Comcast is leaking the names and passwords of customers’ wireless routers | Hacker News Reader

Comcast is leaking the names and passwords of customers’ wireless routers

techcrunch.com

182 pointssmaili79 comments

I have Comcast and my own modem/router. It’s a good idea to have your modem/router as the article suggests but you’ll have to be tech savvy enough to counteract Comcasts’ tech support people. Every time there is an issue with the internet connection their tech support always say it’s my modem/router that is the problem and that I need to use a Comcast supplied modem/router. It’s annoying and those who are not savvy enough will capitulate and get Comcasts’ equipment.

I hate Comcast and would gladly pay another company double what I pay for internet service with similar speeds. Alas, no such competition exists is my area. I hope Comcast goes bankrupt some day.

Yep, and you have to also watch out for their multiple EOL lists. I have a modem that has been EOL'd if it's a leased modem (meaning they will give you a new one if you're leasing it) but has explicitly not been EOL'd if it's customer-owned. But guess how many Comcast reps catch that distinction? None, of course. Even when I show them their own page that explains this, they insist that I need to get a new modem.

I have Spectrum and the best decision I ever made was buying my own modem and router. I've had zero issues since and consistent speeds.

I second this. With Comcast (business). No complaints coming up on the first year. Caveat: I don't need blinding speed to push code back and forth. Verizon DSL was fine, actually, when I used that.

I was in the same situation. Their all-in-one modem/router is the most insufferable piece of equipment I've ever had to work with. Trying to do any kind of video chat using it was a nightmare with constant freezing and buffering issues even when standing right next to it.

Bought my own Surfboard and TP-Link router and installed DDWRT and have been free of most issues since then except one. I randomly lost internet connection once and tried everything that I could to get it back up and running. Finally got a technician out and he showed me that sometimes you have to keep the power on the surfboard and only unplug/replug the coaxial cable to the wall and then it will start working again. I had never seen an issue like that before in my life and I'm still trying to figure out why that fixed it.

Probably a supply glitch during power up that interferes with block sync, but only sometimes.

The reason leased modems fall onto the EOL list sooner is because it takes time for Comcast to rollover those units. Comcast has to continue to support those units until they've removed them from the field. Once they've rollover all the units, then the modem is put on the customer owned EOL list.

The EOL list serves two functions. They will remotely update the firmware of supported modems using the TFTP interface and the will validate supported modems on their network for the speeds offered by the modem. When your modem falls onto the EOL list it is no longer updated and they cannot guarantee your speed. The former is a security concern for them, and the later is more of a nuisance if you upgrade your service to a tier your modem can't achieve on their network.

So ISPs remotely push updates to their customer premises hardware? This doesn't apply to the customer's own equipment, right?

It does, if you access your cable modem's web interface you'll find rebooting is the only function you can perform otherwise it is read only.

ISPs manage Cable Modems regardless of who owns them. It's part of the subscriber agreement.

If you have an all-in-one device that is a cable modem, router, switch, and wifi ap all-in-one; the cable modem is still managed by the ISP.

Only the modem is managed? Is it a separate system/firmware? That would make a lot of sense. My ISP gave me a VDSL router and I can configure a lot of things via the web interface, but to get access to features such as bridge mode I'd have to replace its firmware.

Is there a way to get the modem as a discrete component, rather than integrated into these all-in-one things?

An argument can be made the rental is worth it for the ability to tell them "if I can't get x speed off this Ethernet port, it's your fault, hands down, so fix it". Whether or not it's worth $10-15 a month depends on how much you loathe arguing with Comcast on the phone.

In my case, I was on my own modem on Comcast, my new service on my new ISP is using DOCSIS 3.1, and what they support at what speeds seems to be changing frequently, so a rental is the safest bet right now. (And 3.1 modems are expensive as heck.) I tried buying one, it was too new for my ISP to work with, and all the other ones both cost more and were lower end hardware. I'll probably switch back to my own modem once 3.1 stabilizes a bit.

> the rental is worth it for the ability to tell them

Tell them you want to cancel. You'll be routed to the cancellation department, which is greatly empowered and incentivized to ensure you don't cancel. I have to do this about once a year, when Spectrum/TWC randomly adds $40 to my monthly internet bill.

Oh, my God. Never do this. Never suffer their retention specialists. If you want to negotiate your bill, you use Twitter. (Comcast's social media team at corporate HQ won't give you the runaround the goofballs at the regional support centers do, they have different incentives.)

What is this, the dark ages? o.o

Yes it is, as a matter of fact. Future historians will have this very approach to such matters to thank for the darkness. People have been talking about a digital dark age for some years, now.

The thing to do is to go into one of their customer service offices. There you will deal face to face with a human being who is not reading from a decision tree script, and has more options. I do this periodically to get the new subscriber introductory rates on my service.

