Hacking the Cable Modem : What Cable Companies Don't Want You to Know

by DerEngel

ISBN13:

9781593271015

ISBN10:

1593271018

Format:

Paperback

Pub. Date:

9/1/2006

Publisher(s):

Oreilly & Associates Inc

Other versions by this Author

List Price: ~~$29.95~~

Buy New Book

In Stock Usually Ships in 24-48 Hours

$25.46

Rent Book

We're Sorry
Sold Out

Used Book

We're Sorry
Sold Out

eBook

We're Sorry
Not Available

More New and Used
from Private Sellers

Starting at $27.29

Questions About This Book?

What version or edition is this?

This is the edition with a publication date of 9/1/2006.

What is included with this book?

The New copy of this book will include any supplemental materials advertised. Please check the title of the book to determine if it should include any CDs, lab manuals, study guides, etc.

Summary

When freed from restrictions set by service providers, cable modems can be tricked out to reach unbelievably fast speeds. An underground network of hackers has discovered ways to get around the imposed speed limit, and those secrets are shared in Hacking the Cable Modem. Readers learn how cable modems work, and how to bypass security, install firmware updates, customise cable modems, increase upload and download speeds, unlock hidden features and more. Detailed illustrations and straightforward terminology show how to modify actual devices.

Author Biography

Profiled by Security Focus, TechTV, and the Register, DerEngel has been hailed as "the underground Prometheus of super-broadband." He has written several programs to simplify and streamline the uncapping process since he started hacking into cable modems five years ago. He currently heads TCNiSO, a group of hackers who have revolutionized reverse engineering techniques and produce free hackware.

Introduction

xix

My Origin

xix

Why a Book on Hacking Cable Modems?

Why Should I Read This Book?

Cable Modem Hacking Secrets Exposed

xxi

This Is the Only Book That Includes Everything!

xxi

How This Book Is Organized

xxi

Always Hack Responsibly

xxiv

A History of Cable Modem Hacking

(14)

In the Beginning

(1)

The Cap

(1)

DOCSIS: The Cable Modem Standard

(1)

DOCSIS Takes Effect

(1)

Finding the Holes

(2)

TFTP Settings and Config Files

(1)

ARP Poisoning

(1)

How This Hack Could Have Been Prevented

(1)

Cable Modem Hacking Begins

(1)

Creating an Executable Hack

(2)

Defeating the Message Integrity Check

(1)

Fireball and Cable Modem Firmware

(1)

How the Firmware Is Upgraded

(1)

Isabella

(1)

Controlling the Firmware with SIGMA

(1)

DOCSIS 2.0

(2)

Blackcat

(1)

What's to Come

(2)

The Cable Modem Showcase

(12)

DOCSIS vs. Non-DOCSIS

(2)

Standard Features

(1)

Wireless Support

(1)

Universal Serial Bus Port

(1)

External Case

(1)

Voice over IP Support

(1)

Additional Features

(1)

Purchasing Guide

(1)

Available Features

(1)

The Showcase

(8)

A Faster Internet

(8)

About Coaxial Cable

(1)

Hybrid Cable Modems

(1)

The Creation of DSL

(1)

DSL vs. Cable Modem Service

(1)

The Physical Network Layer

(1)

Hybrid Fiber-Coax Networks

(1)

Problems with Cable Modems

(3)

Myths

(1)

Sniffing

(1)

What's Really Important?

(1)

The Truth

(1)

The DOCSIS Standard

(12)

Cable Labs

(1)

About DOCSIS Certification

(1)

How Data Is Communicated

(2)

Detecting Packet Errors

(1)

The Basic DOCSIS Network Topology

(3)

Data Link Transport Layer

(1)

Media Access Control

(1)

How Modems Register Online

(1)

Versions of DOCSIS

(2)

DOCSIS 1.0

(1)

DOCSIS 1.1

(1)

DOCSIS 2.0

(1)

DOCSIS 3.0

(1)

Consequences

(1)

Why Certify?

(2)

What's Inside?

(8)

Opening the Case

(1)

Debug Ports

(1)

The Microcontroller

(1)

Input/Output Ports

(1)

Hardware Components

(5)

Firmware

(8)

Overview of Hardware Components

(1)

Flash Memory

(1)

MIPS Microprocessor

(1)

VxWorks Operating System

(1)

Bootup Process

(1)

Firmware Upgrade Process

(1)

Firmware Naming Scheme

(1)

Study the Firmware

(2)

Our Limitations

(10)

Restrictions on Technology

(2)

Why the Limits?

