Cable Modem Security

My wife & I recently moved into a new apartment complex. The company that owns it offers, among other services, cable modem Internet access. Since our dial-up service was giving us way too many dropouts, and the slowest version (128K) of the cable modem service is only twenty bucks a month, we decided to get it.

So far, it has been working fine. However, I noticed that when the apartment employees were helping us get set up they mentioned absolutely *nothing* about security. There was not a word about the added exposure associated with "always on" systems like cable modems. I have McAfee's anti-virus & firewall running (Home Edition of each), but we all know that such software-based setups are not necessarily the best. I'm considering a hardware firewall, but I don't know very much about how to find the best value.

Here's my request: since my provider seems to be both clueless & apathetic, maybe someone with a bit more experience than me would care to build a fire under their tail. One of you hackers out there should be able to run a script or something for a simulated attack that would find some of the security holes that doubtless exist here. I could then pass the info along to the appropriate people and get some discussion going. If you work for a company that deals in cyber-security, this might be a way for you to drum up some business.

The company that owns this apartment complex has their web site at:

http://www.lindseycom.com

The snail address of the local apartment management:

The Greens
3126A E Valley Water Mill Road
Springfield MO 65803

This should be enough info to give any decent hacker a start.

If anyone out there wants to contact me privately, here's my email address: [email protected]

Thanks.

Joel

well learning abt security is surely nice and necessary................
though i dont know abt cable modems so someone else would help you out....
but i have a few suggestions to point out...........
first of all never make ur email id public like this...............its a bad idea....it invites spam.........
never never give out ur address like this.........it may let u in troble.............
if someone would like to contact you then AO has the facility called PM(private Message) which is better...
so u could instead say pls PM me if you want to...........
i hope next time you will keep this in mind.........

Honestly i cannot hack your cable modem but I have a suggestion for you. I recently purchased cable modem for myself and i was worried about security too. One of the things that you can do is buy a router that comes with a firewall. The router will have a different IP address that way you're hiding yours. If a person hacks you, all they're going to get is the router and not your personal files. Also, make sure that you change the password on the router as most hackers WILL try to guess the default password that comes with it and they WILL get it. Good Luck and enjoy the fast internet :)

Quote:

---

The router will have a different IP address that way you're hiding yours. If a person hacks you, all they're going to get is the router and not your personal files.

---

How exactly is this going to happen? The router should have the same ip address that you normally have, it just tranlates it to a different one (usually non-routable) and forwards the traffic to the correct box behind it. Not to mention if someone is good enough to get into your router I doubt they are going to have much of a problem looking at the router's logs and seeing what machines have been assigned what ips, and wham, they are right where you think they couldn't go.
Listen, asking others to hack something for you (even if you don't want any damage done) is often considered bad form. If you already know that the security is poor, and you bring this to their attention, and they don't do anything about it, then so be it. Learn how to and then protect yourself. Don't rely on them, even if they were good at it. It really is your responsibility anyway.
Good luck

You say that they didn't tell you about the added security you may need. Well if you go to a car dealership and buy a sportscar are they supposed to tell you that there are more chances of you getting into a car accident? This is just the way I see it. You can always say "they didn't tell me" but in the end if something does happen it will be your info and your system that gets hacked. You really shouldn't point the finger at them. Remember when you point a finger at someone there are 3 pointing back at you. So install anti virus software and firewall keep them both up to date with all the current patches and do the same for the OS and it will give you a good start in protecting your pc.

In your Macfee firewall, open it up and do the security test. Thats actually a nice little feature built in. Also if you have a 486 or so laying around the house you now have more options as you can install a version of Linux or BSD to act as a firewall or router. Also, cable is actually safer than what people lead you to believe. My connection is quick as hell and i can download at 2.2 MBs a second depending on the server im downloading from. I havnt had a prob yet.

Just keep everything up to date and dont let the hacker penis of uptime get in the way of installing a patch and you should be fine. Also search around and read up on hacking. After you start to understand it, you will prolly start figuring things out and then have a new understanding of security in general.

Am I the only one who noticed this, or is everyone else just ignoring it

Quote:

---

One of you hackers out there should be able to run a script or something for a simulated attack that would find some of the security holes that doubtless exist here.

---

Yea, I'm just going to go right out, hack their DOCSIS modem, then go after thier box to build up my business, then go to jail.

