Security firm says more routers at risk of hacking

BT, Sky and TalkTalk hubs could also pose a security risk, Pen Test Partners says

Routers made by BT, TalkTalk and Sky could be open to the same hack as Virgin Super Hub 2 devices security, experts from Pen Test Partners have warned. Although those affected are older, it's thought a fair number are still being used by people and can easily be targeted by criminals because they use weak default passwords.

Advertisement - Article continues below

"It's a bit unfair that Virgin Media has been singled out here. They made a mistake - but so have many other internet service providers," said Pen Test Partners' Ken Munro, speaking to the BBC.

"This problem has been known about for years, yet still ISPs [internet service providers] issue routers with weak passwords and consumers don't know that they should change them."

Although BT denied its routers could be targeted in the same way, Munro said the facts showed otherwise. Hackers can guess passwords because they use a format that's pretty uniform across devices. It's also not the first time such revelations have been put forward into the public domain.

"It has popped up again because attention has been drawn to the fact that very few people change their wi-fi password from the one written on the router," Munro said.

Once hackers have access to your network, they can quite easily find other vulnerabilities, which could have a much bigger impact than just allowing them to break in.

Advertisement - Article continues below
Advertisement - Article continues below

As a precaution, Munro said people should change the default password on their router to make it harder for criminals to break through the security features.

23/06/2017: Virgin warns 800,000 customers of Super Hub 2 security flaw

Virgin Media has warned more than 800,000 customers using a particular router to change their default passwords immediately, following the discovery of a flaw that allows hackers to gain access remotely.

An investigation by market watchdog Which? found that Virgin's Super Hub 2 router could be hacked in as little as four days, allowing attackers to gain control of home networks and any connected devices.

Although the company says the risk remains "small", it is advising customers to manually change the default password supplied with the router, typically found on an attached sticker.

The investigation looked at a number of popular connected products, including cameras and Bluetooth toys, and found that eight out of 15 gadgets were susceptible to at least one security exploit.

Advertisement - Article continues below

Which? also tested the Virgin Media Super Hub 2, which only uses a default lowercase password of eight characters long, and found that the router could be hacked in a few days using tools available online. The same password is also used on the router's configuration page, allowing hackers to gain complete control of a network and spy on traffic.

Virgin says there are approximately 864,000 Super Hub 2 routers currently in customer homes, although this number is falling due to Virgin's new Hub 3.0, which uses a more robust password and is impervious to the same style of attack.

"The security of our network and of our customers is of paramount importance to us," said a spokesperson for Virgin Media. "We continually upgrade our systems and equipment to ensure that we meet all current industry standards. To the extent that technology allows this to be done, we regularly support our customers through advice, firmware and software updates, and offer them the chance to upgrade to Hub 3.0 which contains additional security provisions."

Advertisement - Article continues below

The hacking of home routers is not a new threat, and in theory, most devices that come with standard default passwords are vulnerable to hacking. Attackers will typically bombard a device with login requests, using a list of sourced default usernames and passwords known to be used by a particular company. If the password is weak, this can take a matter of days.

Thankfully, for those customers using a Super Hub 2, changing a weak password is a fairly straightforward process, a guide to which has been created on our sister site expertreviews.

This once again raises the issue of security in IoT devices, as many companies have been criticised for promoting the increased use of connected devices while failing to adequately protect their users.

Featured Resources

Top 5 challenges of migrating applications to the cloud

Explore how VMware Cloud on AWS helps to address common cloud migration challenges

Download now

3 reasons why now is the time to rethink your network

Changing requirements call for new solutions

Download now

All-flash buyer’s guide

Tips for evaluating Solid-State Arrays

Download now

Enabling enterprise machine and deep learning with intelligent storage

The power of AI can only be realised through efficient and performant delivery of data

Download now



10 quick tips to identifying phishing emails

16 Mar 2020
mergers and acquisitions

Panda Security to be acquired by WatchGuard

9 Mar 2020
internet security

Avast and AVG extensions pulled from Chrome

19 Dec 2019

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019

Most Popular


Zoom kills Facebook integration after data transfer backlash

30 Mar 2020
Server & storage

HPE warns of 'critical' bug that destroys SSDs after 40,000 hours

26 Mar 2020

These are the companies offering free software during the coronavirus crisis

25 Mar 2020
high-performance computing (HPC)

IBM dedicates supercomputing power to coronavirus research

24 Mar 2020