2

Are there any methods/tests to check if cable modem is secure, has no security holes (for example from trying to update firmware and not knowing what user is doing) and is properly working?

Speed and working seem to be completely okay, just asking to know if there are extra methods to see if everything is fine.

I'm in the process of trying to learn more about network security as until now I only paid attention to anti virus and firewalls inside of my computer. I have no idea if modems could be compromised (giving malicious side ability to hack into computer, spy on user, control what they see or go to in Internet - like directing to malicious sites or stealing passwords) or not as they are kind of primitive boxes. :D

  • 2
    All consumer-grade routers are garbage, especially those provided by ISPs. I suggest you reset it, put it in bridge mode and put a proper router behind it (Ubiquiti EdgeRouters are my personal favorite, but any business-grade router from a reputable vendor will do). – André Borie Jan 10 '17 at 12:51
  • @AndréBorie that won't do much when the cable modem gets compromised by malware and starts intercepting all unencrypted traffic. – Philipp Jan 10 '17 at 12:53
  • 1
    Initially you could search the CVE database (cve.mitre.org/cve/cve.html) and see if any vulnerabilities relate to your device. if you login into the management page n your router you should be able to easily discover the firmware version. – iainpb Jan 10 '17 at 12:53
  • @ian yet you already implicitly trust the validity of that "management page"? anyhow are we talking Modem or router? – humanityANDpeace Jan 10 '17 at 12:55
  • 3
    For a coax CABLE-based MOdulator/DEModulator itself, there's nothing a regular user can do to inspect the traffic out of the modem, and there's no settings to adjust on an actual modem. Given that, the OP's answer's "no". – dandavis Jan 10 '17 at 16:51
1

Here is one way to gain a measure of confidence:

  • Visit Steve Gibson's web site, www.grc.com

  • Click on Shields-Up

  • Click on the button which will make it test "All common ports"

This will allow you to see how your cable modem responds to outside scans. The ideal is for all your common ports to be green, indicating that it simply did not respond to the probes. On the site that is called "stealth" - which means that unless you reach out via web browser or an email program, your system will not betray its own existence.

One of the biggest violators of this kind of stealth is the new style of baby monitors or other devices which are accessible from outside your home by smartphone. Those, by design, open up incoming ports and are detectable from outside.

Another thing to consider is how your cable modem is configured. At the very least, log in to the control panel and change your login password for the modem, unless it is a password that it printed on a label on the bottom of the modem (which means a random password was issued by the manufacturer). Also, find the setting for uPnP and shut it off so nothing inside your perimeter is allowed to open ports which allow inbound connections.

  • 1
    I've never seen a modem than has a web interface, is that common and i'm ignorant (very possible), or are you talking about routers, which is typically where uPnP settings are adjusted? afaik, the modem should be passing any and all traffic without audit to the router.. – dandavis Jan 10 '17 at 15:17
  • 1
    If you have just a raw cable modem, (YIKES), then there will be no interface. But those are getting pretty rare so I assumed you meant a modern one. --> If you are out "in the wild" with just a raw modem, then that is a double reason to get over to grc.com and see how vulnerable your PC is to scanning. (Also, good NAT routers (I use Fascam) are not very expensive) – SDsolar Jan 10 '17 at 18:17
  • 1
    i got my name-brand modem last year and there's no interface. i don't know if it's raw or cooked, but my router is in charge of security management anyway. – dandavis Jan 10 '17 at 18:25
  • 1
    Can you tell which 3 are blue? They are numbered. One of them is Windows IDENT (113). In any case, you are detectable. If someone scans your address range they will know there is a computer there. That is not necessarily bad as long as you keep up with updates and have a decent password. If you can't tell which other two are, we could take this out of SE (via email) and I could run a quick nmap scan and send you the results. – SDsolar Jan 10 '17 at 23:17
  • 1
    I wrote the earlier comment wrong. I think it is 135 that is IDENT. 445 has to do with sharing hard drives, though. Nothing to panic about but you might want to check and see which of your drives are set to be shared.. You are detectable, but most of your ports are closed. That is a good thing. If you just keep Windows Defender running you are about as protected as a consumer-level system can be. Even with a share open, nobody can get in without your password. – SDsolar Jan 11 '17 at 4:51
1

Obviously there is no way to completely check "if [your] cable modem is secure and safe?", because you most cannot look into the firmware and internals of the IC (integrated circuit, aka microchips), hence have no way of making sure agains hardware-based backdoors.

That being said, there are still actions you might be able to take to reduce the uncertainty about the "safety" of your device. It would for instance be possible to log the a certain amount of traffic transported/conveyed by your device and search that traffic for manipulations. Clearly this would most likely involve other devices, you already trust, being capable of such a logging activity.

Update Provided the comment by dandavis, the principle procedure laid out in the preceeding paragraph seems (for a lack of available testing/logging device on the out-bout side ot the cable Modem) unpractical. Therefore, and with respect to the previously stated likewise impracticality to look directly into the Modems circuitry itself, one can say that *for all practical purposes it is at best very hard, *and mostly impossible to "check if [a] cable modem is secure and safe".

"safe"/"secure" are attributes, which of course comprise more than merely not malicously manipulating traffic, as for instance you would like to have the modem not disturbing the other parts of the system linked/attached to that hardware device, something I can sadly not advice you much to.

Besides there will be imho always a struggle with being certain that the device is "safe/secure", as for instance this is not a permanent attribute, but will change over time, I would recommend to tackle the problem by not assuming too much safety/security of that modem, and instead make sure that any harm it may cause is safeguarded against. i.e. use cryptography (tls/ssl, etc.) to protect any data being "touched" by that device.

  • how does one log activity on the out-facing (cable jack) side of the modem? – dandavis Jan 10 '17 at 14:27
  • @dandavis I wish I could provide an answer here, but I reckon that there is no easy one, as it is as you hint, not very common to monitor the out-facing side, or at least I am yet to become aware of such devices, which surely are then quite specific to the techonologies that the modem employs. – humanityANDpeace Jan 10 '17 at 16:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.