Doesn't ANYONE read the FAQs ??

It's not necessary for someone to attempt a "hack," to find your security holes. Run a program like Retina for XP or Nessus for Linux. If you don't have/can't understand those, visit Shield's up to assess the vulnerability of your system. This way, it's legal, and there are logs to present to your apartment managers that describe the holes in detail.

Corn

Asking us to hack something is illegal and would land us in trouble if the building management did something once you submitted the info to them.

Although the management could have improved the security on their network it is ultimately your job to protect your own information. Even when you are in the office if information is taken from your machine, even though it should be the IT dept job to secure the infomation. The information stolen is yours and if its that important to you then you should be securing it yourself or getting help to secure it.

A couple of tips for you to help you along the way.... Get anti virus software and keep the definitions up to date, firewall and get the latest patches and also keep your OS patched to prevent people from using whatever flaws are in the system to get your information. Use difficult to guess passwords that are not all alphas. Change them regularly. If u want to you could get a router with NAT but this will only block out the script kiddies that your firewall will definitely block if u have configured it correctly. And finally after all this is done run a security scan on your system to check for any vulnerabilities and look for solutions to patch those vulnerabilities.

There is a lot of information out there on how to secure your system and stuff like that and reading up on this will help. If you have any others questions, the people at this website will be glad to help out with providing info or links to where u can read up on it but we wont hack into any systems for anyone.

The router that I was refering too Masks my IP address and shows something totally different over the net. Sorry i wasnt very specific.

JK999,

Go to www.sofaware.com

Buy a Checkpoint Sofaware Box about $199 plug it in front of your pc....then carry on as usual

Seriously tho..Sofaware.... they're great boxes and have a few spare ports (incase you get a laptop or a playstation or an Xbox or something in the future)

A doddle to install and easily managable - even by a non technically minded person.

Cheers
v$d$

r8devil is right.

Unfortunately the only thing you can do is to protect yourself. If you try to bring it up to management, you've done your job. They would have to request an "evaluation."

Your concern is commendable, but you're just learning what some of us have known for a while: how apathetic some companies, management teams, and others can be when it comes to security. You have taken the correct pill, and now you are seeing the seedy truth.

g'day!

Here's one for all of you then,

WHY is it that we all bitch, moan and accuse our ISP's of being 'apathetic' & Seedy?

ISP Means 'Internet Service Provider'
The definition of which is to provide Internet Connectivity to the end user.

There's no mention of security in its name at all, Why do we all assume its our ISP's duty to provide us with a secure connection? Afterall they are a profit hungry business they dont wanna spend upwards of £13,000 ($21,000) on an Unlimited Firewall license.. thats not including the hardware and man power & training needed to run it.

TV and Radio providers arent secure, Nor is any Telephone provider.If you want a secure radio channel YOU THE USER has to buy an encrypted transmitter / reciever one for each end. If you want an encrypted phone line YOU THE USER has to purchase a point to point encryption system. Why should the Internet be any different?

And if the Internet was so brilliantly secure we wouldn't all be here now reading this would we?

Sh1t someone give me the red pill ... I wanna go back to never never land. :cool:

This is not directed at anyone but I really would like to hear a justification from someone as to why our ISP's should protect us.

Cheers
V$D$
:confused:

Thanks for all the responses.

Two specific sub-topics I want to address. . . .

>Yeah, I'm just going to go right out,
>hack their DOCSIS modem,
>then go after their box to build up my business,
>then go to jail.

Clearly, the poster of the above grossly misinterpreted my term "simulated attack," especially the "simulated" part. Perhaps "probe" might have been a better term for me to use. I had in mind the sort of action in which a lot of stuff is sent against the system from the outside--stuff similar to what a real attacker would use--but the folks inside the system probably won't even notice that anything is going on unless they are the techies whose job is to keep track of such things. I'm not sure if my ISP even has such people, or how well they do their jobs. If a properly designed probe revealed some serious weaknesses, and I were given a summary, I could (as I mentioned in my initial post) talk to the right people about those weaknesses.

Which brings me to another quote:

>How apathetic some companies, management teams,
>and others can be when it comes to security.

