News for hackers. Stuff that matters.
Re:Cable Haunt: A critical vulnerability found in cable modems by behringer on Monday January 13, 2020 @08:42AM (#22034353)
You make it sound like the providers giving you a modem is a bad thing. This is a good thing. You as the consumer just needs to buy a decent router, and it's your ISPs responsibility to maintain the modem. If you have a decent router you have nothing to worry about. You can simply consider an attack on your modem an attack on your ISP.

All ISPs I've ever seen in the US allow you to use your own router.

Re:Cable Haunt: A critical vulnerability found in cable modems by smileysteve on Monday January 13, 2020 @08:56AM (#22034455)
At a $5+/mo fee for items that normally sell for $60 it seems like profit seeking behavior.

Comcast at least now made equipment returns easier though ups franchises, historically, it could take hours at an under staffed, low budget facility to return a item. And if you didn't you'd often expect to argue with collections.

Re:Cable Haunt: A critical vulnerability found in cable modems by enobrev on Monday January 13, 2020 @03:47PM (#22038376)
Here's a fun trick Comcast is now playing with in Chicago. For unlimited data, it costs $50 a month if you're using your own modem, but using Comcast's modem, I get a "discounted" rate of $20 a month including the modem rental.

It's their way of charging me to use my own modem (which I believe is illegal), hidden behind the ruse of it being a discount to rent theirs.

Re:Cable Haunt: A critical vulnerability found in cable modems by edoceo on Monday January 13, 2020 @01:38PM (#22037207)
Comcast in Washington is $10/mo
Re:Cable Haunt: A critical vulnerability found in cable modems by behringer on Monday January 13, 2020 @09:45AM (#22034831)
5/mo is 120 over 2 years, which is imo the expected life on a modem. Now of course some last 5 years or more, but then some last 6 months. I think 60/year is a decent price for a 100 percent satisfaction guaranteed working modem.
Re:Cable Haunt: A critical vulnerability found in cable modems by heydabop on Monday January 13, 2020 @11:06AM (#22035610)
> which is imo the expected life on a modem

Then buy better modems. My current modem is 4 years old and functions as well as it did on day 1.

If they weren't making money on it they wouldn't sell it to you as an option. Sure the "insurance" might be nice, but overtime they're making money off of you.

Re:Cable Haunt: A critical vulnerability found in cable modems by smileysteve on Monday January 13, 2020 @01:12PM (#22036969)
> for a 100 percent satisfaction guaranteed working modem.

Importantly, the company I mention historically had such a bad satisfaction experience that it was rated lowest for customer experience. Such issues that they rebranded. With their contractor model it was regularly the experience of customers that the install goes through 2 or 3 cheap cable modems until one worked; in combination with their Mac locking, dns poisoning data caps, almost daily scheduled downtimes.

Though I'm still not sure how it's a decent price to pay $120 for something that retails for $60.

Re:Cable Haunt: A critical vulnerability found in cable modems by behringer on Monday January 13, 2020 @02:43PM (#22037830)
Satisfaction guaranteed. Don't like the service? Move along, you're out very little/nothing.
Re:Cable Haunt: A critical vulnerability found in cable modems by insulanus on Monday January 13, 2020 @05:24PM (#22039402)
This would be a good argument if:

* there was any choice in the market * my satisfaction was actually guaranteed * The cost of switching was low (it will take at least a day of coordination to end one service, and start the second)

