Motorola Cable Modem DOS

From: Ryan Sweat (rsweatat_private)
Date: Wed Oct 30 2002 - 12:02:27 PST

  • Next message: David Endler: "iDEFENSE Security Advisory 10.31.02b: Prometheus Application Framework Code Injection"

    I've found it trivial to crash the Motorola Surfboard 4200 Cable modem,
    as installed default by AT&T Broadband Internet.
    
    The modem acts as a bridge, but also has an internal RFC1918 IP address
    (192.168.100.1).  Simply  nmap'ing the cable user's IP address, ie:
    # nmap -sS -p 1-1024 12.x.x.x
    will cause it to crash, rendering the ethernet interface useless.  It is
    also possible to crash it from the lan by simply doing the same scan
    against the cable modem's internal IP address.  The crash is not
    specific to nmap, there are other publicly available tools which cause
    the same result.  This is known to be effective on Software Version:
    SB4200-0.4.4.0-SCM06-NOSH. (possibly others?)
    
    The only way to restore network connectivity is to physically unplug the
    cable modem for a few seconds, then restore power.  A better solution
    would be to buy your own cable modem, and not rent this useless junk
    from AT&T.
    
    Attempts to notify AT&T about this issue resulted in them wanting to
    send a technician to my house to check my wiring.  Don't even get me
    started on their tech support...
    
    Ryan 
    



    This archive was generated by hypermail 2b30 : Thu Oct 31 2002 - 17:06:42 PST