Month: January 2021

When security firm Malwarebytes announced last week that it had been targeted by the same attacker that compromised SolarWinds’ Orion software, it noted that the attack did not use SolarWinds itself. According to Malwarebytes, the attacker had used “another intrusion vector” to gain access to a limited subset of company emails.

Brandon Wales, acting director of the US Cybersecurity and Infrastructure Agency (CISA), said nearly a third of the organizations attacked had no direct connection to SolarWinds.

[The attackers] gained access to their targets in a variety of ways. This adversary has been creative… it is absolutely correct that this campaign should not be thought of as the SolarWinds campaign.

Many of the attacks gained initial footholds by password spraying to compromise individual email accounts at targeted organizations. Once the attackers had that initial foothold, they used a variety of complex privilege escalation and authentication attacks to exploit flaws in Microsoft’s cloud services. Another of the Advanced Persistent Threat (APT)’s targets, security firm CrowdStrike, said the attacker tried unsuccessfully to read its email by leveraging a compromised account of a Microsoft reseller the firm had worked with.

According to The Wall Street Journal, SolarWinds is now investigating the possibility that these Microsoft flaws were the APT’s first vector into its own organization. In December, Microsoft said the APT in question had accessed its own corporate network and viewed internal source code—but that it found “no indications that our systems were used to attack others.” At that time, Microsoft had identified more than 40 attacks on its customers, a number that has increased since.

Microsoft Corporate VP of Security, Compliance, and Identity Vasu Jakkal told ZDNet that the “SolarWinds” campaign isn’t an isolated emergency so much as the new normal, saying, “These attacks are going to continue to get more sophisticated. So we should expect that. This is not the first and not the last. This is not an outlier. This is going to be the norm.”

Mediacom, a cable company with about 1.4 million Internet customers across 22 states, is telling heavy uploaders to reduce their data usage—even when those users are well below their monthly data caps.

Mediacom’s fastest Internet plan offers gigabit download speeds and 50Mbps upload speeds with a monthly data cap of 6TB. But as Stop the Cap wrote in a detailed report on Wednesday, the ISP is “reach[ing] out to a growing number of its heavy uploaders and telling them to reduce usage or face a speed throttle or the possible closure of their account.” Mediacom told Ars that it is contacting heavy uploaders “more frequently than before” because of increased usage triggered by the COVID-19 pandemic. The company said that heavy uploaders “may be under their total bandwidth usage allowance but still have a negative impact on Mediacom’s network.”

Mediacom’s terms and conditions say the company charges $10 fees for each additional block of 50GB used by customers who exceed the data cap. But users may be warned about their usage long before they risk overage fees. One user in East Moline, Illinois, who described the predicament on a DSLReports forum in early January, said they paid for the 6TB plan “to make sure we wouldn’t go over the cap” and had never used more than 4TB. The user wrote:

So, got a call from the Mediacom fraud and abuse department today. The rep told me they were calling customers that have “higher than average” bandwidth usage as they are having network issues. I hurried up and checked my account and only used a bit over 2.5TB last month. He told me my upload was 450GB over their average and if I didn’t reduce my usage they would either throttle or disconnect me. I argued that I used less than half of the total data allowed by my plan, but he said my 1.2TB of upload was too much and that this was my warning.

Another gigabit user in Missouri named Cory told Stop the Cap that the 6TB monthly cap “is way more than I will ever use, but I still received a warning letter claiming I was uploading too much. I discovered I used about 900GB over the last two months, setting up a cloud backup of my computer. At most I can send files at around 50Mbps, which they claim is interfering with other customers in my neighborhood. I don’t understand.”

Too much usage in “Mediacom’s sole opinion”

Letters sent by Mediacom to heavy uploaders said, “your account’s usage is greater than 99.5 percent of all Service customers. Due to your excessive use, you are negatively impacting Mediacom’s network and other users of the Service.”

The letter goes on to say that it’s a “violation” of Mediacom’s acceptable use policy to “use excessive bandwidth, whether upstream or downstream, that in Mediacom’s sole opinion, places an unusually large burden on the network or goes over normal usage. Mediacom has the right to impose limits on excessive bandwidth consumption via any means available to Mediacom.”

Mediacom provided slightly more detail to the Federal Communications Commission in response to customer complaints. A Mediacom letter to the FCC said the company’s “network is built to allow for more downstream usage than upstream usage.” Mediacom’s letter to the FCC also described the data cap as “a large conduit with a smaller conduit within it… Due to historical trends, the smaller conduit allows for upstream usage while the remainder of the conduit is reserved for downstream usage.” Heavy upload use can stress that “smaller conduit,” meaning that customers “can be under the total data usage allowance but still be negatively impacting the network.”

Mediacom blames pandemic

Even without the overall data caps, Mediacom’s Internet plans have built-in limits on uploading. While the gigabit-download plan limits uploads to 50Mbps, the 60Mbps-download plan limits uploads to just 5Mbps and the 100Mbps-download plan limits uploads to 10Mbps. The 60/5Mbps plan has a 200GB monthly cap, and the 100/10Mbps plan has a 1TB cap.

We asked Mediacom why it hasn’t upgraded its network enough to fully support the upload speeds and data allotments that its customers pay for, but we didn’t receive an answer. New versions of the Data Over Cable Service Interface Specification (DOCSIS), which have been heavily hyped by the cable industry, can support symmetrical download and upload speeds of 10Gbps. Even an earlier version of the DOCSIS 3.1 standard that’s now widely deployed theoretically allows 10Gbps downloads and 1Gbps upload speeds. But the cable industry has been slow to raise upload speeds.

When contacted by Ars, Mediacom pointed to cable-industry statistics showing 31.8 percent growth in downstream traffic and 51.1 percent growth in upstream traffic since the pandemic ramped up in March 2020. Mediacom spokesperson Thomas Larsen also told us:

Given the surge in traffic during the pandemic, we have been reaching out to the customers who fall into the top 0.5 percent of upstream users more frequently than before. This is not the easiest topic to explain because Internet usage is growing rapidly in this work from home/study from home environment, so it is difficult to give an exact number that puts a customer into the 0.5 percent category because that number changes from month to month.

Ideally, we can help the customer identify the cause of the upstream overutilization issue and help them take steps to manage it. We can offer business class services that are designed to support greater upload capacity, but that’s really not the point of this exercise.

Mediacom also contacts heavy download users “when their usage negatively impacts” other customers, Larsen said. “Since our network is engineered to be able to handle significantly more downstream traffic, this happens less frequently.”

As for whether customers who don’t lower their usage will face throttling or account terminations, Larsen said, “use that causes a negative impact on Mediacom’s network is prohibited and Mediacom may implement necessary network programs to address such use or suspend or terminate the service.”

Switching ISPs “not an option”

Mediacom’s handling of uploaders is reminiscent of steps taken by Cox Communications earlier in the pandemic. Cox imposed neighborhood-wide slowdowns in some cases, reducing the gigabit-download plan’s upload speeds from 35Mbps to 10Mbps. Mediacom doesn’t appear to have done anything that drastic, but telling users to reduce their upload usage when they haven’t even come close to hitting their data caps is frustrating for customers.

“If there were any other Internet options other than horribly slow AT&T DSL, with a small data cap, I would switch in a heartbeat,” the Mediacom customer in Illinois who posted on the DSLReports forum wrote. “Unfortunately with my job and working from home, going without usable Internet is not an option.”