10

How does Comcast know my WiFi password? I generated it via KeePass and entered it into my Arris router/cable modem myself, and I bought the router used from a friend. When I went to the account web page, it showed me my password. I changed the password and it instantly showed the new password on the account web page (after refresh).

https://customer.xfinity.com/#/settings/security

enter image description here

  • Model:TG862G
  • Hardware Revision: 5
  • eMTA & DOCSIS Software Version: 9.1.103M2AM.SIP.PC20.CT
  • Packet Cable:2.0

I did not install any "Comcast package" or software or wizard setup program.

||improve this question
  • have you installed any software, at all, from comcast on the computer, or any computer on the network? – dandavis Apr 23 '19 at 18:34
  • 2
    See en.wikipedia.org/wiki/… – forest Apr 23 '19 at 20:38
  • I've raised an issue in the NANOG mailing list. Let's see how it goes. – ximaera Apr 23 '19 at 23:48
11

The PSK passphrase is (by design) stored in a retrievable format by the Modem vendor, in this case Arris, but the same standard is supported by many other modem vendors. In DOCSIS cable modems this is most commonly done via SNMP against this specific OID:

clabWIFIAccessPointSecurityKeyPassphrase    OBJECT-TYPE
    SYNTAX      SnmpAdminString (SIZE(0..63))  
    MAX-ACCESS  read-create
    STATUS      current
    DESCRIPTION
        "This object is defined in TR-181 Device.WiFi.AccessPoint{i}.Security.KeyPassphrase."
    REFERENCE
        "TR-181 Device Data Model for TR-069."
    ::= {clabWIFIAccessPointSecurityEntry 5

This is part of the CableLabs WiFi MIB, which is is in turn based on the TR-069 sub-standard of TR-181.

Not only does this apply to cable modems, but many DSL and FTTH endpoints will also allow the service provider to retrieve your PSK passphrases and a litany of other settings.

This allows for end users to have their settings backed up in case of a device having to be replaced or much more commonly for call centers to be able to retrieve some of the settings, like the pass phrase, when a customer calls in because they can't remember it.

||improve this answer
  • Hmm... the section of TR-069 you linked says for Device.WiFi.AccessPoint.{i}.Security.KeyPassphrase: "When read, this parameter returns an empty string, regardless of the actual value." Wouldn't that mean Comcast shouldn't be able to retrieve the user's password via this method? – Ajedi32 Apr 24 '19 at 13:27
  • 3
    It does, but I the SNMP string is READ-WRITE and does not return an empty string provided you have the valid READ string. I can also say that many TR-069 devices also allow for the recovery of the passphrase despite what the TR-181 spec says. – Scott Helms Apr 24 '19 at 13:45
  • This is what the actual snmpwalk output looks like (with the private information excluded) snmpwalk -v 2c -c SNMP_READ_STRING IP_ADDRESS CLAB-WIFI-MIB::clabWIFIAccessPointSecurityKeyPassphrase CLAB-WIFI-MIB::clabWIFIAccessPointSecurityKeyPassphrase.10001 = STRING: passphrase_here CLAB-WIFI-MIB::clabWIFIAccessPointSecurityKeyPassphrase.10002 = STRING: passphrase_here CLAB-WIFI-MIB::clabWIFIAccessPointSecurityKeyPassphrase.10003 = STRING: passphrase_here – Scott Helms Apr 24 '19 at 14:19
2

I believe Arris routers store passwords in plain text (or some reversible encoding). Therefore your ISP just has to read the file where this is stored on your modem.

https://blog.korelogic.com/blog/2016/02/12

||improve this answer
  • 1
    how does comcast reach that file from a webpage on their domain? – dandavis Apr 23 '19 at 18:33
  • I don't know, perhaps you gave comcast access at some point for provisioning/management? – DarkMatter Apr 23 '19 at 18:41
  • They likely automatically index such things into a central store on their end, and then provide it back to you through your account interface. Bear in mind a yuuuuge part of their business model is helping people who can't remember their own passwords. – gowenfawr Apr 23 '19 at 20:18
  • 2
    @dandavis Not over the domain, but over the modem using a protocol called CWMP. – forest Apr 24 '19 at 5:57
2

Are you sure that what you are viewing is actually hosted remotely? Some routers will redirect a certain webpage to an internally hosted page, essentially hijacking the connection. They do this because it's easier to remember to connect to customer.xfinity.com than it is to remember that you need to type 192.168.1.1 into your browser. If this is the case, Comcast does not actually know your password.

You can test if this is the case by visiting this page from another system that is not behind your Comcast router. If the network name and password are not displayed even after logging in, then you will know that it was only your router redirecting to an internal page. If it does show this information despite you not being on your own router, you will know that Comcast does in fact know your plaintext password. In your particular case, it's unlikely that the router is redirecting you because the site you have visited is showing HTTPS, which provides encryption that makes such redirections infeasible.

If Comcast does know your password, then it is because the router is transmitting it to them, most likely by using CWMP, a remote management protocol from TR-069. This is supported and usually enabled by default on vendor-supplied modems and can allow an ISP to retrieve data from the router, like the key.

||improve this answer
  • 2
    Since the OP indicated that the page they were viewing was accessed over HTTPS (https://customer.xfinity.com/#/settings/security), a redirect doesn't seem likely. – Ajedi32 Apr 23 '19 at 21:03
  • @Ajedi32 That's a good point. I'll incorporate that into my answer. – forest Apr 23 '19 at 23:29
2

Comcast can retrieve the wi-fi password from their wireless gateways because they use custom firmware. The TG862G happens to be a model that was used by Comcast but ALSO sold at retail. There's no way to differentiate the retail from the Comcast branded when it comes pushing the firmware, so it runs the Comcast firmware just like their leased gateways. Thus, they can read the wi-fi password just as if it had been a leased TG862G.

||improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.