14 DAY TRIAL // FBI announced that a prominent cable modem hacker was arrested last Thursday on fraud-related charges. He allegedly sold devices, which allowed his customers to steal Internet service and impersonate other users.
According to the authorities, Matthew Delorey, 26, of New Bedford, Massachusetts, is a hacker who specializes in modding cable modem firmware. Cable modem devices are used by ISPs to provide Internet access over cable TV networks.
Having its origin in the gaming community, "modding" refers to the act of modifying a piece of hardware or software in order to add functionality that wasn't intended by the manufacturer. Apparently, Delorey used his website, massmodz.com, to sell cable modems re-configured to allow MAC address spoofing.
Media Access Control (MAC) addresses are unique identifiers assigned by hardware manufacturers to the networking devices they produce. MAC address spoofing involves configuring a networking device to report a user-supplied MAC address instead of its real one and is supported by most Ethernet controllers today.
ISPs provide customers with locked-down cable modems that don't allow access to such advanced options, theoretically making their MAC addresses viable for customer identification. But Delorey saw a business opportunity into re-configuring these devices to allow MAC spoofing and then selling them.
"A cable modem with a 'spoofed' MAC address may allow the modem's user to access the Internet using the identity of another modem or a fictitious modem, thus allowing the user to hide his or her identity from the Internet service provider and obtain Internet access for free. Such a 'spoofed' MAC Address would also allow the user to hide from law enforcement, which could facilitate criminal conduct," the United States Attorney's Office for the Southern District of New York explains in a press release.
The hacker was arrested after he sold two modded modems to an undercover FBI agent. He was charged with one count of conspiracy to commit wire fraud and one count of wire fraud. The maximum sentence is 20 years in prison for each count and a $250,000 fine.