This remark, and related statements about how the protection of my personal home system is mainly my responsibility, are basically sound. In fact, I think that Lindsey Communications (the ISP involved here) should be discussing this very fact with each person who subscribes to their cable modem service. We should know exactly what the ISP is responsible for and what is out of their hands security-wise. The contract that we signed doesn't really cover anything significantly related to security.

Anway, thanks again for the help.

JK: The reason that ISP's and management companies do not provide security is really rather simple..... They can't without inconveniencing their customer base and costing them a small fortune which, in turn will have to be passed on to the customer base in the form of higher costs, (they are not a charitable institution but rather another "Joe" trying to eek out a living in a pretty cut-throat environment). The inconvenience and/or higher cost will drive their customer's away thus they go out of business.

To explain: Imagine I am the ISP and I decide that I will properly firewall my network to protect my customers. Initally, it would appear to be a low cost service to me and the expense I pass on to you would be minimal. But this isn't the case. You see, to _properly_ protect you I have to block all ingress and a lot of egress. For example I know that one of the favorite ports for malicious activity would be 31337. I would block that both inbound and outbound. But let's say you are a security type and work from home and want to scan your work systems, (or one of your customer's systems), for a Trojan hiding on that port. Well... You can't because my firewall is stopping you. So you are going to call me to get it fixed - you just raised my support expense because while my tech is talking to you he isn't talking to someone else. But it gets worse...... In order to help you I need someone in place that has a thorough understanding of firewalls and is trained to manage the firewall. Now you really put up my costs because instead of the $10/hour tech I could have got away with I now need a $30/hr tech. The real problem there is that my $30 tech will spend 99% of his time doing $10 work..... That's a huge waste of skill and a huge cost that I need to pass on to you.

That's a bit of an extreme example but think about all those people that want access to their computers from work through PCAnywhere etc. All those people that play online games that require a port switch after the initial connection to be able to play. Before you know it I have so many holes in the firewall that it might as well not be there - and for my additional cost for no effective service it simply wouldn't be there - it doesn't benefit either of us.

So, security is, plain and simple, a personal thing. What I want blocked will probably not suit you and what you want blocked would almost certainly not suit me. Therefore, since there is no consensus there can be no, cost effective, solution.

You seem to be an educated person, so I won't needlessly insult you with profanities, but I will not be as understanding and diplomatic as Tiger Shark.

Anyone here can “probe” ports, that is not illegal. And yes, almost all here could probably do it without the ISP realizing it. But what you ask,

Quote:

---

stuff similar to what a real attacker would use

---

is what this site is all about, to LEARN what hackers would use and protect against it, but actually using it the way you request using it would not be legal.

There is much debate in your ( and my ) Congress, as is in many countries and the security field in general, on who is responsible for Internet security. I agree that the ISPs should be held to a greater standard then they are now, ( and the manufactures of programs and hardware, such as wireless networks, etc. ... don't even get me started on that! ) should have as the bottom line security and the users' right to be secure as their top priority. But the bottom line right now is that it is the USERS responsibility to ensure that their systems are secure, NOT the ISP's. ( there is too much money in the way they are doing it now, and not enough political pressure. )

I recommend to everyone that they, at the very least keep their Operating System up-to-date with current security patches, have up-to-date anti-virus programs running, and have a firewall installed and properly set up. If you don't, you are not only asking for trouble, you are inviting it, and you are a bane to society and should be disconnected and banned from the Internet. ( that includes CIOs who don't follow those rules!)

Quote:

---

.. I think that Lindsey Communications (the ISP involved here) should be discussing this very fact with each person who subscribes to their cable modem service.

---

I think maybe you should provide us with more info if you truly want help. I can find NO reference to “Lindsey Communications” but “lindseycom.com” is hosted by Comcast Cable, but there are numerous cable providers for your state. Which is possibly your cable provider?? Check out their terms of service!

Now, as to your arrogance. I hold to the firm belief that anyone more arrogant then me is an *******. ( you can quote me on that! ) You are, in my opinion definitely more arrogant then me!! To think someone who, as a new member, who never posted before, subscribing with a “throw-away” e-mail account such as a yahoo account instead of the account which your ISP ( in this case the cable provider ) provided you with, would come to a community such as this and try to entice and solicit members to commit illegal acts by daring them with statements such as

Quote:

---

... this should be enough info to give any decent hacker a start

---

and

Quote:

---

this might be a way for you to drum up some business

---

justifies my opinions.

