What is BRCM-LVG under shared? Is my computer being hacked?

This shared BRCM-LVG showed up on my Mac when we got a new ISP "Time Warner Cable" and they installed a Tricolor TC8715D router/modem. It concerned me so thought I would try a quick Google search and found this forum. Not being one of these "everyone's out to get me" conspiracy nuts I thought I would do some research so here's what I've found. zhen424 seems to be right on the money. I went through the setting and found my DLNA and Digital Media Server and USB Settings were all on by default. Turned them all off. Reset router. A quick IP scan later and the mysterious BRCM-LVG device is gone.

Here's how I understand this works. If you wish to... you could connect a Hard Drive via USB to your shiny new router and use it as a Network Attached Storage (NAS) device. But, in order to access this, now wirelessly connected, mass storage device there needs to be a intermediary device that handles the connection, searches said HD for files and transfers to PC, takes incoming files from PC and writes them to the HHD, etc. Built into the TC8715D there exists such a device and it's main chipset is made by Broadcom which explain the name. Now... if you're still worried about it, just turn off the features i mentioned above, reset the router and eject the BRCM-LVG device from your Macs. Enjoy!

A correction and some additional information--and possible explanation.

Correction of my original post: 'Get Info' does not provide any information--just goes into permanent "fetching" status; 'Quick Look' identifies the root folder "storage" as a 16KB space with no data.

While I consider it reprehensible that cable companies mount file systems on peoples networks without explanation, this may become more prominent in the future--here is what I've been able to determine.

Time Warner and Arriss-Technicolor have signed on to MoCA (Multimedia over Coax Alliance) and DLNA (Digital Living Network Alliance) both developing protocols for delivering streaming media, VOIP, and Internet of Things. The Gateway modems such as the Technicolor, are taking on more of the work to deliver performance.

It appears that multimedia modem-routers with the Broadcom chipset use internal Linux procedures to operate. Many of the process identifiers are labeled "BRCM[hyphen]<nomen>. I can't absolutely verify this; information does not seem available to the layperson. I have found instances of BRCM-2.4, BRCM-test-SSID, and such.

My modem settings do have MoCA currently "disabled" (but available.) DLNA is "enabled" to "allow sharing of digital media between devices such as computers, laptops...and other multimedia products." Does not detail what those "products" are. Onboard-help also states, "DLNA can be enabled or disabled. When enabled, the gateway acts as a Digital Media Server." Additionally, my Gateway has QoS (Quality of Service) enabled to "...provide better performance for latency sensitive communication such as voice or video, especially during high traffic."

I am confident that this is BRCM-lvg is a Gateway internal multimedia server as mentioned in the onboard-help; but I don't seem to have the "creds" to absolutely verify that.

If apple is monitoring this discussion, I would submit that it would be a service to us to verify this; and provide detail in a Knowledge Base entry. Apple users are generally more discerning about what they allow mounting to the file system; and we have a right to know.

Found on my Cisco router at tab " Storage & Sharing"

Device Name : Cisco-Lvg and "Enabel Advanced Access Protocols to attached NAS Storage"

with 2 access Methods, links and ports.

- Windows Network Connection \\CISCI-LVG and

- FTP (via internet).

Disabeled The Windows Network, and it disappeared from Finder.

By no means an expert but it works for me.

This post describes exactly what you should do to rid yourself of this parasitic brcm-lvg that is definitely a security issue. Please read this entire post to understand. I read all these threads below, and called Time Warner Cable (TWC) Tier 3 Tech Support, but the the technician couldn't help. He said it wasn't TWC responsibility. When I explained that the Technicolor Router was TWC property, and indeed, that its security was their responsibility, he put me on hold to check with somebody. Then he had me repeat everything. I repeated all the symptoms for him numerous times as he checked this and that. I told him about this thread on Apple, and asked him to help me block any foreign MAC addresses as per one of the helpful people here. He kept telling me that all he could advise was to change my password. (This much I know and have been doing, like, daily since this breach/hack) Knowing there was nobody to escalate to (I'm already talking to the Executive Office at TWC for this breach of security, but nobody seems to understand what to do about it), I asked the TWC technical representative to help me log onto the router myself, which he did. He told me 'Everything looks fine. Firewall's up and running. Again, I think you need to change your password.' I started asking about all the unrecognized devices connected, and the custom firewall settings which were set to DISABLE my firewall under the appearance of it being enabled. I reset my ip4 to maximum security, and made the mistake of telling him, which he had strong negative opinions about. I also reset my ip6, and some other settings to the 'recommended' settings (that's not where they were). And I went in and deleted a mac address that had no business being on my router. Wish I'd had the foresight to take a photo. All passwords reset, router gateway reset, brcm-lvg and its ominous Sharepoint storage device - gone for now. If someone can please tell me how to take this to the next legal level with TWC or somebody, I'd be grateful.

focus123

I am fairly certain this is one of the neighbors' Broadcom Routers, possibly with a Server attached. It is not merely a chip inside your Mac.

When these show up, it is invariably on Cable-TV wiring, which has the unusual "shared" connection for every device in a neighborhood I described above. (unlike say, DSL or FIOS, where only one customer's data appears at the main Network Interface.)

It is coming from your modem. For an example on how to configure it, see http://media2.comcast.net/anon.comcastonline2/support/help/faqs/wireless_gateway /HOW5220_TC_8717_User_Guide.pdf

I am just now having exactly the same issue. And it appeared simultaneously on both my and my wife's MacBook Pros.

It also showed up when Time Warner Cable (TWC) "upgraded" my cable modem/router to a Technicolor model TC8715D. This had not occurred anytime previously.

Based on the update to the original post noting the poster's similar "upgrade" to a Technicolor modem/router, I would venture that it is either a 1- feature of that line or 2- TWC is capturing data. Either case makes me very anxious because the main folder is labeled storage; and I have no idea what it intends to "store." Finder's 'Get Info' only shows that folder as a 16KB space with 16KB free (at this time, anyway.)

I have admin access to the modem; but a cursory review of settings did not appear unusual. I do intend to do some additional digging about and locking down.

Had same issue.

Turned of modem

went to sys pref sharing - unticked remote login

turned modem back on

BRCM gone

hope this helps

The router should have an administration page on which it shows all the wireless clients connected to it. Does that page show more clients than you know you have?

Hold down the option key and select the Wi-Fi menu in the menu bar. What values is shown for "Security?"

Do you have any ideas as to how this device was able to gain access to my password protected network?

If it wasn't wired to your router, and wasn't on a layer-2 VPN such as Hamachi, then it would have had to get into the Wi-Fi network. If you have a weak network password such as a dictionary word, it could be cracked easily in a few minutes. Changing the password would be a good idea, regardless of how strong it is.

Pretty much the same situation here. Same provider and equipment. I bet you also have a smart TV, perhaps a Samsung DVD. Is DLNA enabled?

It isn't an alarming device, simply part of the services provided by that modem. If you want to eliminate it you will need to get rid of the modem.