse. But is it more wrong than not getting what you paid for?
We need stronger protection of customer rights. Corporations become too big, ubiquitous and have too much influence by lobbying or the sheer power of their legal departements. In theory, everybody's equal in the eyes of the law; in reality, I'd like to see a small individual with a small-town lawyer fight off the legal team of a big corporation. That is, if that person can even afford a lawyer and the legal costs for a case that might last forever.
Just because your spending forty dollars a month on an internet connection doesn't entitle you to all the speed you wish. It's silly to say that just because tyou are paying twice what you did for dial up access you should be able to connect like the internet was a local network.
If we Slashdot their company webservers will they send FBI agents after us too? Damn it's evil of us using up bandwidth. We shouldn't take deep breaths either.. we might be depriving others in our neighborhood of oxygen. Or would the neighborhood committee have to force us to sign an EULA when we moved in to criminzlize that?
Monopoly companies think they can force anything from their customers but how long until their customers just cut the monopoly out of the loop. Electric companies screw over customers.. alternative power is gaining in popularity. Phone companies screw over customers.. VoIP is on the rise. Cable companies screw over their customers.. kids download movies off the Internet. Internet screw customers.. Mesh computing is on the rise. It takes time but these companies are choking themselves.
At what price learning? At what cost wisdom? The price is a man's peace of mind, and the cost is his life.
I can go to Circuit City or any of several other computer stores and buy a cable modem. If I don't happen to buy one that is as crippled as the one the local cable company provides, just what crime have I commited? These modems are apparently legal, as they are sold and advertised very openly (and in fact are much more available than DSL modems). It doesn't seem likely that Linksys, Actiontec and the rest will all strive to make the slowest cable modem. How do you keep gun ho yahoos who weren't unstable enough to get into the ATF from breaking down your door if you use a retail purchased cable modem?
I'm an American. I love this country and the freedoms that we used to have.
This isn't just funny, I think it's a legitamite question.
If attempting to go get bandwidth you didn't pay for is a violation of the TOS, shouldn't it also be considered a violation of contract if they systematicaly don't get the bandwidth they paid for?
I get the feeling that the Supreme Court is waiting for the right case to come along to put Congress in their place on that one.
First off, no one can get 2gbs d/l unless u got some fancy routers and yr network is running multiple gigabit adapters. And even then, someone has to push multiple signals up to you - very unlikely.
/. a little while back where the CTO of some crapbag cable company was boasting that they had unlimited bandwidth. If they got clogged or bogged down, they re-route and open up more somewhere else.
Second, there was an article somewhere on
You could argue that i was 'stealing' from you, but i could also argue that cable companies are stealing more than their share from us. how much do they really pay for the tax payers backbone (what's left of it and not owned by some slimy corp)?
Besides that, simple economics dictates that once the pipes are connected, it costs no more or very little to push a signal down it to multiple destinations. In other words, we're subsidizing their rape of us! Oooooh, we'll give you a 2meg d/l. Aren't you happy you have a T1 at a 10th of the cost? No. Because that transfer stuff is all bullshit and they're making money hand over fist. And they know it.
So do I care about 'stealing' from you. No, not at all because you're already being ripped off and I can't take something away from you when you don't already have it. Read up on stuff more and you'll see that we're all screwed. Period!
I have often wondered about this myself. The concept of paying only for what you get seems to be lost in today's (screw the customer) business world. I've got some ideas on how to turn the tables (and I'm talking about legal business methods here) on them, but I'm not ready to divulge them yet. Suffice to say that I want to see a more fair deal in both directions - I'm sick and tired of being scammed by today's ccepted marketing practices that involve a lot of smoke and mirrors.
That may work for television, where the communication is only one way, but for IP to work there must be a network wide unique IP at each customer location.
You are confusing the IP layer with the link layer.
Ethernet is the same way: all ethernet clients receive ethernet frames from everyone else on the same wire. This is why switches were invented: to isolate individual ethernet clients from one another, effectively putting them all on their own separate ethernet mini-segment.
If all of your accounting and authorization lives at the IP layer, what's to stop a user from claiming 10 different IP addresses and multiplexing traffic across all of them, pretending to be 10 different hosts?
I do agree, though, that implementing measures like IP traffic shaping should help curb the abuse, but it will not eliminate it unless other measures are taken along with it.
I wonder, though, if IP is the only protocol allowed over cable modems, though? Is it possible to use another protocol to share data with a neighbor?
And on top of that, the technology to provide bi-directional cable (for modems and even set-top boxes that don't need to dial in) does indeed require packet switching,
I did not claim that all cable networks were incapable of individually addressing a piece of hardware, I just said that many were one-to-many.
Keep in mind also that there is a difference between equipment that can be individually addressed and equipment that has its own dedicated, switched pipe to the cable company's hardware. Normally cable equipment shares one pipe, and only picks out frames that are addressed to it, ignoring the rest. This is not a dedicated, isolated connection, it's still shared, but filtered by client hardware so that it all seems point-to-point.