Mr. Educated, go back to ****ing school!
( I did say needlessly )

I'm kidding with this, but just to prove a small point to our thread starter, if it was anything else other than a security related post, it would sound like...:

My friend & I recently moved into a new apartment complex. The company that owns it offers, among other services, security patrols. Since our old beater car was giving us way too many backfires, and the slowest version (12mph) of the engine speed is only two RPMs. We decided to buy a new 'always on' ;) car, a faster car that could 'download' faster! :D

So far, it has been working fine. However, I noticed that when the apartment employees were helping us get set up they mentioned absolutely *nothing* about security. There was not a word about the added exposure and risk associated with "really fast" cars like race cars. I have a car alarm <<insert vendor name here>> running, but we all know that such car-based setups are not necessarily the best. I'm considering a hardware car alarm, but I don't know very much about how to find the best value.

Here's my request: since my apartment patrol provider seems to be both clueless & apathetic about the specs of my race cars engine, maybe someone with a bit more experience than me would care to build a fire under their tail. One of you theives out there should be able to run and hit a car or something for a simulated attack that would find some of the security problems that doubtless exist here. I could then pass the info along to the appropriate people and get some discussion going. If you work for a company that deals in Grand Theft Auto, this might be a way for you to drum up some business.

The company that owns this apartment complex has their web site at:

http://www.we-only-do-our-jobs.com

The snail address of the local apartment management:

Jim Bob
12345 Fake Street
Someplace snazy
This should be enough info to give any decent car theif a start.

If anyone out there wants to contact me privately, here's my email address:

[email protected]

Thanks.

<<insert someones name here>>

Yeah, ^^^ does that sound smart to you? Um, no. Go to the book store, and READ! (Hey, you don't even have to buy the books! You could get a 'shoplifter' to 'simulate' an attack, and maybe get it for free, and teach them bookstores a lesson for doing business!)

Yeah, um, no. Plz read the faqs next time....

Dave

Quote:

---

Originally posted here by dstevens1958
I'm kidding with this, but just to prove a small point to our thread starter, if it was anything else other than a security related post, it would sound like...:

My friend & I recently moved into a new apartment complex. The company that owns it offers, among other services, security patrols. Since our old beater car was giving us way too many backfires, and the slowest version (12mph) of the engine speed is only two RPMs. We decided to buy a new 'always on' ;) car, a faster car that could 'download' faster! :D

So far, it has been working fine. However, I noticed that when the apartment employees were helping us get set up they mentioned absolutely *nothing* about security. There was not a word about the added exposure and risk associated with "really fast" cars like race cars. I have a car alarm <<insert vendor name here>> running, but we all know that such car-based setups are not necessarily the best. I'm considering a hardware car alarm, but I don't know very much about how to find the best value.

Here's my request: since my apartment patrol provider seems to be both clueless & apathetic about the specs of my race cars engine, maybe someone with a bit more experience than me would care to build a fire under their tail. One of you theives out there should be able to run and hit a car or something for a simulated attack that would find some of the security problems that doubtless exist here. I could then pass the info along to the appropriate people and get some discussion going. If you work for a company that deals in Grand Theft Auto, this might be a way for you to drum up some business.

The company that owns this apartment complex has their web site at:

http://www.we-only-do-our-jobs.com

The snail address of the local apartment management:

Jim Bob
12345 Fake Street
Someplace snazy
This should be enough info to give any decent car theif a start.

If anyone out there wants to contact me privately, here's my email address:

[email protected]

Thanks.

<<insert someones name here>>

Yeah, ^^^ does that sound smart to you? Um, no. Go to the book store, and READ! (Hey, you don't even have to buy the books! You could get a 'shoplifter' to 'simulate' an attack, and maybe get it for free, and teach them bookstores a lesson for doing business!)

Yeah, um, no. Plz read the faqs next time....

Dave

---

for the best car safety:

Download AK_47 V 3.0

And then shoot anyone that walks near your car. While your at it, kill the guy that sold you it. All car dealers **** you in the ass anyway so he had it coming. then grab his money. After this you should have no problem with anyone trying to steal your car. If you do, **** em, AK pings can go threw police body firewalls and even the hardware "door" model.