Slashdot Mirror
RCA / Thomson Modem Hack Discovered
An anonymous reader writes "Those un-employed modem
hackers are at it again. The group known as TCNiSO has released a very
interesting hardware
modification for RCA / Thomson cable modems. The modification is done by
grounding the bus clock on the serial EEPROM which throws the device into a
diagnostic panic mode. Then by using the debug tools from the embedded console
to reprogram the EEPROM, a user can permanently enable a developers menu which gives
complete control of the modem, such as modifying the hardware addresses or
flashing new firmware. Now if only these guys can figure out
how to enable the Bluetooth
features on
my v710 phone..."
Just remember that some cable ISPs use modem MAC authentication and changing your MAC address could possibly disable your access to the Internet. Some cable ISPs use "bottom-up" provisioning which allows you to re-register your modem's MAC address and tie it to your account (useful if you buy your own modem) but others could still be using manual provisioning which could cause delays in regaining block-sync.
Personally, don't fuck around w/your cable modem. It works just fine the way it is. Hacks are a wonderful educational/mental exercise but I wouldn't exactly be trying this if you don't want to lose connectivity to your ISP.
Until they are discovered and those modified cable modems are de-serviced?
I was wondering if people could use a modified firmware that would report a valid modem config file back to the ISP when the ISP scans for ones that were not sanctioned.
The ISP could powercycle the modems remotely and push new firmware to all the modems rather easily. I would assume that the pushed firmware would include a way to block unauthorized firmware from connecting to the network.
Who knows if they'd be that interested though?
..of the securityfocus story. It says "Feb 5 2004". It's nearly a year old!
Remember these cable modem tweakers that were raided by the FBI?
Please note cable modems do not connect to the telephone network. They connect to the cable company's private wires.
Could these guys get arrested or sued under the DMCA?
i cant wait for a few days until all the people that try this hack, are kicked off the network allowing my service to go faster.
yay for stupid people.
Now if only these guys can figure out how to enable the Bluetooth features on my v710 phone...
Try the discussion forums over at wirelessadvisor.com
I posted a teaser message there once regarding the Motorola T720. By using the USB modem cable and a COM port sniffer, I determined that extended AT modem commands were used to synchronize the phone with the desktop. By posting my findings, someone took the initiative and started a Yahoo! group for hacking the T720. Within a month, the group had 400 members and within five months the group had collectively hacked the T720.
MAC address/IP are often used in court. Things get interesting when people can change or spoof these things.
This violates most acceptable use policies, regardless if your own the cable modem or not changing your modems mac address would fall under hacking as your could cause service interruptions on your network segment for other people. Your paying for internet service not the right to fuck around with a companies million dollar network. We had a kid get arrested for this, changed his modems mac everyday but never changed his nic's. Pretty trivial to track him down.
I've got a box-full of old 2400 bps modems and it would be great if these guys can find a way to tweak some speed out of them.
The group known as TCNiSO has released a very interesting hardware modification for RCA / Thomson cable modems. The modification is done by grounding the bus clock on the serial EEPROM which throws the device into a diagnostic panic mode. Then by using the debug tools from the embedded console to reprogram the EEPROM, a user can permanently enable a developers menu which gives complete control of the modem, such as modifying the hardware addresses or flashing new firmware. Now if only these guys can figure out how to enable the Bluetooth features on my v710 phone..."
Whoa, slow down.
Corky here can't handle frontpage paragraphs like that first thing in the morning.
There are instructions on this web site on how to modify your v710 phone to turn on all the bluetooth functionality. You need to register though. Don't know if they work, I haven't tried them so you are on your own.
If they work, let us know.
In a two way system yes both a forward and return path are provided completely through the cable provider. In a 1 way system the return path is provided through the phone, Motorola's Surfboard 2100D has a CAT3 connector on it for this purpose. I'll bet that there is still a few of these in the US.
It was also discovered that by permanantly grounding the clock, the RCA cable modem could be turned into a full fledged Radeon 9700 Pro...
Everyone is talking about how this is a bad thing to do on someone else's network, but what about on your own network? Is it possible to get two cable modems to talk to each other over a coax cable? Can you hack the things to run distributed.net software? There are an awful lot of people out there with cable modems but no cable modem service.
We discovered and hounded the vendor relentlessly about the fact that the modems had a serial port for dial-upstream service. If you jumped a couple pins on the serial port, reset the modem, and plugged in a serial line 9600/8/n/1 you'd get the modem's diagnostics (password protected, albeit with a very weak password).
The things you could do from the diag screen were downright scary. All this and more. You could determine the downstream and upstream freqs; you could also set the modem to transmit on any upstream frequecncy at any level up to 60dB. We played around with it for a bit. We set up a test modem and had it transmit for a second at 60dB on one of our upstream freqs; it took out ~400 users' service for about a half hour. Had we done it on the PPV freqs, it would have taken out PPV for a few thousand people. Fun stuff.
And to my knowlege, they never fixed it.