A New Idea to protect your Ambit 250 !!!!

[lord-icon]

Been swithering on this for a while . Its still in the early stages and only a thought I had while driving into work this morning


A New Idea to protect your Ambit 250 !!!!

The Joys of a 1hr drive to work , well it got me thinking about how to protect my new shiny and still working Ambit 250


This wont stop them as in the ISP detecting you are running a cloned Mac , But I hope it will stop them bricking our modems !!

How they brick you .

Simple they have access to your modem , via Telnet and upload a whole heap of junk to your modems 16Mb CMOS TSOP .leaving is unrecoverable , unless you de solder and have it re programmed .

I have managed to get hold of the Data Sheet for this chip and been having a look into it .

OK , My thoughts Pin 11 is the WE# “write enable”
Now making this logic High 3.3v should so will disable write to this chip .

Throwing this one to the table .

What’s your thoughts please .

Regards

Icon

 

[nozzer]

It all depends on whether they need write access for anything else. Some devices seem to use the flash to store log entries etc.

 

[lord-icon]

I was thinking about that ,
But all it would meen is the event log wouldnt work

or dissable the event logs

Cheers

Icon

 

[nozzer]

I guess the only way to find out is to try it and see what happens.

 

[lord-icon]

Thats my plan for tonight

I will post my findings .

Cheers


Icon

 

[lord-icon]

Ok

So far so good

Pin 11 not connected to gnd but floating . I have now tied this to Vcc via 100R resistor

Guess What !! Modem boots ok .

Tried to make mac change , Was unable to .

So far so good


Removed Pinn 11 from Vcc and flashed modem . I have set the trap . !!

Telnet enabled
default password not changed

Pin11 no reconnected to Vcc

Im all set !!

I have a few more things to check , then its time to see if VM can brick it . !!!


Icon

 

[KhuramG]

Brilliant!

I hope it works mate - top thinking mate even if the attempt is unsuccessful.

Good luck!

 

[reddwarf]

How would you change details on the modem the next time you need to change the mac address? Do you have to re-solder the pin?

 

[lord-icon]

How would you change details on the modem the next time you need to change the mac address? Do you have to re-solder the pin?

Sorry my post wasnt to clear . Im a tad exited right now .
Ok what I did was romoved Pin 11 frim the PCB . Now that was bloody hard ,
connected it to Vcc via 100R resistor .
Booted modem with no HCF connection
Tried to change mac adress ,, was unable
As for re-soldering the pin . Not at this time . its dissconnected from the PCB and connected to Vcc via 100R resistor .
So far still sitting at 20Mb download

here for all you tech lads/lasses
http://www.datasheet4u.com/html/2/9/L/AM29LV160B_AMD.pdf.html

Then click DataSheet View

 

[yomeh]

all sounds good but couldnt they still blacklist the modems mac

 

[lord-icon]

all sounds good but couldnt they still blacklist the modems mac

Yes

But then you put the modem back to write mode .
Change mac
Then back to read only



Cheers


Icon

 

[yomeh]

Yes
But then you put the modem back to write mode .
Change mac
Then back to read only

Cheers
Icon

hmmm could a switch be put on so theres no soldering then cutting if the mac gets blacklisted

 

[lord-icon]

Yes , a very good point .

I beleve there ia space between the HCF and usb connections at the back of the modem for a small switch

 

[yomeh]

if all goes well it might be the way to go

 

[hackmax]

Isn't it just easier to use a firmware that disabled telnet

 

[lord-icon]

Cheers


I am going to keep this modem on for the rest of tonight .

Icon

 

[yomeh]

Isn't it just easier to use a firmware that disabled telnet

aye was thinking that actually mate it just does the same thing really

but the more ways to stop vm the better

 

[Ph@ntom]

My thoughts Pin 11 is the WE# “write enable”
Now making this logic High 3.3v should so will disable write to this chip .
Icon

I remember a similar trick on Modshack with the old Telewest Pace STB
they called the Pin 11 trick A No Update Mod,
it stopped TW from updating the STB

The STB are still working today! so as it is the same chip
it should work in the same way with the 250.

 

[lord-icon]

Isn't it just easier to use a firmware that disabled telnet

Yes it is
But this way will stop any new attacks our lovely isp will try to come up with

And so far so good

 

[madmanuk]

very good mate keep up the good work.
Thanks