FEATURE STORY
Cracking Cable Modem Hacking

In last month's Pipeline, we reported that Matthew Hallacy, a 21-year-old network programmer and a cable modem sub, posted a "hacking" ruse on the Web that involved modifying a configuration file to control settings on a DOCSIS modem. A savvy programmer, Hallacy detailed how to get a DOCSIS modem to reveal the config file. Additionally, he explained how to change the file's binary data with the use of an open-source software program.

"What Mr. Hallacy did isn't hacking," Motorola (http://www.gi.com) BCS Educational Services' Allan Konar maintains. "It's exploiting poor implementation."

Cable technologies come from a tradition that is "more cowboy than scientist," Konar continues. "With the merging of RF and IP that we're seeing now, and the consequent scaling of services, we as an industry must start looking at best practices, and not just rollout of services."

Last week, Pipeline received more takes on the topic from DOCSIS guru Mark Millet of Cisco (http://www.cisco.com) and Certainty Solutions' (http://www.certaintysolutions.com) Zonker Harris. Their letters follow. If you'd like to weigh in, e-mail . Also, don't miss the new topic for discussion in this week's "Broadband Soapbox." (Scroll down or click on the link above.)

The Shared Secret Is Not Stored in the Config File -- "In 1998, cable operators were testing modems and CMTS units from various vendors, and discovered that various combinations were not working. It turned out to be issues related to a DOCSIS 1.0 security feature, known as 'shared secret.'

"Some CMTS units and some configuration tools used different default values for this parameter. Some vendors used their name. Others used the word, 'DOCSIS,' or the older term, 'MCNS.' If the DOCSIS config file and the CMTS value didn't match, the modem is rejected, and cannot come online. Operators found this process confusing, and frustrating, so the CMTS equipment vendors designed methods to permit 'any config file, with any shared secret value' to connect. This new 'insecure' method was so convenient, and had been proven reliable in lab testing, that large operators deployed in this manner. It was just kind of a momentum thing. In about 45 days, the operator community figured out it was time to enable shared secret.

"Please note, and make this part clear: The shared secret is not 'stored' in the DOCSIS config file. Instead, the DOCSIS config file is combined with the shared secret string, and a new value is created. That new value is called the MD-5 hash of the DOCSIS config file, and the shared secret, and is not reversible. Once the CMTS is configured to match the config file, and the MD-5 hash, the entire issue this particular customer describes goes away. A Day 1 security feature, people found it confusing and inconvenient. -- Mark Millet, Technical Marketing Engineering, Cisco Systems

"The violation involves DOCSIS features, which many MSOs could do a better job securing. There are DOCSIS features than can be better secured on the CMTS, and there are network features and architecture that can also help prevent the hacking problems. (Cisco gear has had these features for a couple of years now, so the technology to protect the systems is just not being used.)

"At the SCTE (Golden Gate Chapter) Vendors' Day, Cisco put on a great talk about the problem, with a very descriptive name: 'Stopping Cable Modem Hackers.' The show was in Concord, CA, home to AT&T Broadband, and less than 12 people attended this session out of 600+ attendees. Less than three folks were working in a role that could affect the changes to the CMTS, and none worked in a provisioning role, or thought they could affect their provisioning process, to help stop the hackers.

"IP networking is the backbone for cable-based high-speed data services, VOD and VoIP, but it seems that most MSOs are not using the services of top-notch network design and network security folks. (AT&T Managed Internet Services seems to have good staff, but ATTBI seems to have been unable to borrow some of that talent, or even consult with them, based on the traffic I monitor coming from my cable modem at home.

"Classic MSO staff are great with RF, and understand that domain well. But very few of their staffers know about data networking, and most do not want to learn. I cannot imagine how hard it must be for an RF-taught manager to try to interview data networking candidates to help run their networks. Once employed, the network folks need some policies and decisions to guide the implementations, but where does an MSO get those plans?

"The implementations also can be influenced/hampered by the manufacturers features (and bugs), and the level of network-side support for their products since interoperability seems to be seeing some daylight through CableLabs (http://www.cablelabs.com). Maybe MSOs need to consider working with outside help (outsourcing or consulting firms with strong backgrounds in networking, Internet issues, and security) to help get them started, to help hire strong candidates and to help improve some weak network infrastructures. Growing that knowledge in-house will take much longer than you think, and MSOs may suffer embarrassing press in the meantime.

"Jay Junkus (president of KnowledgeLink and Communications Technology's telephony editor) has the right ideas about how important the networks will be to the advancement of cable services in the future. With satellite services evolving rapidly, MSOs need to act quickly to reduce the number of subscribers that they may lose to satellite, but their design and implementation decisions need to be on-target as well, or the subs will leave later anyway.

"The first step is to understand what you don't know. The second step is to find the best way to get that knowledge in-house and use it. Hiring competent outsiders, and ensuring they document their work and train your staff can be a fast-track solution to getting that knowledge in your shop, keeping more subs, and having successful trials and deployments. Moving slowly, to stay out of the limelight, is a good way to also fall from grace with your subscribers. David K. Z. Harris, Certainty Solutions Inc.

ENGINEERING NEWS
S-A Wraps Up Integration On Digital Box

A PVR box is a complex piece of equipment in and of itself, but when you mix PVR capabilities into a digital set-top box the complexities of integration become exponential.

Last week Scientific-Atlanta (http://www.sciatl.com) announced it had completed the integration of Metabyte Network (http://www.mbtv.com) and Keen Personal Media's (http://www.keenpm.com) technologies into its Explorer 8000 digital set-top box, which S-A says is the first single unit set-top box with PVR abilities.

