Slashdot Mirror
RCA / Thomson Modem Hack Discovered
An anonymous reader writes "Those un-employed modem
hackers are at it again. The group known as TCNiSO has released a very
interesting hardware
modification for RCA / Thomson cable modems. The modification is done by
grounding the bus clock on the serial EEPROM which throws the device into a
diagnostic panic mode. Then by using the debug tools from the embedded console
to reprogram the EEPROM, a user can permanently enable a developers menu which gives
complete control of the modem, such as modifying the hardware addresses or
flashing new firmware. Now if only these guys can figure out
how to enable the Bluetooth
features on
my v710 phone..."
Just remember that some cable ISPs use modem MAC authentication and changing your MAC address could possibly disable your access to the Internet. Some cable ISPs use "bottom-up" provisioning which allows you to re-register your modem's MAC address and tie it to your account (useful if you buy your own modem) but others could still be using manual provisioning which could cause delays in regaining block-sync.
Personally, don't fuck around w/your cable modem. It works just fine the way it is. Hacks are a wonderful educational/mental exercise but I wouldn't exactly be trying this if you don't want to lose connectivity to your ISP.
Until they are discovered and those modified cable modems are de-serviced?
Kenny P.
Visualize Whirled P.'s
..of the securityfocus story. It says "Feb 5 2004". It's nearly a year old!
Remember these cable modem tweakers that were raided by the FBI?
Please note cable modems do not connect to the telephone network. They connect to the cable company's private wires.
Could these guys get arrested or sued under the DMCA?
impossible for so many reasons, read up on the phone network, but it is impossible to send any large ammount of electricity down it.
also you can connect up homebrew devices, the only thing you wil degrade is your own private phone network, no one elses.
why would it be a DMCA violation in the first place?
do you even know what it stands for
I was wondering about this. It seems, to me, that this hack will render your modem useless on the cable network. What's the advantage of that?
Changing tha MAC address will effectively cut off service to your modem. Being able to update the firmware sounds nifty but, do you have new firmware that you need to install? Is there some service that you need so badly, on a cable modem, that you would spend your time writing new firmware for it?
I just don't see the advantage to this hack. I can see the advantage of previous hacks to uncap a modem but, even those hacks put you at risk of having your service terminated or worse, criminal charges being brought against you.
why would it be a DMCA violation in the first place?
do you even know what it stands for
I believe it stands for "YHBT".
i cant wait for a few days until all the people that try this hack, are kicked off the network allowing my service to go faster.
yay for stupid people.
Now if only these guys can figure out how to enable the Bluetooth features on my v710 phone...
Try the discussion forums over at wirelessadvisor.com
I posted a teaser message there once regarding the Motorola T720. By using the USB modem cable and a COM port sniffer, I determined that extended AT modem commands were used to synchronize the phone with the desktop. By posting my findings, someone took the initiative and started a Yahoo! group for hacking the T720. Within a month, the group had 400 members and within five months the group had collectively hacked the T720.
MAC address/IP are often used in court. Things get interesting when people can change or spoof these things.
This violates most acceptable use policies, regardless if your own the cable modem or not changing your modems mac address would fall under hacking as your could cause service interruptions on your network segment for other people. Your paying for internet service not the right to fuck around with a companies million dollar network. We had a kid get arrested for this, changed his modems mac everyday but never changed his nic's. Pretty trivial to track him down.
It wouldn't be a DMCA issue; DMCA applies to copyright protection. Hacking your modem isn't going to let you bypass some obscure copy-protection scheme.
My sig can beat up your sig.
Warning: mysql_connect(): Can't connect to MySQL server on 'engdb.agava.com' (61) in /home/t/tcniso.hosting.agava.com/WWW/db_connect.ph p on line 10
Can't connect to MySQL server on 'engdb.agava.com' (61)
=)
The only way you can possibly benefit from this is to uncap the modem, which is about as kosher as petty shoplifting. And you wouldn't need to reflash the modem for it anyways.
So, if you are not uncapping it, then what's the point? It's not like you are going to add any badly missed features, or make a linux print server out of it. Maybe it's just my lack of imagination, but I just don't see any practical uses for a hacked cable modem. I mean, other than getting the inner satisfaction from proving that you are actually able to read and flash the EEPROM:-). But then, you could just use a screwdriver and an EEPROM programmer...
I've got a box-full of old 2400 bps modems and it would be great if these guys can find a way to tweak some speed out of them.
The group known as TCNiSO has released a very interesting hardware modification for RCA / Thomson cable modems. The modification is done by grounding the bus clock on the serial EEPROM which throws the device into a diagnostic panic mode. Then by using the debug tools from the embedded console to reprogram the EEPROM, a user can permanently enable a developers menu which gives complete control of the modem, such as modifying the hardware addresses or flashing new firmware. Now if only these guys can figure out how to enable the Bluetooth features on my v710 phone..."
Whoa, slow down.
Corky here can't handle frontpage paragraphs like that first thing in the morning.
There are instructions on this web site on how to modify your v710 phone to turn on all the bluetooth functionality. You need to register though. Don't know if they work, I haven't tried them so you are on your own.
If they work, let us know.
In a two way system yes both a forward and return path are provided completely through the cable provider. In a 1 way system the return path is provided through the phone, Motorola's Surfboard 2100D has a CAT3 connector on it for this purpose. I'll bet that there is still a few of these in the US.
It was also discovered that by permanantly grounding the clock, the RCA cable modem could be turned into a full fledged Radeon 9700 Pro...
Uncapping of the rate? No. Promiscuous mode is where the terror begins! Sniffing the traffic on the segment is where the real press will begin.
Southeastern Virginia REPRESENT!
Everyone is talking about how this is a bad thing to do on someone else's network, but what about on your own network? Is it possible to get two cable modems to talk to each other over a coax cable? Can you hack the things to run distributed.net software? There are an awful lot of people out there with cable modems but no cable modem service.
We discovered and hounded the vendor relentlessly about the fact that the modems had a serial port for dial-upstream service. If you jumped a couple pins on the serial port, reset the modem, and plugged in a serial line 9600/8/n/1 you'd get the modem's diagnostics (password protected, albeit with a very weak password).
The things you could do from the diag screen were downright scary. All this and more. You could determine the downstream and upstream freqs; you could also set the modem to transmit on any upstream frequecncy at any level up to 60dB. We played around with it for a bit. We set up a test modem and had it transmit for a second at 60dB on one of our upstream freqs; it took out ~400 users' service for about a half hour. Had we done it on the PPV freqs, it would have taken out PPV for a few thousand people. Fun stuff.
And to my knowlege, they never fixed it.