If you own or lease a Motorola/Arris SurfBoard 5100, 6121, or 6141 cable modem, security researchers have uncovered an annoying vulnerability that could expose you to a denial of service attack.

David Longenecker first discovered the flaw with the world’s most popular cable modem — the SB-6141, a highly recommended DOCSIS 3 model. The firmware does not password protect access to the cable modem’s configuration menu, accessible by visiting 192.168.100.1 in a web browser.

In addition to technical information about the modem and the cable system’s current cable broadband configuration, there are two user accessible reset buttons, one to reboot the modem and another to reset it to its original factory settings. Rebooting the modem will disrupt your Internet connection for under a minute, but doing a factory reset could bring the modem offline until someone reaches the cable company to request the modem be reauthorized. An individual with nefarious intent can repeatedly reset the modem, bringing the user offline again and again.

SB6141 is a DOCSIS 3 modem

The Houston Chronicle explains how this could become a widespread problem:

Included within this interface is the ability to reset the modem. A user can be tricked into clicking on a simple link that will reboot the SB6141, and you can see a proof of concept here. Note that if you have one of these modems with this flaw, and you click the link, your modem WILL reboot.

Normally, you’d have to be sitting at a computer on the same network as the modem to trigger a reboot. But the link above takes advantage of the fact that you can mask a local Web page address as an image file. As Longenecker describes it:

Did you know that a web browser doesn’t really care whether an “image” file is really an image? Causing a modem to reboot is as simple as including an “image” in any other webpage you might happen to open – which is exactly the approach taken on the RebootMyModem.net proof of concept:

<img src=”http://192.168.100.1/reset.htm”>

Of course it’s not a real image, but the web browser doesn’t know that until it requests the file from the modem IP address – which of course causes the modem to reboot. Imagine creating an advertisement with that line of code, and submitting it to a widely-used ad network…

Advanced users can go into their router’s configuration page and block access to the IP address 192.168.100.1 (the modem’s configuration page) for anyone inside their network. That step prevents you or anyone else on your network from accidentally clicking a link that tricks your modem into rebooting. But most users will probably wait until Arris has distributed firmware updates that cable operators will eventually apply to correct this vulnerability. The upgrade will occur in the background and most users will never notice it.

Fixed (wired) broadband is now the most important revenue component of the TV-Internet-Phone package.

Despite ordering 41 percent more downstream network equipment in 2015 than the year before, cable operators enjoyed a 3% drop in broadband equipment expenses, according to researcher SNL Kagan.

While your cable operator blames the cost of upgrades and usage growth for your latest broadband rate hike, cable company spending on broadband actually declined thanks to lower prices and more efficient broadband networks.

ARRIS, a major supplier of cable broadband equipment, also saw its revenue from equipment sales decline as cable operators used software virtualization to cut the price of DOCSIS channels over new, more efficient converged cable access platforms.

Cable operators are feeling heat in some markets from emerging fiber-based competitors, but the imminent arrival of DOCSIS 3.1 has made meeting those competitive challenges easy and less costly than ever before.

ARRIS closed out the year as the global revenue leader in broadband equipment, grabbing 53% of total revenue among providers of cable broadband infrastructure. ARRIS benefitted immensely from the focus of its primary North American customers, including Comcast and Time Warner Cable, on dramatically increasing throughput to stay competitive with Verizon FiOS, AT&T U-verse, and Google Fiber.

“The imminent availability of DOCSIS 3.1 linecards and full-spectrum channels won’t slow the continued purchase and deployment of current DOCSIS 3.0 channels as cable operators must continue to increase throughput to reduce the likelihood of churn among their broadband subscribers,” said Jeff Heynen, senior research analyst for SNL Kagan.

But the costs to deliver those service improvements are now so low, providers are enjoying actual declines in their annual expenses for equipment upgrades, while at the same time many are raising prices and introducing or increasing modem rental fees and usage caps.

ARRIS, one of the country’s largest suppliers of cable modems, is under scrutiny after a security researcher discovered not one, but two secret “backdoors” potentially affecting more than 600,000 of the company’s installed cable modems/home gateways that could allow hackers access to a customer’s equipment and home network.

