Hacking a Netgear N600 Wireless Modem Router DGND3700 V1

Today I found a really cool custom firmware for my Netgear DGND3700 V1 modem/router which is discussed in this thread at forum1.netgear.com.

The developer’s wiki page for the firmware is here.

This firmware adds a few features such as ability to toggle telnet and ssh (a.k.a. “dropbear”) daemons on or off via the adminstrative web gui.

Significantly this firmware adds a toggle for Annex M support under “ADSL Advanced Settings -> DSL Modulation”. I use Sonic.net which is possibly the best ISP in the United States and they offer the ability to toggle it on or off simply by calling 611 and selecting the appropriate menu items. Annex M is simply another DSL modulation protocol and enabling it essentially doubles the upload speed of the connection. This is significant if you intend to run your own VPN, web or possibly other servers.

In the ADSL Advanced Settings there’s also the item “SNR Margin” which enables one to change the signal-to-noise ratio. If the SNR is lowered it can increase bandwidth. I set mine to -5.5 dB and it when I ran a speed test saw that my download bandwidth increased by around 1 Mbps. If the value is set too low it won’t connect.

When applying the update through the modem/router’s web admin gui it may give a warning that it is not US firmware (if you are in the US) but this is not a problem. Its ok to ignore the warning and proceed.

There are some other cool things you can do. The above firmware will install Busybox which is a minimal set of shell utilities/commands. One cool command to read out the networking status of the device is:

xdslctl info --show

If you want to see info for the actual ADSL interface you can run:

ifconfig atm0

I mentioned previously a utility to enable telnet on a stock DGND3700 without the above firmware. With the above firmware this is not necessary.

Finally, I found out about a cool utility called RouterStats which captures statistics from the modem/router and displays them in various formats including graphs. It even has a web server feature.

To get it to work one must set the modem/router’s web admin username and password in the configuration options. In the telnet settings tab under “experimental” one has to check the box for “login normally with ‘admin’ and password” even though for telnet these are not necesary. Under chipset settings Broadcom can be selected and the appropriate command is “adslctl info –stats”.

Here’s a good page which explains how to manually set the signal-to-noise ratio of the ADSL line (which is not necessary since there’s already the option in the firmware).

Some more interesting info from other sources (the driver blob mentioned here is incorporated into the current firmware):

Hacker … from Hungary has discovered a slightly newer DSL driver blob for the BCM6368. The BCM6368 is the Broadcom System-on-Chip that powers the HG612 and a good many other VDSL2 CPE.

source: http://huaweihg612hacking.wordpress.com: Updating the DSL hardware driver blob

UPDATE: Fortunately the DGND3700 appears to be unaffected by a recently discovered secret backdoor vulnerability in many other Netgear models.