[meionm]

I didn't know how to properly name this thread so it might be confusing.

I came across this with bunch of people and I can not really comprehend. Basically, there are people selling comcast's hacked modems that allow having comcast internet for free. I am not interest in hacking or having free comcast internet. What I would like to know how is this possible. I always thought that account with comcast would be needed to get service. Anyone came across this?

[nd4spdbh2]

doubtfull.... if im not mistaken the way comcast or any other coax cable company does it, is link the mac address of your modem to your address.... if your addy doesnt have net package you get no net.

[Ben333]

People have flashed custom firmware onto cable modems that allow them to be forced onto your ISP's primary DNS (or something like that) for free service, or to clone the MAC address and serial number of someone else that has service. This will not be discussed here though, will surely result in a deleted thread. Completely illegal to use one of these modems to get free internet, and when using another MAC serious fraud can be committed.

[meionm]

Originally Posted by nd4spdbh2

doubtfull.... if im not mistaken the way comcast or any other coax cable company does it, is link the mac address of your modem to your address.... if your addy doesnt have net package you get no net.

It does work, today I setup wireless router to such connection. The odd part was DNS wireless address had to be changed because it was coming up with comcast setup page but once it was done it worked. Also it does not appear to be as fast as regular comcast internet, speedtest only show 8mb/768kb, though it was an apartment building.

I know about the mac address with comcast but somehow that is bypassed.

[Ben333]

Well, I believe that when a modem with a MAC not in their service list joins, it gets the new customer page - and assumed it was restricted to only seeing comcast's network and dummy DNS. Now... if it's as simple as using another DNS from that point to avoid only seeing the new customer page that would mean no hacks are needed other than manually changing the DNS in windows. Definitely interesting, I would think it can't be that easy. Was this a friend's network you were using and he said he had a "hacked" modem?

[meionm]

Originally Posted by Ben333

People have flashed custom firmware onto cable modems that allow them to be forced onto your ISP's primary DNS (or something like that) for free service, or to clone the MAC address and serial number of someone else that has service. This will not be discussed here though, will surely result in a deleted thread. Completely illegal to use one of these modems to get free internet, and when using another MAC serious fraud can be committed.

So you are saying that they are using copied mac address already in use. Something like multiple people using same social security number? Comcast has bandwidth cap wouldn't excessive number of users exhaust that monthly 250gb bandwidth limit causing paying customer some problems?

[meionm]

Originally Posted by Ben333

Was this a friend's network you were using and he said he had a "hacked" modem?

This wasn't friends network. I went to some guys home to setup wireless network for him. He just didn't know where to put dns numbers in windows. Oh yeah, the guy that setup hacked modem told him about dns numbers.

Hacked modem to computer worked fine.

Hacked modem to router through wire connection worked fine

Hacked modem to router wireless connection didn't work without fixed dns number

[Ben333]

I would think so. Also, two modems of the same MAC address won't work on the same node / head end. (since it shouldn't happen anyway) So as far as I know it, the oldest trick in the book and the one still used today is people using the MAC and serial of someone paying for service in another area. If you only see a new customer page until you change the DNS... perhaps you're allowed on the net but since the MAC isn't local, you get the new customer page only DNS. I had a Surfboard modem running sigma a while ago. It had some settings in it, but I never used to for free internet (nor do I recommend it ). When I moved I said, hey, lets not pay $3 a month for rental so I reset everything and after them trying to send my modem a "health check" they concluded it was my modem's fault and that it needed replacing. I'm guessing they just didn't have access to some admin features on it because of the firmware. Now I'm renting a modem

EDIT: Reply to post #7

Thats strange... unless he already had the DNS settings in his desktop configured. A wireless connection without the router (since you said it works fine wired through the router) might as well just be a switch, so not sure why that would effect it.

[Adragontattoo]

Really?

You are actually discussing this?

A: It is stealing
B:It is against the Forum TOS
C:This thread needs to stop now.

[Ben333]

That was my initial response too. I don't see why this couldn't be discussed as long as it doesn't go into the process of actually installing 3rd party firmware on a modem, or suggesting someone actually do this. Doing this would get you banned from your ISP, and possible jail time or a large fine thats definitely not worth it I would think.