Bernardo Rodrigues published a report of the exploits on his blog, which affect ARRIS cable modem models including TG862A, TG862G, and DG860A. Rodrigues reports only ARRIS and your local cable company can fix the security problems, and neither seem to be in much of a hurry.

The ARRIS Touchstone 860, which can be identified by its model number depicted on the front lower right of the modem.

“Securing cable modems is more difficult than other embedded devices because, on most cases, you can’t choose your own device/firmware and software updates are almost entirely controlled by your ISP,” Rodrigues writes. Indeed, very few cable modems allow users to self-update their equipment with the latest firmware. To guarantee uniformity, that privilege is given exclusively to the cable company providing service, even if a customer owns their own modem outright.

“ARRIS SOHO-grade cable modems contain an undocumented library (libarris_password.so) that acts as a backdoor, allowing privileged logins using a custom password,” Rodrigues writes. “The backdoor account can be used to enable Telnet and SSH remotely via the hidden HTTP Administrative interface “http://192.168.100.1/cgi-bin/tech_support_cgi” or via custom SNMP MIBs.”

While exploring the potential security damage that backdoor could permit, Rodrigues stumbled on a second, open to additional exploitation by hackers.

“The undocumented backdoor password is based on the last five digits from the modem’s serial number,” Rodrigues wrote. “You get a full busybox shell when you log on the Telnet/SSH session using these passwords.”

ARRIS TG862

In plainer language, one or both backdoors will allow a hacker to bypass the modem’s usual security protections and provide the intruder with full remote access to the affected cable modem. Hackers have likely already identified the security lapse and have exploited it, with some suspecting access key generators are already available allowing the user to automate attempts to reach affected modems on a significant scale.

Unfortunately for consumers, neither ARRIS or cable operators appear to be rushing to update the affected firmware to eliminate the backdoors, having waited more than two months just to acknowledge Rodrigues’ report.

For now, customers using these devices exclusively as cable modems are least likely to suffer a serious security lapse. More at risk are consumers relying on these three models as both a cable modem and home gateway providing Wi-Fi access around the home. Theoretically, hackers could use one or both exploits to gain access to your home network. Consumers using one of the affected models should contact their local cable company and ask them to replace the device with an alternative, preferably from a different manufacturer.

At least one cable company reported they are working with ARRIS to correct the flawed firmware, but early efforts have not been successful. It may be prudent for some security-conscious customers not to wait.

Time Warner Cable’s major broadband speed upgrade is alive in the Astoria, Woodside and Long Island City neighborhoods of Queens, N.Y.

The Time Warner Cable Maxx upgrade is Time Warner Cable’s effort to catch up to other cable operators that have significantly upgraded broadband speeds for customers over the last 18 months. Time Warner Cable has traditionally been one of the slowest major cable broadband providers in the country, with most customers only able to buy speeds up to 50/5Mbps. But Time Warner Cable has also committed to keeping unlimited use service available to customers, unlike Comcast, Charter, Cox, Suddenlink, and Mediacom.

The free speed upgrades are the largest ever for Time Warner Cable, typically more than tripling speeds for most customers.

Stop the Cap! has heard from readers in Queens who discovered the upgrades took effect this week, so we have been able to take a closer look at what customers can expect as Time Warner rolls out upgrades across New York City and Los Angeles and finally extending faster speeds over the next two years in other cities.

(Image: ematrix)

Arris Touchstone Telephony Gateway TG1672g

The first notification your area is about to receive an upgrade will come in a letter from Time Warner Cable.

Customers subscribing to the fastest speed tiers may need new equipment. Time Warner Cable is using 8-channel bonding in Queens for its 100 and 200Mbps tiers and 16-channel bonding for its 300Mbps tier. Some older and low-end DOCSIS 3 modems only support four channel bonding. For instance, a customer using a four-channel capable Motorola 6121 modem in Queens with Time Warner’s 30/5Mbps Extreme tier will only get speeds up to 50/5Mbps after the upgrade. If the customer owned a Motorola 6141, which supports eight channel bonding, they will get the full advantage of the upgrade: 200/20Mbps. But even the 6141 isn’t enough for Time Warner’s top tier: 300/20Mbps. Customers would need an upgrade to a 16-channel capable modem.

