Slashdot Mirror
RCA / Thomson Modem Hack Discovered
An anonymous reader writes "Those un-employed modem
hackers are at it again. The group known as TCNiSO has released a very
interesting hardware
modification for RCA / Thomson cable modems. The modification is done by
grounding the bus clock on the serial EEPROM which throws the device into a
diagnostic panic mode. Then by using the debug tools from the embedded console
to reprogram the EEPROM, a user can permanently enable a developers menu which gives
complete control of the modem, such as modifying the hardware addresses or
flashing new firmware. Now if only these guys can figure out
how to enable the Bluetooth
features on
my v710 phone..."
Just remember that some cable ISPs use modem MAC authentication and changing your MAC address could possibly disable your access to the Internet. Some cable ISPs use "bottom-up" provisioning which allows you to re-register your modem's MAC address and tie it to your account (useful if you buy your own modem) but others could still be using manual provisioning which could cause delays in regaining block-sync.
Personally, don't fuck around w/your cable modem. It works just fine the way it is. Hacks are a wonderful educational/mental exercise but I wouldn't exactly be trying this if you don't want to lose connectivity to your ISP.
Until they are discovered and those modified cable modems are de-serviced?
Kenny P.
Visualize Whirled P.'s
..of the securityfocus story. It says "Feb 5 2004". It's nearly a year old!
The group's website is being served through a hacked cable-modem connection.
Remember these cable modem tweakers that were raided by the FBI?
Please note cable modems do not connect to the telephone network. They connect to the cable company's private wires.
This article was written nearly a year ago, and probably doesn't apply now.
Could these guys get arrested or sued under the DMCA?
impossible for so many reasons, read up on the phone network, but it is impossible to send any large ammount of electricity down it.
also you can connect up homebrew devices, the only thing you wil degrade is your own private phone network, no one elses.
why would it be a DMCA violation in the first place?
do you even know what it stands for
I was wondering about this. It seems, to me, that this hack will render your modem useless on the cable network. What's the advantage of that?
Changing tha MAC address will effectively cut off service to your modem. Being able to update the firmware sounds nifty but, do you have new firmware that you need to install? Is there some service that you need so badly, on a cable modem, that you would spend your time writing new firmware for it?
I just don't see the advantage to this hack. I can see the advantage of previous hacks to uncap a modem but, even those hacks put you at risk of having your service terminated or worse, criminal charges being brought against you.
why would it be a DMCA violation in the first place?
do you even know what it stands for
I believe it stands for "YHBT".
I wonder how long it will be until people spoof other people's cable modem hardware addresses to 'steal' their access...
i cant wait for a few days until all the people that try this hack, are kicked off the network allowing my service to go faster.
yay for stupid people.
Now if only these guys can figure out how to enable the Bluetooth features on my v710 phone...
Try the discussion forums over at wirelessadvisor.com
I posted a teaser message there once regarding the Motorola T720. By using the USB modem cable and a COM port sniffer, I determined that extended AT modem commands were used to synchronize the phone with the desktop. By posting my findings, someone took the initiative and started a Yahoo! group for hacking the T720. Within a month, the group had 400 members and within five months the group had collectively hacked the T720.
only 14 comments, and site's down already.
Si la vida me da palo, yo la voy a soportar Si la vida me da palo, yo la voy a espabilar
MAC address/IP are often used in court. Things get interesting when people can change or spoof these things.
This violates most acceptable use policies, regardless if your own the cable modem or not changing your modems mac address would fall under hacking as your could cause service interruptions on your network segment for other people. Your paying for internet service not the right to fuck around with a companies million dollar network. We had a kid get arrested for this, changed his modems mac everyday but never changed his nic's. Pretty trivial to track him down.
It wouldn't be a DMCA issue; DMCA applies to copyright protection. Hacking your modem isn't going to let you bypass some obscure copy-protection scheme.
My sig can beat up your sig.
Once they tweak their cable modem, they'll be back up again.
Then again, maybe they DID tweak their cable modem, and screwed it up.