> An argument can be made the rental is worth it for the ability to tell them "if I can't get x speed off this Ethernet port, it's your fault, hands down, so fix it". Whether or not it's worth $10-15 a month depends on how much you loathe arguing with Comcast on the phone.

You can still make that argument by plugging a computer directly into the modem. It's not a good idea for long term use as there is no NAT so your computer will directly receive all traffic for your public IP but it's fine for the initial setup when you're verifying that your supposed “up to X MB/s" is really "barely Y MB/s".

This discussion here is really on renting or owning your own modem. As far as I can tell, most rented modems now bundle a router/access point into the modem confusing the issue slightly, but you can (and should IMO) buy your own modem. I have refused to use any ISP supplied hardware for well over a decade precisely because of issues like the one described in the article.

Have you actually done this? Because I have, and even after telling them, "I'm paying for 25 down and using your modem I'm barely pulling down 7." Their suggestion was that I should upgrade to 50 down.

I told them to go to Hell and switched to Fios.

Yep, after trying this a few times I never got anything better than "might be temporary issues with traffic in your area" or "we have this more expensive package..." Which doesn't actually surprise me, since I doubt tech support can fix a problem that's essentially "we blatantly lied to you when we sold you this service".

Cable companies have always sold a maximum speed. When you pay for "25 megabit" internet from a cable company, what you're really paying for is up to 25 megabits down. AFAIK, no cable company has ever guaranteed a minimum download speed of any kind.

> "if I can't get x speed off this Ethernet port, it's your fault, hands down, so fix it"

I'd happily cough up the cost of router rental for this ability, but I never seem to get it. With my own router, support calls stonewall when the rep blames my router. Without it, they persist a little longer and then generally shrug and say they have no further solutions and it's probably a temporary issue.

I'm used to getting 1/2 of the speed I pay for, that's happened with every ISP I've ever had, but lately Comcast has been moving down towards 1/5 and raising prices. I'd be willing to go back to a rented router to get that fixed, but at the moment it looks like their retention department will be my best hope.

> An argument can be made the rental is worth it for the ability to tell them "if I can't get x speed off this Ethernet port, it's your fault, hands down, so fix it".

Unless you hook the modem directly up to the cable coming from the pole/ground then they can always blame the cabling in your house.

Even when Comcast sends a tech out to your house to punch holes in the walls, floor, and ceiling to install cables they don't guarantee that install.

I had an issue years ago and Comcast insisted it was an issue with my house cabling and refused to do anything but send a tech out at my expense. When he knocked on the door I lead him around to the side of my house where the cable came down from the pole. I had my modem sitting there on a bucket plugged into that cable and an extension cord powering it. It wasn't until I showed him with my laptop plugged directly into the Ethernet port that it wasn't establishing a signal lock that they sent a bucket truck out to inspect the lines and fix the problem.

> "if I can't get x speed off this Ethernet port, it's your fault, hands down, so fix it".

In my experience that was when they'd point out that their advertisements only say “up to x speed” and lie that the server I was trying to use must be overloaded. The best answer is to contact your local government regulators and/or switch to the competition.

We had Comcast in New Haven and when we moved to DC the experience had left me soured enough that I got 8Mb DSL rather than deal with Comcast again. In the evenings, the DSL line reliably delivered better performance than our Comcast service had. We subsequently moved to a neighborhood with RCN and the experience has been night and day different: if I pay for 50Mb, I get 50Mb.

I subscribed to this idea for years ... until I had "Internet" issues at my office. Called Comcast, tech visited and blamed my old router. I called them on their bluff (it wasn't) and had them install a Comcast combo router/modem - problem solved, didn't need to buy a new router. I can now call Comcast whenever anything slows, or breaks at my office. They're responsible for it all, I don't have to worry about managing my own router and never have the situation where my hardware can be blamed.

I value my time (which = money) greater than my "geek" needs to have a separate router. I don't get paid to fart around with router reboots, firmware upgrades or hardware updates.

Edit: Spelling/grammar.

Keep in mind you do get charged a "modem rental fee" or whatever, and in most cases its $10-20 dollars monthly. For you that might be worth it, for others who already feel like their ISP is a sham and charging way too much, it might cross the line.

Comcast modems also broadcast a second set of WiFi networks for other Xfinity customers and their mobile network. You are paying monthly to subsidize their 5G network. The additional power usage, however negligible, is additionally insulting.

Does the modem broadcast this wifi signal, or just the router? I have just the modem at home and don't see the "xfinity" wifi network like I do when travelling. I'm not worried about "freeloaders" at the office. Our neighbors all buy their Internet (which is actually silly, we should cooperate) , and there's no "loitering" area outside.

Considering I've used that feature quite a few times, it's hard for me to complain about the, what, 2 cents a year of power we're talking here?

