Actiontec MI424WR for Verizon FIOS: tricking Verizon?

[eccerr0r]

A friend of mine has an Actiontec MI424WR on FIOS - one of the older "unsupported" ones that Verizon is now charging a monthly fee for simply having one of them - basically forcing them to cough up or upgrade to a "supported" one. Barring the politics of this BS, has anyone figured out a way to trick Verizon into thinking that it was upgraded to a "good" version?

What's the specific problems with this router in why they want to force everyone to pay up or replace? Anyone figured out?

Unfortunately I can't remotely play with this router...

[dmill89]

Re: Actiontec MI424WR for Verizon FIOS: tricking Verizon?

What's the specific problems with this router in why they want to force everyone to pay up or replace? Anyone figured out?

The same reason Microsoft wants everyone on the latest windows (aside from the spyware stuff with Win 10), it costs money to keep supporting "obsolete" equipment (and I believe that model doesn't support the latest wireless security standards, which is further reason for them to "encourage" people to upgrade). Is there a specific reason your friend doesn't want to upgrade? The upgraded routers from Verizon are generally free and your friend would get a much faster and more secure 802.11n router to replace that old 802.11g dinosaur.

[stj]

Re: Actiontec MI424WR for Verizon FIOS: tricking Verizon?

it's probably the first half of the mac adddress giving away the make & model.

[eccerr0r]

Re: Actiontec MI424WR for Verizon FIOS: tricking Verizon?

Is there a specific reason your friend doesn't want to upgrade? The upgraded routers from Verizon are generally free and your friend would get a much faster and more secure 802.11n router to replace that old 802.11g dinosaur.

Yes, the reason? It's not free. I think 802.11g is fine for my friend, rather not spend the extra fee or buy a new router... sees no reason for upgrading whatsoever.

... other than stopping that monthly fee.

[japlytic]

Re: Actiontec MI424WR for Verizon FIOS: tricking Verizon?

Earlier Wireless-G equipment only supported WPA (TKIP), but later Wireless-G equipment supports WPA2 (AES) and all Wireless-N (and onwards) supports WPA2 - as far as I know, when Wireless-N routers came out, just about all of them (non-enterprise) supported Wi-Fi Protected Setup.
At a client's place, I got better range upgrading from Wireless-G to Wireless-N (the wireless router was upstairs while a desktop computer with a USB wireless dongle was downstairs sometimes having problems connecting) - and it most likely did wonders for the fairly new Pay TV box (which also supports 5 GHz operation) upstairs.

[dmill89]

Re: Actiontec MI424WR for Verizon FIOS: tricking Verizon?

Yes, the reason? It's not free.

I guess he must have missed the free upgrade window then, I got a free upgrade a little over a year ago (didn't even ask for it, just upgraded my plan and they sent me a new router no charge and a pre-paid label to return the old one) and I believe they were offering them for at least a couple years, but looking now it doesn't look like they are offering them anymore, bummer.

[eccerr0r]

Re: Actiontec MI424WR for Verizon FIOS: tricking Verizon?

so nobody tried making their router trick Verizon?
Wonder if a firmware upgrade is necessary to do this. As I don't have the admin password and knowing how crappy actiontec firmware is, I don't know what else can be done...
I wonder if simply putting the router/"modem" in "bridge" mode (how DOES FIOS work?) and using an external router is sufficient to trick verizon? Somehow I think not but that's unfortunately something I can't experiment.

[stj]

Re: Actiontec MI424WR for Verizon FIOS: tricking Verizon?

see if you can change the mac address or install openWRT on it.
https://openwrt.org/

[dmill89]

Re: Actiontec MI424WR for Verizon FIOS: tricking Verizon?

another option (or at least it used to be, don't know if Verizon still allows it or not), is to have the internet service switched from coax to cat-5 (phone-call to cust-svc) and use your own router. This will require running cat-5 cable from the main FIOS box (the big white one usually located in the basement/garage/utility room) to your router.

[eccerr0r]

Re: Actiontec MI424WR for Verizon FIOS: tricking Verizon?

I was wondering about that, that coax... what signal standard is going over it? some baseband signal or something modulated?

I don't think I can remote-install openwrt on that MI24WR...

[stj]

Re: Actiontec MI424WR for Verizon FIOS: tricking Verizon?

if it's coax, then it's not ADSL, it's DOCSIS - probably 3.0

[eccerr0r]

Re: Actiontec MI424WR for Verizon FIOS: tricking Verizon?

This is Verizon, the fiber goes to a box in the garage, and the box is connected via coax to the router. I don't remember if the coax also goes to the TV's STB, but it would be strange that it would be DOCSIS as I don't think that Actiontec OEM'ed the router as DOCSIS compliant.

I thought the coax also goes to the STB and using the RJ45 plug on the FIOS box, using that would disable the STB and wouldn't be a proper solution either...

[Spork Schivago]

Re: Actiontec MI424WR for Verizon FIOS: tricking Verizon?

it's probably the first half of the mac adddress giving away the make & model.

