Hacking the OpenReach Eci modem b-focus v-2fub/r rev b

Using the router I configured in https://jonrob.net/2017/02/05/openbsd-6-0-home-router/ I found the connection to be stable until I moved house where I’ve been getting frequent disconnects, whenever this happens /var/log/messages on the router shows:

Jun  3 22:42:27 Xavier /bsd: pppoe0: LCP keepalive timeout
Jun  3 22:48:16 Xavier /bsd: pppoe0: LCP keepalive timeout
Jun  3 22:54:04 Xavier /bsd: pppoe0: LCP keepalive timeout
Jun  3 22:59:52 Xavier /bsd: pppoe0: LCP keepalive timeout

Swapping this out for a different modem resolves the issue so it’s clearly an issue with the OpenReach modem, now lets see if we can fix it.

Connecting my laptop to Lan1 on the modem and restarting the network interface with

doas sh /etc/netstart em0

shows that it is not running dhcp, and

arp -a

shows nothing in the arp table so it doesn’t look like this has an IP address meaning we can’t telnet/ssh in or access any web interface. Apart from maybe looking into the BTAgent I don’t see any attack vectors here.

The case can be opened without causing any damage by removing the two foam feet and unscrewing with a 00# phillips screwdriver, then shimming the clips  using a loyalty card and the screwdriver, it’s best to start at the side opposite the lights and work around as that side has three clips. Continue reading “Hacking the OpenReach Eci modem b-focus v-2fub/r rev b”