Same here. I use the Xfinity network frequent enough that I value having it, and don't mind providing it. I use it at the kids bus stop, at people's homes, businesses - it allows me to keep my mobile data bill low.

$15. The cost of a new router, combined with the time it takes to deal with my own hardware makes it an easy sell. It's also worth noting that I'd need to drop the modem & router to erase this fee - the modem rental fee is $10 - so $5/month for a router I don't have to manage, looks even more affordable.

I took the other approach at home. Just bought a new $175 router, which solved my "issues" (old router was crashing with heavy use). At home however, I have plenty of "fart around" time.

>I value my time (which = money) greater than my "geek" needs to have a separate router.

After verifying no rental fees, when i have service issues I simply unplug my router and plug in Verizons for them to troubleshoot. Five minutes after the leave; I replace it with mine and shove it in the closet and the world is better for it.

In my case, my service issue was MY router. If I had unplugged my own router before the tech arrived, he would have been A) confused and B) unable to help me.

In that case, you would have saved time from a service visit by diagnosing your router as bad before the tech arrived :) But again, all comes down to where you want to allocate your personal effort. Simply handing off issues can be a significant mental relief, even for trivial things.

You are paying ~$200/year to rent your router.

I'm guessing he knows that. It doesn't have to save him much time for that to be a bargain.

This. I have a line of people waiting to pay me (I should stop posting here and get to that) - debugging my own hardware makes me $0. It's why I don't run my own email server, and don't host my own websites, and don't run my own media server at home.

$10/month for the modem, $5/month for the router. You can do the math.

Let’s say he gets paid $50/hr.

If he spends 4 hours on the phone with Comcast dealing with their incompetent “tech support” he has already lost that money. And he’s frustrated to boot.

For some, peace of mind is worth that price. For others, it’s not.

Double that (not bragging) and you'll see the justification for my choice. I could have saved several hundred dollars (at least) if I wasn't using my own hardware previously. Not to mention weeks of slow Internet which cost me even more money.

The problem with the calculation you made is that he is not making $50 per hour every hour of the day. If a person is at full employment, that is they can’t or won’t work more hours, then the calculation changes. The opportunity cost of dealing with tech support is no longer monetary and the cost of equipment rental is no longer negligible.

they can’t or won’t work more hours, then the calculation changes

How so? If I come into work (self employed) and have no Internet access I immediately start losing money (double if you count both people in my office). If I have to debug my own hardware, possibly drive to Staples to buy new hardware - I lose even more money, not to mention the cost of new hardware.

My only recourse is to eliminate some personal time with my family and replace with more business time to make up for the losses.

I don't see how this calculation makes buying my own hardware more economically attractive.

If the time spent on troubleshooting cuts into the number of billable hours then one should factor in the wage for those billable hours. If it doesn’t subtract from the number of billable hours then the wage of a billable hour doesn’t factor in.

Where you mention cutting into personal time with family is precisely what I mentioned when I said the opportunity costs aren’t monetary when at full employment. If that non monetary opportunity cost is too high then one should rent the modem.

The “every hour of the day” argument is a bs argument. You need to sleep, for starters. And a majority of the working class has decided that it’s great to have a life outside of work, hence the two particular phenomenons we know as “9-5” and “weekend”. Nobody works every hour of the day.

With that being said, my $50/hr figure is a full-employment all-things-considered figure. In fact if someone is a freelancer, their invoice rate is likely twice or thrice that rate. But my figure even takes downtime into account.

If you’re making $50/hr, then 4 hours of work time spent troubleshooting a router is not worth it financially. It’s also up to you decide whether it’s worth it emotionally or spiritually.

> I can now call Comcast whenever anything slows

Have you done this and had success? If I expected having a rented router to actually get me better speed and service, I'd probably just deal with the cost. Even having firmware and hardware upgrades handled automatically would be worth something. But my experience is that rented routers are worse than purchased ones and never upgraded, while I get a 0% success rate from Comcast customer service regardless.

Perhaps business internet is different, if you actually had a tech out?

I have not had to contact Comcast since I had my own router replaced with the combo. When I did have my own router, I was able to have a tech come to my office and identify the issue (which involved cutting my router out and testing) Even though it was my hardware that was at fault, they did not charge me - probably because I opted for the combo? (not sure)

The combo router is not cutting edge - however I don't need cutting edge router technology at my business - I need reliability. We have two people in the office so our needs (even though we work "on the web") are not that great.

Check with me in a couple years, when my combo modem/router is even older and I need/want an upgrade. I'm not sure of that process - anyone been through that?

> Alas, no such competition exists is my area. I hope Comcast goes bankrupt some day.

Alas, unless your municipality is willing to bust Comcast’s local monopoly, they’re not going anywhere so long as you need internet.

That's why I ditched my Cisco for theirs. It's like they are looking for an excuse to end the support call. I still use my own WiFi equipment though. The Comcast one isn't very good.

