Intel-Powered Broadband Modems Highly Vulnerable To DoS Attack (dslreports.com) 59
"It's being reported by users from the DSLReports forum that the Puma 6 Intel cable modem variants are highly susceptible to a very low-bandwidth denial-of-service attack," writes Slashdot reader Idisagree. The Register reports:
Effectively, if there's someone you don't like, and they are one of thousands upon thousands of people using a Puma 6-powered home gateway, and you know their public IP address, you can kick them off the internet, we're told... According to one engineer...the flaw would be "trivial" to exploit in the wild, and would effectively render a targeted box useless for the duration of the attack... "It can be exploited remotely, and there is no way to mitigate the issue."
This is particularly frustrating for Puma 6 modem owners because the boxes are pitched as gigabit broadband gateways: the devices can be potentially choked and knocked out simply by receiving traffic that's a fraction of the bandwidth their owners are paying for... The Puma 6 chipset is used in a number of ISP-branded cable modems, including some Xfinity boxes supplied by Comcast in the US and the latest Virgin Media hubs in the UK.
The original submission also notes there's already a class action lawsuit over the performance of cable modems with Intel's Puma 6 chipset, and adds "It would appear the Atom chip was never going to live up to the task it was designed for."
This is particularly frustrating for Puma 6 modem owners because the boxes are pitched as gigabit broadband gateways: the devices can be potentially choked and knocked out simply by receiving traffic that's a fraction of the bandwidth their owners are paying for... The Puma 6 chipset is used in a number of ISP-branded cable modems, including some Xfinity boxes supplied by Comcast in the US and the latest Virgin Media hubs in the UK.
The original submission also notes there's already a class action lawsuit over the performance of cable modems with Intel's Puma 6 chipset, and adds "It would appear the Atom chip was never going to live up to the task it was designed for."
Re: (Score:2)
Re: (Score:1)
The class action lawsuit is not because the chipset is easily subject to DoS attacks. The lawsuit is because the chipset is unsuitable for the purpose for which it was sold and marketed. Any modem based on the chipset may suffer latency of 200ms or more and lose roughly 6% of all the data that is supposed to pass through it.
The fact that the chipset is subject to a DoS attack that uses a (relatively) trivial amount of bandwidth is just another reason to avoid modems that use it.
Re: (Score:3)
Why not? It's supposed to be reasonable secure against such actions. Would you also consider it unreasonable to sue the makers of a "high security lock" that would unlock if you jiggled the door knob?
Re: (Score:3)
Would you also consider it unreasonable to sue the makers of a "high security lock" that would unlock if you jiggled the door knob?
It works the other way around. There's a guy with a YouTube channel about lock picking who says the Big Name in "secure" padlocks has sued him over some of his videos showing how easy they are to defeat.
Courts are empirically rigged in favor of the corporate interests, against the People, so this isn't terribly surprising.
Re: (Score:2)
That's a great example of why I think a judge should review any lawsuit before the defendant is even bothered with it. It should be shot down immediately.
Re: (Score:2)
Yes. The thing is, the judge would be charged only with voiding lawsuits that could not win on their face. That is, if everything the plaintiff says is assumed to be true, would it win anything? If the answer is no, the suit goes away. That prevents crap like when someone claimed to be God and that David Copperfield was usurping his divine powers in performance of his tricks. The courts have no jurisdiction over divinity, so the suit goes away. Joe Blow wore a red shirt, so I want $1999! Wearing a red shirt
Atom chip? (Score:2)
Given that my Atom server has no problem saturating both gigabit network ports at the same time somehow I doubt the problem is the performance of the Atom chip referenced as being beefed up in the summary and more due to a crappy implementation of Puma 6 itself.
Re:Atom chip? (Score:4, Informative)
It's not the Atom cores, it's the bolted on NAT accelerator with 2048 max entries + 30s timeout for UDP "connections" + firmware too stupid to fall back to software NAT when the hardware table is full.
Re:Atom chip? (Score:5, Interesting)
So you just spoof 2048 UDP packets every 30s and they can't send a single packet? That IS trivial.
Re:Atom chip? (Score:5, Funny)
Re: (Score:2)
Why does a cable modem need a NAT accelerator? It shouldn't be doing NAT to begin with, right? That's the router's job...
NAT in a chip? (Score:2)
Nonetheless, why's that built into the hardware? Given that NAT implementations in IPv4 are NOT standardized, so if something uses a different NATing mechanism, all that silicon is wasted.
Anyway, all the more reason to move to IPv6
Re: (Score:2)
Yeah exactly what I was saying. But the last line in the summary makes it seem like the newer Atoms aren't up to the task. That's just plain incorrect.
Re: (Score:3)
Re: (Score:2)
Yeah my point exactly. The Atom itself as a CPU is just fine, and that link back to a previous post talking about newer versions of Atoms is completely unrelated to whatever it is they botched in this implementation.
Re: (Score:2)
It's not the bandwidth, it's the packets per second.
Re: (Score:2)
The SPS is tied directly to the PPS, thus the PPS is at fault. If you bothered looking at the dozens of test screencaps in the thread, you'd know this.
Re: (Score:2)
Yes, again, if that packet for the same state is not received within a certain timeframe, that entry in the table gets locked up and doesn't clear.