(2)

Restrictions on Cable Modems

(3)

The Cap

(1)

Network Overhead and Bottlenecks

(1)

Removing Port Restrictions

(3)

Using the VxWorks Shell (Surfboard-Specific Solution)

(1)

Using SNMP (Generic Solution)

(1)

Know Your Limitations

(1)

Reverse Engineering

(8)

A History of Reverse Engineering

(1)

Recommended Tools

(3)

Soldering Irons

(1)

Dental Picks

(1)

Cutting Tools

(1)

Chip Quik

(1)

Desoldering Braid

(1)

Opening the Case

(1)

My Methods

(4)

Record Everything

(1)

Download the Firmware

(1)

Research the Components

(2)

Cable Modem Security

(8)

Upgradeable Firmware

(1)

Message Integrity Check

(2)

Minimal User Interaction

(1)

Cryptography

(1)

Certification

(1)

Dynamic Configuration

(1)

Other Security Measures

(2)

Buffer Overflows

(18)

Types of Buffer Overflow Attacks

(1)

The Origin of Buffer Overflow Vulnerabilities

(1)

Developing a Buffer Overflow Exploit

(1)

The Long Process

(1)

The Phone Conversation

(1)

The Drawing Board

(1)

The Dead Modem

(3)

A Quick Lesson About MIPS Assembly Language

(2)

Disassembling the Firmware

(3)

Our Downfall

(1)

Our Comeback

100

(1)

No Time to Rest

101

(2)

The Source Code

103

(4)

Sigma Firmware

107

(8)

Interface

108

(1)

Features

109

(2)

Advanced Page

110

(1)

Addresses Page

110

(1)

Configuration Page

111

(1)

A New Kind of Sigma

111

(1)

Sigma-X

112

(1)

Symbol File

112

(1)

Telnet Shell

112

(1)

Sigma Memory Manager

112

(1)

The Finished Firmware

113

(1)

The Future

113

(2)

Hacking Frequencies

115

(10)

The Difference Between DOCSIS and EuroDOCSIS

116

(1)

Changing a Surfboard Modem's Frequency Plan

117

(6)

Using the VxWorks Console Shell

117

(4)

Using SNMP

121

(1)

Using the Surfboard Factory Mode

122

(1)

When It Doesn't Work

123

(2)

Useful Software

125

(12)

Necessities

125

(1)

FileZilla Server

126

(1)

TFTPD32

126

(2)

TCPOptimizer

126

(1)

HexEdit

127

(1)

OneStep

127

(1)

Information Discovery Software

128

(2)

DocsDiag

128

(1)

Net-SNMP

129

(1)

Ethereal

129

(1)

DiFile Thief

129

(1)

Soft Modding Software

130

(1)

Hard Modding Software

130

(2)

EtherBoot

131

(1)

Schwarze Katze

131

(1)

Fireball Software

132

(2)

Firmware Image Packager

132

(1)

Patch!

133

(1)

Disassembler

133

(1)

Symbol Utility

133

(1)

The Firmware Assembler

133

(1)

Advanced Software

134

(1)

The Interactive Disassembler

134

(1)

SPIM

134

(1)

Reverse Engineering Compiler

135

(1)

Advantages of Firmware Hacking

135

(2)

Gathering Information

137

(8)

Using the Modem's Diagnostic HTTP Pages

137

(1)

Using Ethereal to Find Configs

138

(3)

Set Capture Options

138

(2)

Set Up an Express Filter

140

(1)

The Ethereal User Interface

141

(1)

Using Coax Thief

141

(1)

Using SNMP

142

(1)

SNMP Scanner

143

(1)

DocsDiag

143

(1)

Using Sigma

143

(2)

NodeScanner

143

(1)

Coax Side Sniffer

144

(1)

The Blackcat Programmer

145

(8)

In the Beginning

146

(1)

Developing Blackcat

146

(1)

Building a Blackcat Cable

146

(3)

Parts List

147

(1)

Schematic

147

(1)

Constructing the Cable

148

(1)