Re:Cable Haunt: A critical vulnerability found in cable modems by mavhc on Monday January 13, 2020 @10:36AM (#22035320)
Where are you living where modems die every 2 years? My cable modem/wifi router from ISP is about 5 years old. Can't use your own cable modem in UK. They don't list providing of the modem as a line item on the bill either
Re:Cable Haunt: A critical vulnerability found in cable modems by tinus_hn on Monday January 13, 2020 @10:52AM (#22035477)
Officially the EU requires allowing customers to use their own modem if they want to. If the ISP setup requires registering MAC addresses they are obligated to register your personal modem and if a weird setup is required they have to document everything and notify you in advance of changes.
Re:Cable Haunt: A critical vulnerability found in cable modems by gog on Monday January 13, 2020 @04:23PM (#22038770)
Do you have any more details about this? A link or what to search for would be also great.
Re:Cable Haunt: A critical vulnerability found in cable modems by tinus_hn on Tuesday January 14, 2020 @05:09AM (#22043395)
Re:Cable Haunt: A critical vulnerability found in cable modems by mavhc on Tuesday January 14, 2020 @09:12AM (#22044842)
Can only see one example of someone asking about that on google.
Re:Cable Haunt: A critical vulnerability found in cable modems by tinus_hn on Tuesday January 14, 2020 @03:50PM (#22049105)
I do not understand what you mean by that. Note that these directives force the member states to adopt their own laws implementing them. They do not directly affect people, only indirectly. So if people want to invoke the rights they have to cite the national law implementing the directive.
Re:Cable Haunt: A critical vulnerability found in cable modems by mavhc on Wednesday January 15, 2020 @08:45AM (#22054027)
The response in the UK is always "you can't do that", so either the UK hasn't implemented the law, or no one cares
Re:Cable Haunt: A critical vulnerability found in cable modems by tinus_hn on Wednesday January 15, 2020 @02:57PM (#22057824)
The directive stipulates some authority who enforces the rules.

It’s quite possible that, similar to the situation in the Netherlands, the rules don’t align with the opinion of the appointed authority and any appeal is nullified by an endless stream of denials and delays.

For a truly determined citizen or group it would be possible to work through the national and European legal system and force the authority to do its job but it takes a very long time and a lot of money and determination.

Re:Cable Haunt: A critical vulnerability found in cable modems by ken on Monday January 13, 2020 @10:18AM (#22035126)
Likewise, you make it seem like ISPs are competent enough to recognize an attacked modem, and repair or replace it on demand, and promptly. My experience is that when your internet connection goes down or becomes unusable, and you call and complain, it can be literally several weeks before they even respond to you.

They may technically own the modem but you’re in your own to keep it running.

Re:Cable Haunt: A critical vulnerability found in cable modems by derefr on Monday January 13, 2020 @06:41PM (#22040048)
> competent enough to recognize an attacked modem, and repair or replace it on demand

The cable modems I've interacted with all seem to be immutable infrastructure: their state consists of 1. a signed firmware image; 2. a DOCSIS initialization packet received upon network registration (essentially equivalent to a cellular "carrier profile"); 3. a set of saved preferences; and 4. some volatile working state, like ARP tables or WPA encryption-stream key state.

#4 gets trashed on reboot; #3 shouldn't be large enough (or executable) in a way where programs can run from it; #2 gets overwritten every time the network reconnects; and so the only place to put a persistent malware vector should be #1. And #1 can only be written to using signed code (sort of like Intel CPU microcode.)

So what's the problem that can't be solved by rebooting the modem?

Re:Cable Haunt: A critical vulnerability found in cable modems by behringer on Monday January 13, 2020 @03:16PM (#22038145)
Not my experience. My parents are stuck with Comcast due to their monopoly and even they bend over backwards to fix my parents recent issues (hardware failure). Sure it took a couple weeks, but it a couple weeks of troubleshooting, testing, a couple visits, some hardware replacements. People expect these repair installers to be miracle workers, but sometimes an intermittent fault takes time.
Re:Cable Haunt: A critical vulnerability found in cable modems by LeonM on Monday January 13, 2020 @09:04AM (#22034513)
> You can simply consider an attack on your modem an attack on your ISP.

Never thought about it that way. I agree.

> All ISPs I've ever seen in the US allow you to use your own router.

I'm not familiar with the US market, I was speaking from my personal experience with EU based ISPs. I should have made that clear.

Re:Cable Haunt: A critical vulnerability found in cable modems by Vrondi on Monday January 13, 2020 @11:42AM (#22035980)
In the USA, you can use your own router and your own modem, if you are aware enough to do so. Most common people just use whatever the ISP hands them, and pay $5 per month or more for years on end for the privilege of using boxes that never get updated.