<story><title>FBI Smartphone Surveillance Tool Details Revealed in Court</title><url>http://www.wired.com/threatlevel/2013/04/verizon-rigmaiden-aircard</url></story><parent_chain><item><author>trotsky</author><text>It seems like it would be faster to make a list of things verizon won&apos;t accept an administrative subpoena for in lieu of a warrant as opposed to the other way around.&lt;p&gt;On an unrelated note, if you have verizon FIOS they can push a new firmware package to your router and reboot it easily, without you ever knowing. And they log in every day and confirm the hash of the firmware you&apos;re running - if it&apos;s not on the approved list (which is generally just the current one they have you set for) it automatically reflashes. A properly written firmware could monitor not just all traffic that was internet bound, but also everything on the local lan and wireless net.&lt;p&gt;At least in the router I have, there is a significant amount of dark radios on the board. There&apos;s a second (unused) 802.11n radio that in other editions is used as a second n stream but easily could be used to do full site surveys or packet capture or as an evil twin, a DECT (cordless phone) compatible phy that could impersonate a cordless basestation and if I read the spec sheet right a bluetooth and powerline phy.&lt;p&gt;The verizon STB for their converged QAM/IPTV also downloads a portion of their firmware from the management servers and verifies hashes and oprational state TCG style - if they aren&apos;t connected to the network they will never actually finish booting.&lt;p&gt;Details are limited about what the CISCO built STB contains on the inside, but it at least has a light sensor (ir remote) and a vibration / accelerometer (for sudden drop hd head park) that they have been touting as a feature that allows them to measure ad exposure based on floor vibrations that suggest you walked away during a commercial.&lt;p&gt;They&apos;ve also been recently touting a 99% effectiveness rate at uniquely identifying the viewer in multi person households based on statistical modeling of the order and speed buttons are pressed on the remote, though I&apos;m unsure if that&apos;s with the current cisco gear or the new motorola (google) gear that they are just rolling out.</text></item></parent_chain><comment><author>cliffy</author><text>You can replace their router with one of your own. On my ONT there are two ways of connecting to the Verizon service:&lt;p&gt;1) Ethernet. If you connect this way then running your own router is trivial, but by using Ethernet you lose some services related to TV.&lt;p&gt;2) Coax. This is a bit more complicated. You&apos;ll still have to power the Verizon router, but everything behind, and including, your router still will be under your control. You need a Coax to Ethernet adapter like this one:&lt;p&gt;&lt;a href=&quot;http://www.netgear.com/service-provider/products/powerline-and-coax/moca/MCAB1001.aspx&quot; rel=&quot;nofollow&quot;&gt;http://www.netgear.com/service-provider/products/powerline-a...&lt;/a&gt;&lt;p&gt;I don&apos;t remember all the specific steps I had to take to enable this offhand. I need to go back and write a howto. In any case, The final setup will look like this:&lt;p&gt;&lt;pre&gt;&lt;code&gt;  Verizon ONT --[Coax]--&amp;#62; Moca Adapter --[Ethernet]--&amp;#62; Your router.
                          Moca Adapter --[Coax]--&amp;#62; Verizon router.
&lt;/code&gt;&lt;/pre&gt;
One important point is that you must release your DHCP IP on the Verizon router before your router can obtain one.&lt;p&gt;I think you can dispense with the Coax connection to the Verizon router if you don&apos;t care about TV capabilities, but if you don&apos;t you might as well switch the ONT to use Ethernet instead and avoid this mess.&lt;p&gt;My main motivation for doing this was that the wireless capabilities of the Verizon-supplied router were terrible, but it has the added bonus of keeping Verizon&apos;s prying eyes out of my home network.</text></comment>
<story><title>FBI Smartphone Surveillance Tool Details Revealed in Court</title><url>http://www.wired.com/threatlevel/2013/04/verizon-rigmaiden-aircard</url></story><parent_chain><item><author>trotsky</author><text>It seems like it would be faster to make a list of things verizon won&apos;t accept an administrative subpoena for in lieu of a warrant as opposed to the other way around.&lt;p&gt;On an unrelated note, if you have verizon FIOS they can push a new firmware package to your router and reboot it easily, without you ever knowing. And they log in every day and confirm the hash of the firmware you&apos;re running - if it&apos;s not on the approved list (which is generally just the current one they have you set for) it automatically reflashes. A properly written firmware could monitor not just all traffic that was internet bound, but also everything on the local lan and wireless net.&lt;p&gt;At least in the router I have, there is a significant amount of dark radios on the board. There&apos;s a second (unused) 802.11n radio that in other editions is used as a second n stream but easily could be used to do full site surveys or packet capture or as an evil twin, a DECT (cordless phone) compatible phy that could impersonate a cordless basestation and if I read the spec sheet right a bluetooth and powerline phy.&lt;p&gt;The verizon STB for their converged QAM/IPTV also downloads a portion of their firmware from the management servers and verifies hashes and oprational state TCG style - if they aren&apos;t connected to the network they will never actually finish booting.&lt;p&gt;Details are limited about what the CISCO built STB contains on the inside, but it at least has a light sensor (ir remote) and a vibration / accelerometer (for sudden drop hd head park) that they have been touting as a feature that allows them to measure ad exposure based on floor vibrations that suggest you walked away during a commercial.&lt;p&gt;They&apos;ve also been recently touting a 99% effectiveness rate at uniquely identifying the viewer in multi person households based on statistical modeling of the order and speed buttons are pressed on the remote, though I&apos;m unsure if that&apos;s with the current cisco gear or the new motorola (google) gear that they are just rolling out.</text></item></parent_chain><comment><author>peterwwillis</author><text>&amp;#62; And they log in every day and confirm the hash of the firmware you&apos;re running&lt;p&gt;If you can modify the firmware you can change it to respond to their query with the &quot;correct&quot; firmware signature, so this doesn&apos;t seem useful to me. Source?&lt;p&gt;Also, is the 802.11n radio connected to an antenna? If not, can&apos;t really do any surveys with it. Sounds like a fun box to play with for evil maid attacks, though!</text></comment>