Connecting the Cable

149

(1)

Obtaining the Software

149

(2)

The Blackcat Engine

150

(1)

The Graphical User Interface

150

(1)

How to Hack a Surfboard SB5100

151

(2)

Traditional Uncapping

153

(6)

Step 1: Know Your ISP

154

(1)

Step 2: Retrieve the Config Files

154

(1)

Step 3: Change Your Config File

155

(1)

Step 4: Change Your IP Address

155

(2)

Windows 2000 and Later Versions

155

(1)

Windows 98/98 SE/Me

156

(1)

Step 5: Upload Your Own Config File

157

(1)

Uncapped

157

(2)

Building a Console Cable

159

(10)

The Console Port

159

(2)

What Is TTL?

160

(1)

Examining the Schematic

160

(1)

How to Build a Console Port

161

(7)

Step 1: Gather the Parts

162

(1)

Step 2: Gather the Tools

163

(1)

Step 3: Put the Pieces Together

163

(1)

Step 4: Connect the RS-232 Cable

164

(1)

Step 5: Connect the TTL Lines

165

(1)

Step 6: Connect the Cable

166

(1)

Step 7: Test Your Console Cable

167

(1)

Limitations of a Console Port

168

(1)

Changing Firmware

169

(14)

Standard Methods

170

(3)

Method 1: Using a Config File

170

(1)

Method 2: Using SNMP

171

(2)

Changing Firmware on SB4xxx Series Modems

173

(9)

Using Shelled Firmware

173

(1)

Using Open Sesame

174

(1)

Using Blackcat

175

(1)

Using the Console Port

176

(4)

Accessing the Developers' Back Door

180

(2)

Changing Firmware on SB5100 Series Modems

182

(1)

Hacking the RCA

183

(6)

Opening the Modem

184

(1)

Installing the Console Cable

185

(1)

Shorting the EEPROM

186

(1)

Permanently Enabling the Developer's Menu

187

(1)

Changing the HFC MAC Address

188

(1)

Hacking the Webstar

189

(8)

Installing a Console Cable

189

(2)

Bootloader Commands

191

(1)

The Firmware Shell

192

(2)

Hacking the Web Interface

194

(1)

New Possibilities

195

(2)

The Surfboard Factory Mode

197

(20)

About the Surfboard Factory Mode

198

(1)

Finding the Exploit

198

(3)

The Importance of Assembly Code

198

(3)

Enabling Factory Mode

201

(1)

Enabling Factory Mode in Sigma

202

(1)

Using Factory Mode

202

(1)

Changing the HFC MAC Address

203

(1)

Changing the Serial Number

203

(1)

The Factory MIB Look-up Table

203

(3)

cmFactoryDbgBootEnable

205

(1)

cmFactoryHtmlReadOnly

206

(1)

Hacking with the Surfboard Factory Mode

206

(4)

Devising a Plan

206

(1)

Creating Executable Data

206

(1)

Writing Data to Memory

207

(1)

Executing Your Data

208

(1)

Wrapping Up

209

(1)

Viewing the Result

210

(1)

Using Factory Mode to Change Firmware

210

(5)

Writing a Function to Change Firmware

210

(1)

The Symbol Table

211

(1)

The ChangeFirmware() Assembly Function

211

(4)

Downgrading DOCSIS 1.1 Firmware

215

(1)

Patching the Upgrade Procedure

215

(1)

Obtaining Digitally Signed DOCSIS 1.0 Firmware

216

(1)

Downgrading the Firmware

216

(1)

Additional Resources

216

(1)

Hacking the D-Link Modem

217

(14)

The Diagnostic Interface

217

(2)

System Info Page

218

(1)

Cable Status Page

218

(1)

Signal Page

219

(1)

Event Log Page

219

(1)

Maintenance Page

219

(1)

Hacking the DMC-202 Using the Telnet Shell

219

(8)

The Main Menu and Beyond

220

(6)

How to Change the MAC Address

226

(1)

How to Change the Firmware

226

(1)

The Production Menu

227

(3)

How to Access the Production Menu

228

(1)

How to Change the Hardware Parameters

229

(1)

Why Open the Case?