That could be it, because the MAC address does contain at least the Organizationally Unique Identifier (manufacturer's name). An example might be something like:

00:60:1D:38:32:90

The OUI is always the first three bytes, so in this case, 00:60:1D, or Lucent Technologies.

Is the model in the MAC address though? I don't think so, albeit I could be wrong.

I'd think maybe they're figuring it out a different way or using something besides MAC address. Otherwise, they'd be "blacklisting" (or whatever you want to call it), all modems from one specific manufacturer, and to me, it almost sounds like they're not doing that. Just blocking certain brands.

I'm not really familiar with the FIOS stuff, but I know a little about the cable modems from TWC. The central office can actually fully modify my cable modem, even if it's one I bought myself, however, it needs to be on their "allowed" list. This is because they flash the firmware with a crippled version, which is stupid. I went out and bought a really nice DOCSIS 3 modem just to find out they crippled it when they "activated" it.

If they were able to modify the firmware without me needing to give them permission, I wonder if Verizon has similar access to their FIOS routers or whatever they're called.

Anyway, maybe a simple test for the OP would be to spoof their mac address? This usually isn't that hard now-a-days and most routers that I've ran across offer the ability.

[stj]

Re: Actiontec MI424WR for Verizon FIOS: tricking Verizon?

the mac address identifies the model aswell as the maker

[Spork Schivago]

Re: Actiontec MI424WR for Verizon FIOS: tricking Verizon?

the mac address identifies the model aswell as the maker

Are you sure? I thought the first 24 bits where the manufacturer and the last 24 bits where the serial number (which could be used to identify the model, if someone besides the company who made it had that information). But I didn't think it was directly encoded into the MAC address like the manufacturer's name is. For example,
00:60:1D:00:00:00 - 00:60:1D:00:1F:FF might represent a Lucent Orinoco wireless NIC, but only because the Orinoco wireless NIC has a serial number in that range (that's just an example, I don't think it does).

I think this is why programs like nmap can give us the make of the NIC but not really the model number (maybe check out nmap-mac-prefixes?)

**EDIT:

Also, on top of that, I don't believe a company has to assign the MAC address's "serial" number (the last 24-bits) in any particular order. One company might use consecutive numbers, another might just randomly pick them. They're all supposed to be unique, but after a while, I believe a company might reuse some of the old MAC addresses from NICs that might not be around anymore, so even if we did have a list from a company, there's no guarantee that MAC address belongs to that specific model number. The only thing we can almost guarantee is the make, but with MAC address spoofing, even that cannot be safely guaranteed anymore

[eccerr0r]

Re: Actiontec MI424WR for Verizon FIOS: tricking Verizon?

I also wonder if it uses TR-069 to tell what kind of router it really is...
Not sure exactly what's in that "modem".

[Spork Schivago]

Re: Actiontec MI424WR for Verizon FIOS: tricking Verizon?

With Coax, it'd be hard to tell for certain, right? I mean, it's not like you could just hook it to a switch, throw a NIC in promiscuous mode and sniff the traffic.

My guess would be you'd have to modify the firmware somehow to accomplish what you want to accomplish. I bet there's some identifying information hidden in the firmware that Verizon can pull off the device to figure out the make / model.

[eccerr0r]

Re: Actiontec MI424WR for Verizon FIOS: tricking Verizon?

Sometimes I kind of find it hard to believe someone hasn't hacked this to avoid the fee... If it's even possible...

[Spork Schivago]

Re: Actiontec MI424WR for Verizon FIOS: tricking Verizon?

Dumping the firmware and writing a modified version back to a device isn't always easy. Sometimes, a device has the ability to upload a firmware file and have the device flash it (which is usually the case with routers), but they have to figure out the file format of the firmware, which might never happen, depending on how the company designed the format....

There's some devices, where they're not supposed to upgraded in the field. With those, you usually have to remove a chip or hook wires up to the PCB to dump / reflash.

Finally, I believe there's even some firmware where once it's flashed, it's not changing, no matter once. You'd have to remove the chip and replace it with an entirely knew one.

With routers, generally the firmware contains some sort of kernel (OS), and then a filesystem with packages (programs) like DNS server, DHCP server, etc. If Verizon can somehow extract this information from the device, I'd start with the firmware. See if you can find a downloadable copy from the manufacturers' website. There's programs out there to help you try to figure out the format and everything (binwalker comes to mind). If not, maybe try to dump the firmware.

With some devices, like my cable modem, if I try modifying the firmware, even if I went out and bought the device, I can go to jail. Well, if I'm getting service through Time Warner Cable or if I'm selling the modified device to someone who's getting service through Time Warner Cable. You might want to double check and make sure it's legal to do what you want to do before you do it though.

My experience with firmware files isn't that good and I firmly believe Stj knows a lot more about firmware then I do. Perhaps he could shed some light on this?

[stj]

Re: Actiontec MI424WR for Verizon FIOS: tricking Verizon?

you need the mac addresses of a few of those boxes and of a few of the newer ones to decode the pattern.
the mac will be in plaintext in the firmware in the bootloader area - changing it wont stop it working, but it may fix the issue.
you may even be able to change the mac from a serial terminal connected to a debug header on the pcb.