Hacker News Reader

You can replace their router with one of your own. On my ONT there are two ways of connecting to the Verizon service:

1) Ethernet. If you connect this way then running your own router is trivial, but by using Ethernet you lose some services related to TV.

2) Coax. This is a bit more complicated. You'll still have to power the Verizon router, but everything behind, and including, your router still will be under your control. You need a Coax to Ethernet adapter like this one:

http://www.netgear.com/service-provider/products/powerline-a...

I don't remember all the specific steps I had to take to enable this offhand. I need to go back and write a howto. In any case, The final setup will look like this:

  Verizon ONT --[Coax]--> Moca Adapter --[Ethernet]--> Your router.
                          Moca Adapter --[Coax]--> Verizon router.

One important point is that you must release your DHCP IP on the Verizon router before your router can obtain one.

I think you can dispense with the Coax connection to the Verizon router if you don't care about TV capabilities, but if you don't you might as well switch the ONT to use Ethernet instead and avoid this mess.

My main motivation for doing this was that the wireless capabilities of the Verizon-supplied router were terrible, but it has the added bonus of keeping Verizon's prying eyes out of my home network.

Yeah, I've taken a similar approach - my comments were more just to raise awareness about how much verizon is theoretically able to do in light of what a low bar they have for doing them for LEO.

You can get it set up so all your iptv services work with the ONT using the ethernet port BTW - that is the default install configuration these days for people on the faster service tiers as moca caps some where north of 100mb. In that setup the actiontec is connected both via coax and ethernet to the ont, and it serves as a ethernet<-> moca bridge internally to support the ip features of the stbs.

Running the STB's without any moca is basically unusable, no epg, no dvr, no vod etc. And it's worth noting that even though my actiontec is physically separated from my home net through a tweaky setup, they could still theoretically do full stream wireless packet capturing of whatever the radio could hear, or become an active node on your other 802.11 network. Brute forcing a WPA2 secret is a common enough practice that they have purpose built luggable SFF pc's with 4 tesla cards inside for field work.

You can actually remove 100% of the verizon CPE and still good tv if you're willing to pay for it. Once I found out all the stuff the STB's are doing I'm in the process of replacing them with a tivo with a cable card and a tivo mini (basically a slave). Even slightly cheaper per month than the multiroom dvr, though the upfront is $$$

Could you give an example of the WPA intercept system you speak of (SFF / Tesla)?

There are some interesting things on the Harris site, but seemingly no open source info on such systems they may have.

I think I was abusing terms when I said SFF, I guess I was thinking more like "in comparison to" an HPC rack.

similar to the intermediate CA black box providers they seem to have much larger presences at trade shows than on the web, but this is pretty close to what I'm talking about:

https://www.nor-tech.com/clusters/cs-darpa.htm

but this is a little closer to the look: http://www.captec-group.com/wp-content/uploads/captec_dsei_2...

But the one I was thinking of was more along the line of a comically oversized air travel case for a projector or so.

touting as a feature that allows them to measure ad exposure based on floor vibrations that suggest you walked away during a commercial.

Ok, now that's creepy. Time to get a Jack Russell Terrier & a tennis ball.

I'm pretty sure the generations in development have video cameras and microphones (to allow you to cough wave your hands or speak to change channels, of course). That same platform also has ISM radios in monitoring mode so that they can see what devices are present and obtain rough positioning data. So they'll know when you get home based on your phone mac appearing, and how many people are on the couch and who they are.

here is the video recognition stb patent application that includes a number of eye openers:

http://www.freepatentsonline.com/20130042270.pdf

> And they log in every day and confirm the hash of the firmware you're running

If you can modify the firmware you can change it to respond to their query with the "correct" firmware signature, so this doesn't seem useful to me. Source?

Also, is the 802.11n radio connected to an antenna? If not, can't really do any surveys with it. Sounds like a fun box to play with for evil maid attacks, though!

You can only load verizon/actiontec signed firmware via the UI. I suppose you probably could reflash it directly if you connected leads to the smt chip on the board, that is assuming it's not on the SOC and assuming the stage 1 loader doesn't verify the signature. It's mostly to prevent rollback attacks where a known vulnerable firmware is flashed to take advanatge of a flaw.

discussion of the firmware enforcement process: http://www.dslreports.com/forum/r27282376-Actiontec-Rev-I-fi...

(technically it's implemented by an automatic process that verizon runs that logs in via their TR069 carrier management port and then does various (unlogged things) including enforcing that you're on approved firmware.

yeah the box has two antennas each one attached to the radios. Almost all of the other actiontec customers use it as a 2nd channel to get 300mbit, but for whatever reason verizon's is set to only use 1.

https://www.actiontec.com/products/datasheets/AEI%20MI424WR%...

datasheet for the product, verizons feature set is slightly different but it's just firmware differences.

If their stage 1 is verifying the signature it's going to be pretty hard to hack the firmware (since you need to crack the key or find some other hole to get your firmware to run), so at that point they could care less about logging in to double-check the key wasn't cracked. In that case the integrity check is more likely just making sure the firmware isn't corrupt, or just checking the version to see if it needs an upgrade in general. If on the other hand they are just verifying which firmware is applied, the stage 1 probably isn't verifying the signature, so in that case we really could fake out the check.

Flashing the chip directly is probably significantly easier than attacking the UI's signature verifying feature. Once you learn how it's pretty fun to examine random devices' firmware directly ^_^

Yeah, glancing at the specs it looks like you're almost surely correct, that it's just checking a version string thats returned.

I got a little carried away, but really my point wasn't that it's impossible to avoid the risks, just that undoubtedly 99%+ of their customer base could be subjected to this and im sure most don't realize it. I thought my concerns with it were pretty tin foil hat until reading this story about the exact company doing something very, very similar.

> they can push a new firmware package to your router and reboot it easily, without you ever knowing. And they log in every day and confirm the hash of the firmware you're running - if it's not on the approved list (which is generally just the current one they have you set for) it automatically re flashes.

This is pretty standard practice for cable providers. The cable company I work for does this to cable modems.

Oh yeah, its not an issue when you're talking about the typical WAN side CPE that only sees outbound traffic and isn't loaded with radios. After all, they can see or do whatever they want to your traffic anywhere in the path. It's a slightly different story when it also has the potential to see all your land side traffic and anything in the 2.4ghz band it can hear.

The cable modems my company provides has built in 2.4ghz, and the company has full admin rights to the modems local admin interface (the customer does not)...

yeah, so that's another good example of the future of administrative subpoena surveillance. I knew that the converged ap and modem was pretty common with dsl providers, but at least the ones i had seen allowed the customer to control what firmware was running.

My cable provider does this to and i don't trust them in the slightest so i just use my own router: cable --> providers modem/router --> my router --> network

I would disable its routing ability and use it as a bridge, but it provides a easy way to share wifi with guests/neighbours.

One should never use the router given to you by your telco.