Please note that this was a sarcastic comment using Bell's excuse for not allowing non-Bell owned equipment to be connected to your phone jack.
Am I the only one here older than age 12?
Its cable modem systems, not DSL, just a few radio waves over a coax, and no, its not going to microwave them
Warning: mysql_connect(): Can't connect to MySQL server on 'engdb.agava.com' (61) in /home/t/tcniso.hosting.agava.com/WWW/db_connect.ph p on line 10
Can't connect to MySQL server on 'engdb.agava.com' (61)
=)
It's pretty obvious from a cable modem providers perspective when you start transmitting out of bounds or the crc on the firmware is not right. You might think you can get away with it, but at the same time they KNOW they can catch you, if they desire. And YES they do prosecute folks. Go back to p2p'ing its probably safer than hacking your cable modem. Or learn to bridge the neighbors worth of free 802.11 to aggregate more bwidth, lol.
The only way you can possibly benefit from this is to uncap the modem, which is about as kosher as petty shoplifting. And you wouldn't need to reflash the modem for it anyways.
So, if you are not uncapping it, then what's the point? It's not like you are going to add any badly missed features, or make a linux print server out of it. Maybe it's just my lack of imagination, but I just don't see any practical uses for a hacked cable modem. I mean, other than getting the inner satisfaction from proving that you are actually able to read and flash the EEPROM:-). But then, you could just use a screwdriver and an EEPROM programmer...
Who let 1960 AT&T on slashdot. Wasn't there a court case that decided that you can put 3rd party hardware on the public telephone network? Although, I imagine that you would have trouble connecting the cable "modem" to your phone jack.
13 and a half...
I've got a box-full of old 2400 bps modems and it would be great if these guys can find a way to tweak some speed out of them.
This article brings joy to me. It's great to see serious hardcore development like this, on a shoestring. 21st century Thomas Alva Edisons and Alexander Graham Bells.
But the thing that really comes to my attention is:Never leave debug code in production firmware. Proves I haven't been paranoid for no reason these years!
Nothing in the world is more dangerous than sincere ignorance and conscientious stupidity.
The group known as TCNiSO has released a very interesting hardware modification for RCA / Thomson cable modems. The modification is done by grounding the bus clock on the serial EEPROM which throws the device into a diagnostic panic mode. Then by using the debug tools from the embedded console to reprogram the EEPROM, a user can permanently enable a developers menu which gives complete control of the modem, such as modifying the hardware addresses or flashing new firmware. Now if only these guys can figure out how to enable the Bluetooth features on my v710 phone..."
Whoa, slow down.
Corky here can't handle frontpage paragraphs like that first thing in the morning.
There are instructions on this web site on how to modify your v710 phone to turn on all the bluetooth functionality. You need to register though. Don't know if they work, I haven't tried them so you are on your own.
If they work, let us know.
In a two way system yes both a forward and return path are provided completely through the cable provider. In a 1 way system the return path is provided through the phone, Motorola's Surfboard 2100D has a CAT3 connector on it for this purpose. I'll bet that there is still a few of these in the US.
I realize this is a minor detail, but with the I2C protocol SDA (the EEPROM line that is grounded) is actually the serial data/address line. SCL is the serial clock line.
It was also discovered that by permanantly grounding the clock, the RCA cable modem could be turned into a full fledged Radeon 9700 Pro...
You need the SuperDave 1.02 firmware over at HoFo. http://www.howardforums.com/showthread.php?s=&thre adid=513683
Enables xferring ringtones, pix via BT, better camera quality, I now have signal/battery strength on the HUB in my Acura TL, other fixes as well.
Uncapping of the rate? No. Promiscuous mode is where the terror begins! Sniffing the traffic on the segment is where the real press will begin.
Southeastern Virginia REPRESENT!
Everyone is talking about how this is a bad thing to do on someone else's network, but what about on your own network? Is it possible to get two cable modems to talk to each other over a coax cable? Can you hack the things to run distributed.net software? There are an awful lot of people out there with cable modems but no cable modem service.