230

(1)

Securing the Future

231

(14)

Securing the DOCSIS Network

231

(1)

What Network Engineers Can Do

232

(9)

Upgrade to DOCSIS 1.1/2.0

233

(1)

Disable Backward Compatibility

233

(1)

Enable Baseline Privacy (BPI/BPI+)

233

(1)

Create Custom CMTS Scripts

234

(1)

Prevent MAC Collisions

234

(2)

Consider Custom Firmware

236

(1)

Use Signed Firmware

236

(1)

Secure the SNMP

237

(3)

Use Active Monitoring

240

(1)

Keep Up to Date

241

(1)

Cable Modem Hackers

241

(2)

Hackers Often Use Spare Modems

241

(1)

Hackers Rarely Use Their Own MAC Addresses

241

(1)

Hackers Often Use Common Exploits and Hacks

242

(1)

When the Cable Company Finds Out

242

(1)

The Future

243

(2)

A. FREQUENTLY ASKED QUESTIONS

245

(12)

General Questions

245

(7)

Do I need cable television in order to have cable Internet?

246

(1)

How do I know if my service provider is DOCSIS or EuroDOCSIS?

246

(1)

Which was the first cable modem to be hacked?

246

(1)

My cable modem has both a USB and an Ethernet interface. Which one should I use?

246

(1)

Is it possible to change the MAC address of a cable modem?

247

(1)

Can two computers use one cable modem to access the Internet?

247

(1)

Can two cable modems go online with the same MAC address?

248

(1)

Which cable modems can be uncapped (or are hackable)?

248

(1)

Should I uncap my cable modem because my service is slow?

248

(1)

Is DOCSIS 2.0 faster than DOCSIS 1.1?

248

(1)

What does the term ``uncapped'' mean?

249

(1)

How can I change my modem's firmware?

249

(1)

Where is my modem's diagnostic web page?

249

(1)

How do I unblock port ....?

250

(1)

What is Sigma firmware?

250

(1)

Can I use a router with Sigma?

250

(1)

Can I download the config file from a cable modem?

251

(1)

If I am uncapped, how fast can I download or upload?

251

(1)

Are there any good Internet cable modem resources?

251

(1)

Can I contact you?

252

(1)

Motorola Surfboard-Specific Questions

252

(5)

How many different Surfboard models exist?

252

(1)

What are the differences between the SB4100 and the SB4101?

253

(1)

What are the differences between the SB5100 and the SB5101?

253

(1)

Can I install EuroDOCSIS firmware into a DOCSIS modem (or vice versa)?

253

(1)

Are there any secret web pages in Surfboard modems?

254

(1)

Can I change the Surfboard's default IP address, 192. 168. 100.1?

254

(1)

Can I turn off the standby feature through the Ethernet port?

254

(1)

Can I disable the DHCP server on a Surfboard modem?

255

(1)

Can I remove the community string from my cable modem's SNMP server?

255

(1)

Which Surfboard modems are compatible with DOCSIS 1.1?

255

(2)

B. DISASSEMBLING

257

(12)

Obtaining Firmware

257

(2)

On the Web

258

(1)

From Your Service Provider

258

(1)

Directly from the Flash

258

(1)

Unpacking a Firmware Image

259

(3)

Uncompressing Firmware for SB3100, SB4100, and SB4200 Modems

259

(2)

Uncompressing Firmware for the SB5100 Modem

261

(1)

Extracting the Symbol File

262

(2)

Writing a Program to Extract the Symbol File

263

(1)

Creating an IDC Script

264

(3)

Setting Up the Interactive Disassembler

265

(1)

Working with the Interactive Disassembler

266

(1)

Using What You've Learned

267

(2)

C. CROSS-COMPILING

269

(8)

Setting Up the Platform Environment

270

(1)

Emulating a Linux Environment

270

(1)

Compiling the Cross-Compiler

271

(1)

Compiling the GNU Compiler Collection (for MIPS)

271

(1)

Compiling Your First Program

272

(1)

Loading the Compiled Program into Your Cable Modem

273

(1)

Obtaining Plug-ins

274

(3)

TftpGet

274

(1)

nmEdit

275

(2)

D. ACRONYMS

277

(4)

Index

281

Hacking the Cable Modem : What Cable Companies Don't Want You to Know

9781593271015

Buy New Book

Rent Book

Used Book

eBook

Questions About This Book?

Summary

Author Biography

Table of Contents