[meionm]

Originally Posted by Adragontattoo

Really?

You are actually discussing this?

A: It is stealing
B:It is against the Forum TOS
C:This thread needs to stop now.

Well, I am not looking for how to but for explanation of how is that possible. I couldn't figure out how could someone go around mac address when it required for internet to be working. So if someone is cloning existing mac address of an existing comcast customer then it might cause them a problem when illegal user downloads illegal content.

Post #8 I didn't check dns for wired network. This might have be preset by the other person.

[Ben333]

I would imagine that it would be terrible for the owner of that MAC. They could even be wrongly accused of possessing something that would ruin their reputation. Also, I don't believe this is traceable at least not down to a specific address making it even more of a problem for the cable company. Another good reason to not make the methods public, yet people have. There are even published books on the topic, not sure how in depth they go though.

[meionm]

Does RIAA/MPAA track down downloaders by MAC address eventually?

[Adragontattoo]

IP not MAC.

IP is assigned by the ISP, MAC can be spoofed.

[Ben333]

I think finding internet criminals goes like this... Find their IP, contact the ISP. "Uhh hey, whos xx.xx.x.x?" then they look and see "Ah, that went to MAC (address), thats assigned to (customer)" More concerning than downloading music though would be things like hacking or child pornography, things that people would want to hide.

[mage_x]

There are a lot of forums specifically for this topic. Google is your friend

The way it works: If your modem MAC address is not provisioned in the ISP's system, then there is a "block" bootfile sent to the modem. The bootfile is what controls how much bandwidth you are given, basically. Custom modem firmwares trick the ISP into thinking the modem is still getting the block bootfile and at the same time let you download whatever bootfile you want from their server or even load it straight into the modem's memory. A different DNS, as you said, is required to bypass their block page. It's different for some ISPs, though. On some, you have to clone someone else's MAC from a different node. It depends on how their provisioning system is set up.

Cloning someones MAC can get that person in trouble, for instance, if the RIAA asks who the IP is for, the ISP can pull the modem up by IP, then pull whatever customer information is attached to that MAC and find the person you cloned. Same thing would happen if you went over any bandwidth limit using their MAC. It would suspend/throttle both of your modems and you would have to clone another MAC. Furthermore, as YOUR information is not actually in the ISP's database, it is a lot harder for them to track you by IP (but still possible).

Originally Posted by Ben333

That was my initial response too. I don't see why this couldn't be discussed as long as it doesn't go into the process of actually installing 3rd party firmware on a modem, or suggesting someone actually do this. Doing this would get you banned from your ISP, and possible jail time or a large fine thats definitely not worth it I would think.

Installing custom firmwares on your own purchased modem is not illegal (using it to steal internet is, obviously). I do not think using it to clone a modem in your own name and at the same residence is illegal, either. It can be used for diagnostic purposes. There is the potential for legit use, just like filesharing lol

[Neuromancer]

When did comcast start tieing MAC to physical address?

It has abeen a couple of years but I used to take my cable modem with me about town, as long as they where I hooked up at had cable and the filter was removed from the line, it worked wherever I went.

Never going to happen here, just like uncapped back in the day, still interesting to read about.

[rainless]

Originally Posted by Adragontattoo

IP not MAC.

IP is assigned by the ISP, MAC can be spoofed.

Wait a second...

...what the hell happened to THIS guy:

Originally Posted by Adragontattoo

Really?

You are actually discussing this?

A: It is stealing
B:It is against the Forum TOS
C:This thread needs to stop now.

Soooo... "This thread needs to stop now".... BUT! "I've still got a thing or two to add..."

[VinnyTAMU]

Sat in on a talk about this very subject at DEFCON 16.

[madman22]

I work for a small ISP. When we get sent a DMCA violation notice, they already have the IP, so we just look in our database to see who has that IP address. We have it specifically setup so we know who has each IP we give out. We always know the location, and usually the persons information.

On the other hand, i can see how things like this might happen. It gets pretty hard making sure everyone who has a connection is paying for it.