Time Warner’s notification letter says customers can swap out a company-owned cable modem for a 16-channel capable model, currently the Arris TG1672g, either by mail, through an area Time Warner Cable store, or with a service call. The usual modem rental fees still apply.

The TG1672g (download user manual) is a fully capable broadband and Wi-Fi home gateway that also supports Time Warner’s phone service:

• 16×4 Channel Bonding
• Full Capture Bandwidth Tuner
• Multi Processor Technology with an Intel Atom Core Application Processor
• DOCSIS® 3.0 and PacketCable™ 2.0 compliant design
• 4 port Gigabit Ethernet Wireless Router
• 3×3 Integrated Dual Band Concurrent
• 2.4GHz and 5GHz 802.11n radios with Beam Forming
• USB 2.0 Host Port
• Upcoming support for DLNA and File Storage
• Two FXS lines of carrier-grade VoIP with HD voice support
• MoCA1.1 for in Home Video and Data distribution over Coax
• Dual Stack IPv4/IPv6 Home Router
• Internal Power Supply for Highest Reliability and reduced energy consumption
• Battery backup: Single battery pack for reaching a full 8 hours of standby support

If picking up new equipment, a Time Warner representative will probably let you know if your account is flagged “Maxx-capable,” which means your neighborhood’s upgrade is imminent or complete. Time Warner may also want to swap out your set-top boxes if you subscribe to cable television, although readers report cable television service and the on-screen guide in Queens doesn’t look any different at present. The backup battery inside the cable modem is rated for up to 10 years of life and is replaceable by the user for around $60.

Customers who own their own cable modem might have to buy a new one if they are seeking the company’s fastest speeds. Time Warner’s latest approved modem list should guide what, if any, new equipment you might need. If you are considering buying your own modem, you might plan your purchase around the model(s) that support the speeds you want.

Time Warner Cable’s Latest Approved Modem List

[flv]http://www.phillipdampier.com/video/TWC Techs Launch 300 Mbps Internet Speeds at Queens NY Hub 5-6-14.flv[/flv]
Technicians launch 300Mbps broadband speeds for Time Warner Cable customers in Queens, N.Y. (1:27)

Austin is getting an upgrade just in time for competition with AT&T and Google.

There is no market for super-fast broadband speeds, unless your competitor decides to offer them.

Time Warner Cable customers in Austin will benefit from major Internet speed increases that the company insists have nothing to do with its competition.

Google is planning to offer gigabit broadband in select neighborhoods and AT&T is delivering 300Mbps service to a limited number of Austin customers over its slowly expanding fiber network. Coincidentally, Time Warner Cable now plans to match AT&T’s current top speed of 300Mbps beginning this summer.

“Our Austin network allows us to implement the speed increases quickly, and since it’s a rapidly growing market where we know there is demand for faster speeds, we’re moving forward with this aspect right away,” a spokeswoman for Time Warner Cable wrote in an email to CED.

“These substantial speed increases mean Time Warner Cable Internet customers have incredibly powerful new choices for services and features to meet their needs,” said Kathy Brabson, area vice president of operations for Time Warner Cable in Central Texas. “In stark contrast to our competitors, upon completion of this short roll out phase, these faster speeds and choices will be available to every Time Warner Cable customer in every area we serve in the Austin market, not just select neighborhoods.”

Time Warner has also been furiously expanding its Wi-Fi service, available at no cost to Internet customers with Standard Internet or above. To date the company has installed more than 1,300 hotspots with another 1,000 scheduled for installation this year.

Along with Austin, the other areas that will get new speeds include Round Rock, Cedar Park, Leander, San Marcos, Elgin, Marble Falls, Lockhart, Bastrop, Fredericksburg, Taylor, Smithville, Wimberley, Liberty Hill, Lago Vista, Buda, Kyle, Elroy, and Lakeway.

Business Services customers in the area will also have access and can upgrade their service as the new plans are introduced starting this summer. TWC Business Services will introduce the new speed plans of 100 x 10, 200 x 20 and 300 x 20 as add-on options to its existing Wideband plans.

Current Standard Internet and above customers will receive new modems, likely produced by Arris or Technicolor. More information will be sent to customers as the launch dates approach. It is unclear if customers will have to pay to rent the new modems, will get to use them for free, and/or if they will be available separately for purchase.