Cable modem hacker faces up to 40 years in prison | Hacker News Reader

Cable modem hacker faces up to 40 years in prison

afterdawn.com

15 pointsjackfoxy19 comments

This isn't someone who modded cable modems for the joy of exploration. He tried to build a business on devices that stole service from Comcast.

Though it makes you wonder what the sentence would be if he had built a business on stealing Comcast vans and selling them, instead.

Grand Theft Auto = Minimum 5 years x number of vans / Judge's consideration

First off, I notice it says 'up to', there is no telling what he'll be sentenced to until it's done.

But I find it a bit weird to see a sentencing guideline higher than second degree murder.

There is virtually no chance he's going to prison longer than a murderer, regardless of what the article says.

Assuming Comcast has a bandwidth cap, by spoofing real MAC addresses he's basically stealing other users' bandwidth.

But then again, people steal wifi all the time.

There's also no reason to spoof the MAC addresses of real subscribers.

If your modem's external MAC isn't in Comcast's (global!) subscriber table, they give your modem a "walledgarden" default configuration file that causes it to reset frequently, and a poisoned DHCP DNS that directs all queries to their "Subscribe Now!" webserver.

Some of the European ISPs have countermeasures that rotate the names of the configs frequently, but Comcast doesn't do that -- if you've modified your modem, all you have to do is have your modem ask for a different config file (the names of which it will sniff from your neighbors), and set a different DNS server on the modem's immediate clients.

When it comes to wifi, I'd drawn the line between stealing and innocent "borrowing" at the point when someone actually goes through the trouble of running a WEP password cracker, which is akin to what happened in this case.

True. However, he is in good company: didn't Steve Jobs and Steve Wozniak start out the same way when they sold their blue boxing devices? Imagine the iPad announcement coming from a prison cell...

People have done real prison time for phone phreaking.

I am not saying it's not a crime or that the hacker here shouldn't be punished. Just playing devil's advocate.

It's also a different world now. You could make a couple bucks on the side in the late '70s and still (sometimes) get away with it, because the problems with our infrastructure hadn't been fully criminalized.

We live in a world today where some significant percentage of all bank transactions in some countries are fraudulent. We've officially lost our sense of humor.

I think some responsibility needs to be borne by those creating blatantly insecure systems.

If I leave my garage door open and you come in and steal a server, sure, that's illegal, but if, say, I lock my garage door, (or otherwise take reasonable precautions) you break a window, and then steal the same server, your penalty will be greater.

depending on equipment on the consumer premises to be secure (especially if your system is so weak as to just look at the mac address.) sounds to me a lot like leaving the garage door open.

I think this goes doubly for the banking systems; right now, all I need in order to hover all the money out of your bank account is your checking account number (and a merchant account) and your checking account number is on every cheque you write. That's a ridiculously insecure system, and sure, it should be illegal to exploit that, but I think the banks are 'leaving the garage door open' here - they bear responsibility for not taking reasonable precautions.

The definition of "blatantly insecure" is highly subjective. I don't think most app developers want to be held to my standard of "highly secure", and I'm a second-tier vulnerability researcher.

Exactly. There's no legitimate reason to modify a modem. At least with something like a mod chip for a console there's some (small) chance the person is using it to run homebrew code. In this case it's clear cut theft.

While I agree that this guy is clearly a thief, I'd still disagree that there's no legitimate reason to modify a modem. I don't rent mine, I bought it, and it shouldn't be a crime to modify my own property. Maybe I'd like to change the firmware or remove the case to scavenge parts. Maybe I even want to change my MAC address. My old ISP made me re-enter my account info when I did that, and then it would work again. (Haven't tried it with the new one.) Nothing wrong with that.

I do see your point about modifying the hardware when it's no longer connected to a public network but cable infrastructure is a shared medium. The actions of one customer can effect hundreds of other customers. For example, we saw a specific firmware revision that caused the modem's burst modulator (upstream signal) to turn on a high power constant carrier in certain circumstances which would DoS all the modems on the same upstream offline. I've heard this was responsible for a massive outage in Phoenix last year due to 8 modems being upgraded before the code was fully tested. If you upgrade the firmware yourself it's putting other people at risk -- including digital phone subscribers who may be using their services as a life line. Changing your MAC address has some risk simply because MACs are supposed to be unique. You could accidentally DoS another customer offline by doing it although statistically the chances are pretty low you'd use another subscriber's MAC but it does happen from time to time when someone simply increments the last digit of the MAC address.

If he had molested a child he would probably serve less time.

I doubt it. People have gone pretty batty when it comes to that particular offense. I hear that one's "prison experience" is somewhat different when its discovered that one is in for this particular crime as well.

Reply on news.ycombinator.com