The easy solution is to keep the provided modem, and when there's an issue, just swap it over and replicate. Preemptively factory reset the modem, too, which is no big deal anyway when you're only using it for troubleshooting.

They charge a fee for using their modem.

Yep like $7 a month to "rent" it. There is a good reason for not doing that racket.

>I have Comcast and my own modem/router. It’s a good idea to have your modem/router as the article suggests but you’ll have to be tech savvy enough to counteract Comcasts’ tech support people.

I have comcast security as well as internet (it's actually pretty good - the apps are really well written, which I was surprised by). The installer insisted that for more than two cameras, I had to use comcast's own modem because the other solution was to use an extra plugin part that worked crappily for more than two cameras. Any idea if this is actually true?

PSA: Any problems you have with Comcast, you can solve with a sternly worded email to their “executive support” secret email:

Comcast_CustomerSupport@cable.comcast.com

Comcast_ESC@cable.comcast.com

Thanks for the tip. Maybe if I complain with just the right tone I can get them to stop injecting "you have used 75% of your monthly bandwidth" popups into my HTTP responses >:(

They're very proud of this incarnation of their notification injection system. There have been presentations and an RFC.

https://tools.ietf.org/html/rfc6108

Just complain on Twitter. Works every time, even if you didn't want help and were just venting.

https://support.xfinity.com/svp-contact-form

This is another path to the Executive Escalation team. IME, they respond quickly and get stuff done.

I've had great success filing regulatory complaints where I have exhausted the help from the company in question: https://www.fcc.gov/consumers/guides/filing-informal-complai.... Companies usually have a team to deal with these and take them seriously.

To take advantage of this, you need the target's account number. Not impossible to get, but it's also not something you can readily get your hands on.

You could probably find it in most peoples’ trash, reliably, intact, on a regular schedule.

One more reason to enter into paperless statements.

Or to buy a shredder.

That negates many of the other reasons to go paperless, though.

Don't buy a shredder. Buy the Shredder: https://smile.amazon.com/Teenage-Mutant-Ninja-Turtles-Figure...

Ya, but that's pretty out there. The big problem with vulnerabilities is millions of hackers from all over the world can actively exploit them at the same time. If you limit it to someone digging in your trash, you would have to be a pretty high value target for someone to go through that.

I wouldn't expect anyone in my neighborhood to go through that for free internet.

It's common for apartments to have trash can in their mail room that's just got mail in it. So, it's not going to be unclean and being able to leech internet is likely worth it for many people.

You fundamentally misunderstand the attack. Nobody needs to dig in your trash. A malicious third party only needs one account number/address from any Comcast customer. With that, they can use your equipment to download child porn or launch illegal traffic that will trace back to you.

Upvoted. A lot of the security breeches we see are, in practice, extremely difficult to exploit. If I had a Comcast router, (which I don't,) I wouldn't worry one about this exploit. (As long as it's fixed in a timely manner.)

Sure, unless you have a stalker-ish ex, or you're a politician, or you've ever had someone else pay your bill, or you once had a bit of mail go missing or...

Well, why not see it as a feature? Plausible deniability for anything that happens on your wifi, also plausible that it is out of your control.

You should most likely be shutting off the Wi-Fi on a Comcast-owned gateway anyways: The wireless they provide is trash to begin with, and you have less options and ability to ensure it's running modern firmware.

Also it allows any Comcast customer to leech off your bandwidth. That's what those Xfinity wifi hotspots are, you sign in with your Xfinity user/pass.

There's a separate DOCSIS QoS stream allocated for it, it isn't using "your" bandwidth. (Of course, there's only so much uplink at the CMTS, but...)

As someone who occasionally uses the xfinity login while out and about, you can tell it is absolutely on a separate stream because it definitely gets reduced service. I haven't run a speed test on it formally, but it definitely gets less bandwidth than the customer wifi signal, and I'd swear it has some latency added to it just to ensure that it's a nicer alternative to cell signals but not something you want to use full time.

is there a way to verify this?

I have wifi turned on and restrict connections to certain devices so how could I tell?

They won't show up on your local network. They're on a type of guest wifi.

If you connect to your local Xfinity wifi connection, you might be able to sniff them out, if the wifi allows "promiscuous" connections.

(Promiscuous mode works because LANs are like cell networks - they operate on an "honor system", where all devices on the network receive all IP packets, but ignore those which don't match their address.)

Responsible disclosure?

The linked article mentions: "Comcast, when contacted prior to publication, did not comment."

However, when I go on the activation page, it prompts for either a Comcast login or SMS verification, so this may have been fixed.

It’s “responsible” to let the public know that they are exposed to this.

earlier post: https://news.ycombinator.com/item?id=17122312

Reply on news.ycombinator.com