3

I am running pfSense on an edge firewall conncted to a cable line. I can see many DHCP requests hitting my firewall. I guess this requests are getting send by cable modems currently booting up and looking for the ISPs DHCP server, which later on hands out DNS server and TFTP options, so the modem knows on what parameters to run on and where the GW is.

I started wondering: What if someone set's up a WAN facing DHCP server and answers those requests? That bogus DHCP server could offer a DNS server/GW IP address which is equal to its own and intercept/re-route all traffic.

I know that my ISP uses DOCSIS version 3, which offers forms of authentication and encryption. However I am not aware of the implication to the IP assignement and cable modem setup procedure.

Is such a scenario possible? If yes, how can I protect myself from it? This MITM would be hard to detect.

|improve this question
  • Anyone any input? – Matze Dec 2 '14 at 12:27
  • You could try manually setting you modem's ip and gateway. I could see this attack working if the attacker dos'ed the gateway then setup his own dhcp. This is not something you should have to be worried about your ISP should monitor their connections. Sadly in my experience most ISP's don't monitor there connections close enough. – Tim Jonas Jan 19 '15 at 15:19
  • You should first make sure you can reach the other modems, sometimes transmitting and receiving is done on other channels (RF channels I mean, DOCSIS is just wireless over cable) or VLANs and it's possible that while you can listen to what the other modem says, it can't do the same for you and so you won't be able to reply to it with the correct DHCP packet. Just try pinging its internal IP and see if it replies. – user42178 Jan 20 '15 at 7:56
2

This (old) talk gives a lot of background information about DOCSIS, how the protocol works and discusses weaknesses in the cable company implementations:

https://www.youtube.com/watch?v=BBtdZDah6iE

The DOCSIS spec is reasonably readable and available online. The presentation is helpful at getting a high level understanding of how it works and how it doesn't.

Hopefully somebody can provide a more complete answer.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.