That implies directly packets per second.
A modem is NOT a router! (Score:2)
I take it this stupid article refers to NAT routers, and not cable modems at all.
Anyone with the slightest bit of savvy runs a straight cable modem connected to a completely separate router. And, having suffered with various commodity routers such as Netgear, they all suck donkey balls. Do what I did. Break down and get a real Sonicwall TZ-170 (used/surplus of course).
Re: (Score:2)
Re: A modem is NOT a router! (Score:1)
Re: (Score:2)
"The problem appears to be that the x86 CPU in the modem is taking on too much work while processing network packet"
I have a Puma6 device (Linksys CM6190) in bridge mode with a Ubiquity router/firewall and the test site doesn't trigger any issues with increasing latency. I think most ISPs use a management VLAN on the modem as well, but it doesn't seem like that would trigger issues on the customer side.
Re: (Score:2)
It's not the router, it's the shitty hardware accelerator that can't fail back to software mode when the hardware locks up due to shitty tables.
Re: (Score:2)
"Running the same test in Bridge mode thru an RT-AC68U, all of the cached results are 100% Reliable, so, no packet loss, which is a definite improvement. Only one uncached result had a low score, at 97.9 %, so thats not too bad." [http://www.dslreports.com/forum/r31135629-Modem-Router-Rogers-CODA-4582-modem-now-available-Puma-7-Chipset]
What tables are used, or packet processing is done in bridge mode?
Re: (Score:2)
"Puma-7"
Considering we're talking about Puma-6 here, not a fucking Puma-7...
You're obviously not reading the right fucking thing.
Here's a REAL LINK for you - https://www.dslreports.com/for... [dslreports.com]
The one you should've fucking clicked on in the goddamned summary.
Re: (Score:2)
"What tables are used, or packet processing is done in bridge mode"
When a bridge receives an IP packet, the gateway processes the packet as follows:
The destination MAC address is looked up in the bridge's forwarding table.
If the destination MAC address is found in the forwarding table, the packet is forwarded to the corresponding port.
If the destination MAC address is not found in the forwarding table, the destination IP address is searched for in all the defined bridge IP address ranges.
If the destination
Re: (Score:2)
Whew. (Score:4, Funny)
Got scared there for a second then I remembered we can't get gigabit here.
Re: (Score:3, Informative)
Puma 6 chipset has been used in modems/gateways since 2012. Here is a partial list of potentially impacted products:
Arris SB6190
Arris TG1672G
Arris TM1602
Super Hub 3 (Arris TG2492LG) (commonly - virgin media)
Hitron CGN3 / CDA / CGNV series modems:
Hitron CDA-32372
Hitron CDE-32372
Hitron CDA3-35
Hitron CGNV4
Hitron CGNM-3552 (commonly - Rogers)
Hitron CGN3 (eg CGN3-ACSMR) 2013 link
Hitron CGNM-2250 (commonly - Shaw)
Linksys CM3024
Linksys CM3016
TP-Link CR7000
Netgear AC1750 C6300 AC1900
Netgear CM700
Telstra Gateway
Potentially *MUCH* worse (Score:4, Informative)
There is apparently a packet spray pattern that causes the CableModem (CM) portion of the Puma 6 to reboot. (likely segfault) The CM on a puma 6 is run by an ARM Cpu (not the x86 atom), the problem is with broken hardware optimization -- specifically the overflow handling on a fairly small table (2032 entry) likely built of CAM (content addressable memory) intended to accelerate external/internal mappings. That table has entries inserted when any packet arrives with a new address. Spew enough packets from enough different addresses and the table overflows -- that overflow requires (slow) processing to handle.
Disabling the accelerator caps bandwidth to ~60Mbps, and the DoS attack is mitigated.
But the fact that there is a pattern of (external) packets that *crashes* the CM indicates a potential vulnerability in the CM firmware that would allow a complete takeover of the CM OS.
That would be a global disaster.
One proposed mitigation is to use software mapping for packets from external sources and only add mappings to that small table for packets from the LAN side (not the WAN). This would probably have minimal impact for most -- capping speeds to 60Mbps on connections until a packet originating from the LAN side of things has gone through the device.
But a hostile (and clever enough) hacker may still be able to trick the device into crashing and exposing it to takeover if they can run software on both sides of the device (LAN and WAN) attacking it from both simultaneously.
The Puma 6 is a bit of a debacle -- it may very well have to be recalled.
Re: (Score:2)
Re: (Score:3)
NO This has *Nothing* to do with the gateway capabilities and everything to do with the Cable Modem part of Puma 6. I have been able to hang my Hitron CDA-3 modem (no router/gateway or WiFi in it) by spraying it. Haven't found the magic reboot pattern, but its early yet.
Re: (Score:2)
How is this table implemented? I don't know. If it is (as I suspect) CAM, it is likely hardwired (in an ASIC) for speed -- that's why you use CAM.
If the mitigation strategy I mentioned above (or some other) is not feasible, it does not look good. In any event, because the firmware on these Modems (even when owned by the end user) are not under customer control (they can only be updated by the cable provider), it's very likely that the majority of these devices will never have their firmware updated, even if