"It was one of those projects that on the surface could kind of scare you because we had about five engineering teams working on it," Bob Van Orden, S-A's vice president of strategy, tells Pipeline. "It's a two-tuner PVR that has analog and digital, but it also has to carry forward all of the requirements of a cable box, and it also has to retain all of the APIs and interfaces so the legacy applications still run."

S-A uses Keen's TV4me digital video recorder, and driver lever software that manages the file and encryption systems on the hard drive and the MPEG encoder.

Metabyte's MbTV 2.1 PVR software is in charge of storage management, scheduling and recording of programs and resolving time and space conflicts. Van Orden says S-A has about 60 pages of different conflict scenarios that the software has to be able to resolve.

"We've been waiting for the first PVR set-top box, and now its here," Vallal Jothilingham, Metabyte's director of product marketing and management, says. "It's not only a big milestone for us and S-A, but also for the cable industry."

Time Warner Cable purchased 100,000 of the Explorer 8000 for a field trial, and S-A expects to announce another purchase by a large MSO within the next few weeks. -- Mike Robuck

• Susquehanna Burns Churn With Gaming -- Susquehanna Communications says that its initial offering of Scientific-Atlanta (http://www.sciatl.com) Classic Games in three markets has resulted in reduction of digital churn. Monthly churn rates among SusCom's digital cable subs in York and Williamsport, PA, and Brunswick, ME, are down an average of 2 percentage points since the op first launched the suite of parlor games, including backgammon, checkers, memory, tiles and poker, last November.

  "Classic Games gives us the ability to track product utilization to a very detailed level, and we can directly correlate our churn reduction to subscriber usage," Dan Templin, VP of marketing and programming for SusCom, says. "We're seeing an average of 20% of discrete digital households playing Classic Games each month, and they're playing for an average of 45 minutes each day."

  Those numbers are well above the op's projections of 5% to 7% utilization.

CAREER ENGINEER
ITV Standards Forum at National Show

The proprietary nature of operators' environments results in many nasty entry barriers for interactive TV vendors, which has resulted in slow ITV rollouts, exorbitant, time- consuming integration processes and wobbly economics.

To help with those dilemmas, TVGate (http://www.tvgate.tv), the interactive TV division of Comverse (http://www.comverse.com), has launched the TVXML Forum, a nonprofit organization to promote the standardization of third-party services and applications that require two-way capabilities.

"TVXML assumes that existing set-top box and middleware will remain relevant for the coming few years," Ezra Mizrahi, a VP at Comverse-TVGate explains. "The TVXML standard creates a new opportunity for opening the existing infrastructure to third-party ITV applications regardless of middleware and set-top."

The TVXML Forum is hosting a session today (May 7) in New Orleans at NCTA's Cable 2002. The session is from 11 a.m.-3 p.m. in Room 346 of the convention center.

The TVXML standard addresses ITV messaging apps, as well as third-party ITV apps that use messaging enhancements. TVXML will be "promoted from the status of a de facto standard, to an official standard," through today's forum, according to Comverse-TV Gate.

BROADBAND SOAPBOX
Defining Broadband

These days, you hear the word "broadband" almost as often as you hear about "thinking outside the box."

Broadband is used so often that its actual definition has become fuzzy. The FCC (http://www.fcc.com) defines it as a 200 kbps, always-on connection. But recently, Intertainer (http://www.intertainer.com) CEO Jonathan Taplin asked regulators to set the minimum to 750 kbps.

"The FCC should mandate a "truth in advertising policy in regards to broadband," Taplin says. "Today if you buy broadband service from your local telephone company, cable company or ISP you are offered 'up to 1.5 Mbps.' You are not told what the minimum level of service is," he adds.

"Broadband providers are oversubscribing their networks in order to maximize profits on broadband service," he continues. "But to deliver advanced video services a minimum of 750 kbps is required to the home for VHS video quality. For DVD quality,a minimum of 1 Mbps is required."

Want to share your opinions on this topic with other Pipeline readers? E-mail . Letters may be edited for style or length.

SCTE ANNOUNCEMENTS
Touch the Technology

Attend SCTE's Cable-Tec Expo, June 4-7 in San Antonio, and you'll benefit from hands-on demonstrations of the hardware, applications and services available to support your operation from your favorite vendors, including 54 new exhibitors. Plus, get a sneak peak from the exhibitors in the Expo Online Press Room. Preregister for Expo before May 24 at http://expo.scte.org, or for more info, call .

Need help with industry terms? -- SCTE's online technical resources will help you get to the bottom of those cable terms, including a listing of engineering acronyms, technical dictionaries, cable templates and more. Visit the SCTE Web site today at http://www.scte.org/professional/techinicalresources.html.

Free Standards Online -- Free electronic copies of SCTE's approved standards are available online at http://www.scte.org/standards/standardsavailable.html. SCTE standards provide technical specifications for the cable telecommunications industry including application platform development, digital video signal performance, emergency alert systems, and construction and maintenance practices and are approved by the SCTE Engineering Committee and the American National Standards Institute.

If you find CT's Pipeline to be a valuable resource, e-mail this issue to your colleagues and tell them it's just one of the many exclusive benefits of SCTE membership--only a click away at http://www.scte.org/membership/join.html.

To advertise on CT's Pipeline, contact Jason Salazar at ext. 23 or .

To change your contact information or update your email address, please contact Charmaine Jordan at or .

To unsubscribe from CT's Pipeline, visit www.scte.org/professional/pipelineunsub.html.

If you are experiencing technical difficulties with CT’s Pipeline, contact Client Services at or .

Copyright ©2002 Access Intelligence, LLC. All rights reserved. Reproduction in whole or in part in any form or medium without expressed written permission of Access Intelligence, LLC is strictly forbidden.