Vulnerability Development mailing list archives

Re: chaging your @home IP address... could you take a bunch ofthe m....probably... could you get something from it...maybe


From: TWyrick () paulo com
Date: Wed, 6 Feb 2002 14:08:04 -0600

I was just reading up on this earlier today.
Here in the U.S., AT&T cable seems to work exactly this way.

(Apparently, COX Cable in the U.S. has much weaker security set up for
throttling cable modem bandwidth, though.  Their network, last I heard,
still allowed non DOCSIS compliant modems on it.  Software hacks exist that
toy with the ARP address entries and trick these older cable modems into not
capping bandwidth at all on the COX network.)

I've heard rumors that people have successfully modified DOCSIS modems to be
permanently "uncapped" by cutting a couple of resistors inside the modem
after updating the firmware with new QOS settings.
(That way, the modem tftp's down the cable company's throttling settings
when it first boots up on the cable network, but doesn't really update its
internal firmware with the file.)

In fact, I understand that not only are there settings for maximum bandwidth
for up and download, but perhaps more importantly, there is a "priority"
setting.  Cable companies usually leave it set to a value of 0, but it can
be bumped up as high as 7.  If everyone else's cable modem is set to
priority 0 and yours has a different value, your transfers take precedence
over everyone else's on your subnet.

Now - AT&T and others do hire people who monitor bandwidth usage with
software analysis tools; so even if you give yourself lots of bandwidth with
a hack like this, I wouldn't be surprised if your service suddenly gets shut
off!


In the states many companies will let you buy DOCSIS modems, here in Canada
however, most Cable ISP's are not at that stage currently. Some have
implemented DOCSIS on their networks (Including the one that I work for).

The way the modems are throttled are by config files (And possibly via SNMP
management as well), so to unthrottle the modem (And the modems should be
capable of 10mbps both directions if not more) you would need to replace
the
modems config file.

However, attempts to hack the config file and replace it with your own can
be very difficult (Not saying it's not doable, but in all my trying on our
network I haven't been able to). They have shared encrypted secrets in the
DOCSIS config files, so even if you do manage to replace the config file on
your modem with another one (Very difficult to do) the cable router will
not
accept the modem because the shared secret does not match.

Also, the config file is specified on boot up by the Cable ISP's DHCP
server
(It should specify the TFTP server and the config file to download). So the
challenge is, to spoof the DHCP server responses and force the modem to
download a config file from your TFTP server.


Current thread: