CM2000 Event Log Export Encryption

[emattheis]

I just got a CM2000 to replace another perfectly good modem that Comcast starting having compatibility issues with. I'm keeping an eye on the event logs to see if I see any of the same issues show up on the new modem (so far, they don't). Copying data out of the web console on my old modem was a pain, so I was excited to see the export button on the event log page. Unfortunately, the export is encrypted and there are no instructions how to decrypt it. What is the purpose of that? How can I decrypt the file to see what's in it? I'm very curious now, because the export produced a 217 KB file despite the fact that the web page shows no log entries.

[FURRYe38]

What is the file format of the exported file? 

So opening this in notepad or a text editor comes back garbled? 

[emattheis]

When you click the export button, you get a confirmation popup:

If you confirm, you get a progress bar:

The resulting file is named NETGEAR_xxxxxxxxxxxx.bin (where xxxxxxxxxxxx is the MAC address of the modem) and opening in a text editor shows nothing human-readable (at least, not in any language I recognize).

[FURRYe38]

Well probably the text that says "only for NETGEAR analysis" probably means once it's sent to NG, they only have the ability to decode and review the information. and the .bin file so this would be a encrypted binary file. So only NG can decode it. Only needed for troubleshooting extreme issues. 

[emattheis]

Yeah, exactly. That's what I'm interested in knowing more about. Why is it encrypted? What's in the file? If someone at Netgear support can decrypt it, why can't I?

[FURRYe38]

Probably due to ISP service information and other items that users may not need access too. Most of the time if there is a problem between NG and the ISP, they will collaborate on the issue to get it fixed. I've heard the modems and the FW are tightly controlled and only the ISP has the necessary information since there the ones that handle the ISP signal up to the modem and the the only ones responsible for any FW updates that NG gives them. 

Again, only for problems that can't be solved by normal means and would need NG support and engineering intervention. Otherwise,  I wouldn't worry about it. 

[emattheis]

Yeah, not worried about it, just curious. There’s all kinds of ways to provide data to the ISP side. DOCSIS itself defines pretty much everything the head end needs to command and control a modem. Putting the customer user in charge of exporting encrypted data for the cable provider or modem manufacturer seems strange. On the other hand, for power users it’s probably got a ton of interesting data…

[Kitsap]

If you are really digging, at one time there was internet chatter about Netgear backup configuration files.  They were a XML spreadsheet compressed into a password protected zip file and then renamed.  The passwords were available in the chatter.  An internet search may find some of this history.  Maybe a similar approach on the exported event logs?

[FURRYe38]

These .bin files are binary and would probably need decode tokens or keys to decode the .bin file. 

[emattheis]

Yeah, they definitely aren't just renamed ZIP files - there is no known header in the binary data. There must be a tool that NG support and/or ISPs have access to for decrypting/decoding the file. Without access to the tool, we'd need to know the algorithm and secrets used encrypt the file. Ideally, NG is using a well known algorithm like AES, and the key is derived from some values specific to the modem and only known by the owner  - e.g. the serial number and the admin password. If this was documented, sophisticated users would be empowered to decrypt the file on their own.