Ambit 250/255 Webstar 2100 Attacked

[matthew4321]

modems that have been bricked will come back on line, the two modems i have came back on line yestoday..this might help

[matthew4321]

see what happens..

[slacky]

how do u change the serial to match the mac address

[lincsat]

change the serial number of the infinite firmware:
power up modem without feed just Ethernet
now open hyperterminal and set your settings to:
connect using = TCP IP (winsock)
host address = 192.168.100.1
port number = 23
and login in with user & pass
then copy and paste the stop scan cmd:
Code:
cd \cm_hal
scan_stop
cd /
cd non-vol
cd snmp_cm
docsDevSerialNumber cmxxxxxxxxxxxxx (replace the xxxxxxxxxxxxx with the MAC without the :)
write
reboot modem.
Changing The USB MAC.
power up [modem] with-out feed just ethernet cable.
now open hyperterminal and set your settings to:
connect using = TCP/IP (winsock)
host address = 192.168.100.1
port number = 23
and login in with user & pass
then copy and paste the stop scan cmd:
Code:
cd \cm_hal
scan_stop
now enter the following cmds:
Code:
cd /
cd \non-vol/halif
usb_mac_address 00:xx:xx:xx:xx:xx (Make this 1 higher than your Normal MAC)
write

You can also use the terminal facility in the Ambit tool to perform these commands :)

[slacky]

how does changing the serial to the same mac help it not being attacked

[lincsat]

Changing the Telnet login stops it being bricked, changing the serial and USB MAC helps prevent it being identified as a Hacked modem and having the MAC address in use blacklisted.

[slacky]

hyst changed them but on the usb mac i didnt get what it ment by change this to 1 higher than normal so where it started 00 i changed it to 01 is that right?

[lincsat]

Just the very last digit - so if it was 01:02:03:04:05:06 make it 01:02:03:04:05:07 or If it ended 05:09 make it 05:0A

Hope that explains it

[slacky]

well it ends in E so should i make it F

[boogeyman]

hi guys, thought i would register to give you some help, as there seems to be a bit of b/s flying around. read carfully.

vm are attacking all cloned modems. all config files are being encrypted as we speak and tftip servers are changing address.

vm are sending out firmware updates for there modems. this little update allows the encrypted mac to be read by the modem while in sync with the server. each online modem will only get a few attempts to take the update. after so many failed attemps they blacklist the mac.

i reckon that in the matter ov weeks encrypted configs will be everywhere and theres gonna be a lot of bricked modems on ebay.

so changing pw and user name etc aint gonna help. wm know that the modem is running on infinite or other hackware. some ppl or disabling snmp and remote telnet. (vm cant brick the modem, but can still blacklist macs)

so what have i done about this?????
well i got a brand new ambit 255. unflashed and unmodded !!! i then ran a few commands in telnet to change mac 1 mac 2 and usb mac along with seriel. so in summary, vm send out a signal to my modem ''are you one ov ours??.....have you been flashed with infinite or whatever??''
my modem says , 'no boss, i am all original heres my access codes and my macs are working ones that match the serial see?'' ''ok, heres your config enjoy your surfing''

if you have any questions please feel free to ask. ''dont force configs on encrypted macs, you will get online for around 30mins then mac is blacklisted''