simulate CMTS

[toniou]

Hello to everybody,

Is it possible to simulate a CMTS to extract the certificate from my modem?

I don't know if it 's a stupid question but I don't find a lot of information.

to avoid disturbing you, can you give me a link to a tutorial or the necessary information to begin.

Thanks


and sorry for my bad english.

[ABMJR]

nope

[0rko]

ABMJR is right. No CMTS simulation available but allow me the question to you, what's your desire to have the cable modem certificate anyway?

[ABMJR]

the certificate is self signed by the ISP AFTER you register the modem online...its pushed as a download

[0rko]

ABMJR: really? Why should it be self signed by the ISP? The manufacturer and cable modem certificate are chained with the Docsis Root-Certificate. This Docsis Root-Certificate is installed at the CMTS. If the ISP is using a "self signed" certificate for the cable modem he has to update the Manufacturer and cable modem certificate on the cable modem. This is not a easy part, besides the fact it's not standardized by the Docsis specification.

[ABMJR]

Its a firmware update signed by the ISP for that CM

https://www.excentis.com/blog/using-exce...are-images

read here

https://www.excentis.com/blog/secure-sof...-docsis-31

The biggest hole in BPI+ is that cable operators turn on the “allow self-signed certificates” in their CMTS. Why do they do this? Because they are using legacy test equipment, outdated test equipment or non-conforming test equipment that does not support BPI+ certificates. If your hand-held test equipment vendor cannot upgrade your equipment to BPI+, find a new vendor, because you are enabling hackers in your network to create their own self-signed certificates, install them in their own cable modems with “valid MAC addresses” sniffed from your network and steal your service.
Disable self-signed certificates and plug the hole
Another hole in BPI+ is that many systems still have old cable modems that do not support BPI+ and so operators will enable BPI+ in its most limited mode. In this case, modems that support BPI+ will be required to register with BPI+, but modems that do not support BPI+ will register in BPI mode or with no encryption at all. This is an open door once again for hackers.
Require “bpi-plus-enforce” on all CMTSs – this means only modems that support BPI+ will be able to register
Monitor “cloned MAC Addresses” across your network – a good hacker will still be able to clone a cable modem MAC along with its digital certificate, but this will show up on your CMTS logs. Automatic monitoring of your CMTS logs for this event will rapidly identify this hacker and enable you to give him the boot.

[ABMJR]

ABMJR: really? Why should it be self signed by the ISP? The manufacturer and cable modem certificate are chained with the Docsis Root-Certificate. This Docsis Root-Certificate is installed at the CMTS. If the ISP is using a "self signed" certificate for the cable modem he has to update the Manufacturer and cable modem certificate on the cable modem. This is not a easy part, besides the fact it's not standardized by the Docsis specification.

Adding a manufacturer's signature to a code file assures that a trusted manufacturer has signed the new software.
Sometimes, an operator wants to have more control over which software versions are installed on its network (as mentioned, the new software versions might not be certified). This can be done by having the operator add another signature to the code file. The operator then co-signs the image. To do so, the operator uses a Co-signer CVC signed by the same root certificate.
In this case, the modem verifies both CVCs and both signatures before installing the new software.



You can thank me later M8

[teddyalmonds]

ABMJR: really? Why should it be self signed by the ISP? The manufacturer and cable modem certificate are chained with the Docsis Root-Certificate. This Docsis Root-Certificate is installed at the CMTS. If the ISP is using a "self signed" certificate for the cable modem he has to update the Manufacturer and cable modem certificate on the cable modem. This is not a easy part, besides the fact it's not standardized by the Docsis specification.

The fact that you know enough to propose this question proves that you understand more than anything ABMJR can even respond with.

I suggest you disregard his responses as they are of no benefit to anyone attempting to learn anything.

[ABMJR]

TEDDY WHY NOT HAVE A CUP OF TEA AND FALL ASLEEP IN YOUR LIFE PARTNERS ARMS...lmfao

[newname]

This may be part of his required community service hours since his release...