RE: Motorola Cable Modem DOS

["Dan Taylor Jr." <slash () darkhaven net>]

I have been able to replicate this behavior by scanning the cable
modem's internal IP (192.168.100.1) on my Motorola Surfboard 3100 w/ the
following versions:

Software Version: SB3100-3.2.6-SCM-NOSHELL
Hardware Version: 2
MIB Version: II
GUI Version: 1.0
VxWorks Version: 5.3

Scanning the external (internet) IP address has no effect (this is the
first time I've heard of this).

- Dan

-----Original Message-----
From: Ryan Sweat [mailto:rsweat () attbi com] 
Sent: Wednesday, October 30, 2002 3:02 PM
To: bugtraq () securityfocus com
Subject: Motorola Cable Modem DOS


I've found it trivial to crash the Motorola Surfboard 4200 Cable modem,
as installed default by AT&T Broadband Internet.

The modem acts as a bridge, but also has an internal RFC1918 IP address
(192.168.100.1).  Simply  nmap'ing the cable user's IP address, ie: #
nmap -sS -p 1-1024 12.x.x.x will cause it to crash, rendering the
ethernet interface useless.  It is also possible to crash it from the
lan by simply doing the same scan against the cable modem's internal IP
address.  The crash is not specific to nmap, there are other publicly
available tools which cause the same result.  This is known to be
effective on Software Version: SB4200-0.4.4.0-SCM06-NOSH. (possibly
others?)

The only way to restore network connectivity is to physically unplug the
cable modem for a few seconds, then restore power.  A better solution
would be to buy your own cable modem, and not rent this useless junk
from AT&T.

Attempts to notify AT&T about this issue resulted in them wanting to
send a technician to my house to check my wiring.  Don't even get me
started on their tech support...

Ryan