Comcast does it again

[HCHTech]

I had a fun residential call this morning. Comcast internet, their son is a gamer and they have a security camera setup accessible from their phone when they are away, so there are a handful of port forwards coded into the gateway. Or should I say, there used to be. Access to the cameras and games stopped working a couple of weeks ago.

Whoever set this up originally changed the password on the gateway (good), but of course, they didn't know it. Ok, no problem, just factory reset the thing, right? Well, it took a solid 15 minutes to reset, and I still couldn't access. Had to reset again (another 15 minutes), then it would let me login with the default password.....which it made me immediate change. I wrote it down for them, and suggested they tape it to the bottom of the modem, but $50 says they will lose it anyway in about 5 minutes.

Once into the modem, I find that apparently Comcast has moved away from allowing you to do port forwarding in their gateways. Now, there is a cheerful message on that page that says "Now, setting up port forwarding is even easier! Just log into your myxfi account! Awesome.

Ok, so we go to xfinity.com/myxfi, but surprise, they don't know the password. They don't use comcast email, but luckily their cell phone is registered, so we go through the reset song and dance. Finally, we're in. Find the port forwarding configuration page, and the devices don't show on the connected list, so we can't proceed.

Back to the modem configuration, I see nothing is set for a reserved IP. They swear it was done and everything worked for a year up until 2 weeks ago. Sigh. Ok, I gather the MAC addresses and setup reservations for the DVR and the game machine. Go back to the myxfi page online, wait for several minutes for what must be their polling interval for the changes on the modem to sync online, then setup the port forwarding. Odd, when you configure it the first time, it doesn't let you choose the port. It just sets up a forward using port 1, which you have to then edit after the rule is created to put in the correct ports. That was fun.

Anyway, we wait another 10 minutes for the polling interval to expire, then test everything and it all works. What should have been a 30-minute callout turned into a little over 90 minutes.

You would think if they are going to force this change on folks, that they would copy the damned settings, but no - just wipe them out and let people fend for themselves.

I'm not 30 minutes back at my desk when the phone rings - you guessed it, the cameras stopped working again. I log into their myxfi thing again, and traffic to the dvr is being blocked by "Xfinity Advanced Security." I fight the urge to just disable that module entirely, and poke though enough to figure out how to whitelist the traffic. What a PITA.

 

[britechguy]

You would think if they are going to force this change on folks, that they would copy the damned settings, but no - just wipe them out and let people fend for themselves.

I'm not 30 minutes back at my desk when the phone rings - you guessed it, the cameras stopped working again. I log into their myxfi thing again, and traffic to the dvr is being blocked by "Xfinity Advanced Security." I fight the urge to just disable that module entirely, and poke though enough to figure out how to whitelist the traffic. What a PITA.

Indeed.

This is the very reason that a great many security features end up being disabled. They are overly zealous. I have dropped security suites in the past (replacing them, mind you) after several different major players went through periods where they became exquisitely oversensitive about allowing perfectly normal activity that companies that make this stuff, of all people, should recognize as normal.

In the computer security field, we often say that one doesn't need Fort Knox to safeguard a broken bicycle.
~ Glenn Glazer, M.S. ’07 UCLA Security & Cryptography,
April 25, 2019, in Message on Groups.io Beta Group

It is just as big a mistake to make things overly cautious, making people open themselves up to real threats by disabling things that are driving them crazy (and that should be driving them crazy), rather than letting things be "a bit looser" with regard to threats that are, at best, a remote possibility, and certainly not a reasonable probability, if things are left that way.

There is a middle road. And it's safe for the vast majority of users. When you add in the fact that the vast majority of infections of any kind are the direct result of user action, and occur on systems that are already well-girded against sneak attacks, well . . .

 

[HCHTech]

Well, I ended up having to disable the 'Advanced Security' anyway. When you "allow the traffic", it basically whitelists the single IP it detected during the block - for a maximum of 30 days.

The text from page 4 of their technote says:

====================
Advanced Security and Port Forwarding
At this time, Advanced Security is not fully compatible with Port Forwarding or DMZ settings. Advanced Security will identify requests coming from open ports as threats and block them, even if you enable Port Forwarding or DMZ. If you need to use Port Forwarding or DMZ and are unable to access a device from outside your home network, you have two options:

• Allow Access: Go to the Connect section in the xFi app or website, select the device you want to provide access to, and follow the instructions to Allow Access.
  • We recommend that you only use Allow Access when you are confident about who is accessing the device from outside the home network.
  • Note that the Allow Access feature will only permit access to the specific device you choose on the specified port using a specific source IP address for 30 days from the time you enable it.
• Disable Advanced Security: Alternatively, you can choose to disable the Advanced Security feature.
  • We do not recommend that you disable Advanced Security, as this removes Advanced Security’s protections from all of your devices.
  • If you need access to a specific device, we recommend you keep Advanced Security turned on and follow the steps above to Allow Access on a device-by-device basis.

===================

 

[Romaniac]

You have to wonder... either what in the F led them to make this change to where it was worth it; OR, what the people who made this decision were f-ing thinking, if it was not the prior.

 

[Diggs]

Pffft! Worse than Charter is around here. Charter will let a homeowner with just enough knowledge to be extremely dangerous into their modem/router for port forwarding, DMZ, etc. but totally block businesses who have the knowledge and advanced needs from even touching the modem router. Go figure.....

 

[Choppie]

I know this is an old thread....but....

my DEFAULT SETUP FOR ALL CLIENT INSTALLS

1) Send the ISP supplied modem BACK!
2) Make sure the ISP knows to remove that charge from their service and that you are using YOUR CLIENT SUPPLIED MODEM.
3) Purchase/Install the ARRIS MODEL T25 modem
4) Purchase a good quality gigabit VPN router (I use ARAKNIS AN-110-RT-2L1W) which requires a vendor account/OVRC)
5) Manage ALL your LAN settings with the router!
6) DONE...

NOTE! Calling and having the ISP BRIDGE their modem works....but I have seen them UN-BRIDGE their modem and reset everything without any warning....jacking up the entire LAN.

Equipment list;

Arris T25 modem
Araknis AN-110-RT-2L1W router (2 LAN ports, 1 WAN port)
Araknis AN-310-SW-8-POE 8 port POE network switch, optional
Araknis AN-510-AP-I-AC WAP wireless access point

 

[YeOldeStonecat]

3X old threads bounced by above with Araknis mentions in the reply....Choppie you own stock with araknis?

 

[nlinecomputers]

Me thinks Ghoppie got hacked by ChatGPT.

 

[brandonkick]

Pro tip: If the customer is also a xfinity cable subscriber, and they have the remote you can "talk" too.... you can ask the remote what is my wifi password and it'll show up on the screen.