It was a joke. Calm yourself, grasshopper.
My sig can beat up your sig.
We discovered and hounded the vendor relentlessly about the fact that the modems had a serial port for dial-upstream service. If you jumped a couple pins on the serial port, reset the modem, and plugged in a serial line 9600/8/n/1 you'd get the modem's diagnostics (password protected, albeit with a very weak password).
The things you could do from the diag screen were downright scary. All this and more. You could determine the downstream and upstream freqs; you could also set the modem to transmit on any upstream frequecncy at any level up to 60dB. We played around with it for a bit. We set up a test modem and had it transmit for a second at 60dB on one of our upstream freqs; it took out ~400 users' service for about a half hour. Had we done it on the PPV freqs, it would have taken out PPV for a few thousand people. Fun stuff.
And to my knowlege, they never fixed it.
However it was quite likely for the functions to be there , good move by the author to offer a "prize" because i am sure that if it was possible to write a hack for it it would have been written.
Lima India November Uniform X-ray
Unfortunately, only well-placed media tycoons have the ability to get their story out immediately. For the rest of us, it takes much longer to get the outlines of what the "truth" might actually look like.
Go on accepting what you hear on the "up-to-the minute" daily "news" AS GOSPEL and you are doomed to live from the crumbs that remain after corporate titans and their political minions and morally corrupt judges have swept the table of the crumbs they no longer feel worth consuming.
Not exactly a winning Darwinian strategy, but thats your choice in a "free" society.
It's not impossible. But, why would anyone spend hundreds (actually, more like thousands) of dollars on the custom CMTS hardware required? They would be spending *WAY* more than the business class internet access would for a number of years.
So is that sentence.
... that 3MB down ought to be enough for anybody?
A few years ago, similar arguments could have been made against ordinary broadband. What if I want to download full length movies?
Sean
So far we've had had many replies about how this will violate ToS and is Theft of Service. I would not presume to disagree... it's generally a stupid idea to do something illegal with any broadcast device.
But what about applications that don't involve the cable company what so ever? For example is it possible to set one modem in host and the other to client so one could use a pair to communicate? If so would there be an advantage in terms of range over let's say cat5 ethernet?
There is no sanctuary. There is no sanctuary. SHUT UP! There is no shut up. There is no shut up.
If I own it, I should be able to do whatever the f*ck I want with it, as long as it doesn't interfere with other people doing whatever the f*ck they want with the stuff they own.
...Had this been an actual emergency, we would have fled in terror, and you would not have been informed.
I noticed that in one of the menus on that page, there was a "Firewall/NAT" section...presumably if you had access to this you could set your modem up as a router/modem combo so you wouldn't need to buy a router, just a cheap switch/hub instead.
you got fucking owned! he ripped you a new asshole, and you're crying about it. lol!
This should be moderated insightful, not Flamebait. Mods.
"Champagne for my real friends - and real pain for my sham friends!" http://ericblade.postalboard.com/
Let me start by saying I have never cared enough to become more than slightly aware of how DOCSIS / US Cable modems work BUT... Some asshole has set up a rougue DHCP server and half the time my modem gets a 192.168.69.x address with 192.168.69.69 and 10.0.0.69 as its DNS servers and 192.168.69.10 as its gateway and all DNS queries return 192.168.69.69 and then my computer becomes very unusable until I do a hard reset (ie, with a hairpin)on the cable modem and leave the modem unplugged from the cable side for +-1 hour. ??!?!??!? WHY IS THE FIRMWARE NOT WRITTEN TO REJECT ILLOGICAL DHCP ASSIGNMENTS? Comcast does not seem to believe me or even understand what I'm saying, but it happens at 2 locations about once a week or so. I have not used these subnet numbers in my internal assignments. In the words of Green Day, "Am I just paranoid or am i just stoned?" --OR-- could this hardware bug exploit be salvation for me and the many others that are surely affected? A Motorola Surfboard at a third location is not ever affected by this. --Vic, spam@acinta.com