Skip to main content

Xfinity website bug revealed home addresses and Wi-Fi passwords

This week, ZDNet reported that a Comcast website used to activate Xfinity routers was leaking personal data, including a person's home address, the name of the Wi-Fi network and password. This bug was first uncovered by two researchers, Karan Saini and Ryan Stevenson. Saini and Stevenson found that they only needed a customer ID and house or apartment number (not the full address) in order to force the website to deliver the information. This, in spite of the fact that the form did request a full address. This information can be obtained from a discarded bill, or if an attacker only has the ID, they can guess a house/apartment number. ZDNet was able to confirm that the bug indeed returned home addresses, as well as Wi-Fi username and password information in plain text. For one user they tested who didn't use Xfinity's router, the website returned the home address but not the username or password of the Wi-Fi network (another reason to always use your own router). If this wasn't bad enough, it's possible someone could have used this method to rename a Wi-Fi network or change the password, locking someone out of their own network. Tips to Sell a House Quickly Comcast is aware of the issue and has removed the option from its website. "There's nothing more important than our customers' security," a Comcast spokesperson told ZDNet . "Within hours of learning of this issue, we shut it down. We are conducting a thorough investigation and will take all necessary steps to ensure that this doesn't happen again." Still, considering that the service just introduced its mesh routers last night , the timing of this discovery isn't great. It's good that the company acted quickly, but it doesn't change the fact that this breach of security happened in the first place.
Labels:

Comments

Post a Comment

Popular posts from this blog

AP Newswire

WASHINGTON (AP) -- The Senate on Tuesday confirmed President Donald Trump's pick to lead the National Security Agency and the U.S. Cyber Command. On a voice vote, the Senate approved Paul Nakasone for one of the nation's top intelligence posts. They also approved his military promotion to general. Nakasone, a longtime member of the cryptologic community, has a strong background in cyber issues. He is replacing the current director, Mike Rogers, who is retiring. During his confirmation hearing, Nakasone said China, Russia and other nations that launch cyberattacks against the United States aren't worried about retribution and see no reason to change their behavior. "They don't fear us," he said at the hearing, adding that the U.S. must impose costs on those adversaries to make them stop. Nakasone previously commanded the U.S. Army Cyber Command and held military intelligence positions in Afghanistan, Iraq and the Republic of Korea. ap.stripes.com
Post a Comment
Read more

Global Home Automation Markets 2015-2018 & 2024: Increasing Proliferation of Smartphones and Smart Mobile Devices - A Strong Growth Driver for Home Automation Market

Dublin, May 24, 2018 (GLOBE NEWSWIRE) -- The "Home Automation - Global Strategic Business Report" report has been added to ResearchAndMarkets.com's offering. The report provides separate comprehensive analytics for the US, Canada, Japan, Europe, Asia-Pacific, and Rest of World. Annual estimates and forecasts are provided for the period 2015 through 2024. Market data and analytics are derived from primary and secondary research. This report analyzes the worldwide markets for Home Automation in US$ Million. The US market is further analyzed by the following Functional Areas: Lighting Security HVAC Entertainment Others. The report profiles 80 companies including many key and niche players such as: ABB Ltd. (Switzerland) Abilia AB (Sweden) AMX (USA) Control4 Corporation (USA) Crestron Electronics, Inc. (USA) Emerson Climate Technologies, Inc. (USA) HomeSeer Technologies, LLC (USA) Honeywell International, Inc. (USA) Leviton Mfg. Company, Inc. (USA) Legrand (France) Vantage C...
Post a Comment
Read more

Gartner Identifies How Security Leaders Can Be Empowered to Drive Results

NATIONAL HARBOR, Md.--( BUSINESS WIRE )--The overwhelming demands on security leaders today can have a paralyzing effect. During the opening keynote address today at the Gartner Security and Risk Management Summit , Gartner analysts provided insight to empower these security leaders to take action. Tweet this Gartner analysts provided guidance to an audience of more than 3,400 security and risk leaders and practitioners on how to be empowered to adapt their people, processes and technologies to address the old and the new; empowered to transform their approach to risk governance to be more continuous and inclusive; and empowered to scale their security capabilities in other ways than by hiring more people. Much of this empowerment can come from addressing three simple questions: What’s important? What’s dangerous? What’s real? Gartner analysts took the attendees through a series of scenarios to show how these questions can provide clarity, and in each scenario, the in...
Post a Comment
Read more