If bidirectional cable networks are capable of giving each customer his own dedicated data connection, why is it that cable companies have to go out to the pole to install RF filters to keep you from getting HBO or some other channel they don't want you to have? Couldn't they just flip a switch at a central office and omit that data stream? No, they have to either filter the data, or send a message to your addressable set-top-box and *ask* it to stop showing that channel.
there is nothing illegal about "stealing cable."
That is a potentially dangerous piece of misinformation. You may believe what you like about the Communications Act, but the courts do not agree with you.
"...always new atoms but always doing the same dance, remembering what the dance was yesterday." -Richard Feynman
It establishes his pattern of criminal activity, and I think the journalist was demonstrating through an ironic counterpoint that for the more serious crime, the defendant had merely been forced to resign from his job, whereas for the questionably illegal "theft" of bandwidth, the authorities were over-reacting. There is a subtle editorial slant against excessive government authority in the article, as can be evidenced also by the comments about the police chief improperly setting up the surveilance camera.
I object to you calling my candidate Bill McBride a clown. Personally, although he looks like a clown I don't think he is that funny.
I remember Time Warner pulling this crap on one of their customers, and they lost, guy even got to keep the modded modem.
Lawyer got him off, based on Time Warner's statements of up to 50x faster and some others like it in their contracts/advertisements. The stance was that he was only obtaining levels they had advertised.
I have zero sympathy for any ISP that sells accounts and fails to maintain its infrastructure to support them. Instead they just reduce the bandwidth to all customers. I find that significantly more harmful then a couple of people allegedly stealing (read: reclaiming orginally advertised) bandwidth.
And to add insult to injury the unnecessarily involved law enforcement to "make an example". No it's just another example how they dont' want to use their own resources to solve the problem. Like hiring some to monitor and suspend/ban accounts that are abusing TOS.
My ISP used to tell its customers that they had 10 MB/Sec download speeds. Indeed they did - on the DSL local loop. The problem is that upstream of the local loops they backhauled on T1 so the design of the system implied that 30-100 customers each thought they had 10MB/sec download speeds when the reality of the situation is that they all shared a 1.5 mb/sec T1 line. An even more important point is that with all the hops involved, nothing comes in anywhere near the speed advertised anyway.
All that a cap on a cable modem does is slow the load times of individual pages and it only slows it IF every hop to the server happens to be able to transmit at a speed in excess of the cap.
Admitedly if someone is using sustained transfers such as if one is running a game or video feed then they _may_ end up using extra bandwidth. But the vast majority of web surfing is to webpages and in this case if the "same number of pages" are downlaoded per day then even if the user does this in a shorter period of time - the user did not use extra bandwidth.
For instance, I read slashdot pretty much each day. If I read it via a modem it might take me an hour. I'm on a high speed link so perhaps I can read slashdot in 1/2 hour. This does not mean I read it twice. It also doesn't mean that I try to surf to more websites. The reason? Content is dropping folks and there are fewer websites worth visiting now than in the past.
Well, my line used to run at 768 MB/sec. Now it is 468 MB/sec. I do not notice the difference. My ISP's expect me to pay the same amount in fact. The difference in speed resulted because the telephone company (telus) decided to switch out paradyne MVS (ADSL) modems and replace them with D-Link. MVS has a 25,000+ foot reach whereas the D-Link system has a 15,000 foot reach. Hense D-Link runs slower. Even so, if I download a Debian install for instance, I do not necessarily get a lower level of service because it has not been established that the packets would have been made available to my new D-Link modem at a rate faster than it can accept them.
Does this mean that I can send the cops in to Telus claiming theft of service? IE. I paid Telus for the MVS solution and they switched it on me!!! So now I only get 1/2 the service?
In order to support a "theft of service" the cable company should be required to demonstrate that the end users actually consumed more content. I'll suggest they likely cannot do this. All that has happened is that the end users _may_ have viewed the content for a shorter elapsed time. But even this idea is really questionable because most people read at speeds under 1000 words per minuet and most computers send at speeds 1000's of times faster. Even in the case of video, a slow link is fast enough for MPEG video. Inceasing the link speed does not mean the end user is going to pull in more content.
Its like saying that if we double the speed limit between you and the grocery store so you can get there in 1/2 the time - then you will go shopping twice as often and spend twice as much money. The assumtions are clearly rong! Continuing on assumptions like this, if we reduce the speed limit or cut the number of fast food restaurants in half, then people should lose weight because there would be less opportunity to get food.
I don't think capping cable modems does much in the way of putting people on an internet content diet. About all this might accomplish is forcing them to waste their time waiting for slow loading pages.
Indeed, junk advertising wastes bandwidth because it is not wanted. Perhaps the FBI should be sent into doubleclick! Mind you - I just firewall the ad servers. Guess I should be able to claim a refund from my phone company huh? Because I didn't consume the content they tried to shove into my computer.
The police 'blotter', a record of arrests, is public information in the United States of America. Anyone, including you, can walk into a police station and ask to see the blotter. You might get a hassle because they are more used to reporters looking at it but they have to let you see it since it is a public record.
This would be highly illegal in most of the rest of the world (it for sure is here in .de)
I guess I don't need to go into the differences in Germany and the US.