Security firm says more routers at risk of hacking

BT, Sky and TalkTalk hubs could also pose a security risk, Pen Test Partners says

Routers made by BT, TalkTalk and Sky could be open to the same hack as Virgin Super Hub 2 devices security, experts from Pen Test Partners have warned. Although those affected are older, it's thought a fair number are still being used by people and can easily be targeted by criminals because they use weak default passwords.

"It's a bit unfair that Virgin Media has been singled out here. They made a mistake - but so have many other internet service providers," said Pen Test Partners' Ken Munro, speaking to the BBC.

"This problem has been known about for years, yet still ISPs [internet service providers] issue routers with weak passwords and consumers don't know that they should change them."

Although BT denied its routers could be targeted in the same way, Munro said the facts showed otherwise. Hackers can guess passwords because they use a format that's pretty uniform across devices. It's also not the first time such revelations have been put forward into the public domain.

"It has popped up again because attention has been drawn to the fact that very few people change their wi-fi password from the one written on the router," Munro said.

Once hackers have access to your network, they can quite easily find other vulnerabilities, which could have a much bigger impact than just allowing them to break in.

As a precaution, Munro said people should change the default password on their router to make it harder for criminals to break through the security features.

23/06/2017: Virgin warns 800,000 customers of Super Hub 2 security flaw

Virgin Media has warned more than 800,000 customers using a particular router to change their default passwords immediately, following the discovery of a flaw that allows hackers to gain access remotely.

An investigation by market watchdog Which? found that Virgin's Super Hub 2 router could be hacked in as little as four days, allowing attackers to gain control of home networks and any connected devices.

Although the company says the risk remains "small", it is advising customers to manually change the default password supplied with the router, typically found on an attached sticker.

The investigation looked at a number of popular connected products, including cameras and Bluetooth toys, and found that eight out of 15 gadgets were susceptible to at least one security exploit.

Which? also tested the Virgin Media Super Hub 2, which only uses a default lowercase password of eight characters long, and found that the router could be hacked in a few days using tools available online. The same password is also used on the router's configuration page, allowing hackers to gain complete control of a network and spy on traffic.

Virgin says there are approximately 864,000 Super Hub 2 routers currently in customer homes, although this number is falling due to Virgin's new Hub 3.0, which uses a more robust password and is impervious to the same style of attack.

"The security of our network and of our customers is of paramount importance to us," said a spokesperson for Virgin Media. "We continually upgrade our systems and equipment to ensure that we meet all current industry standards. To the extent that technology allows this to be done, we regularly support our customers through advice, firmware and software updates, and offer them the chance to upgrade to Hub 3.0 which contains additional security provisions."

The hacking of home routers is not a new threat, and in theory, most devices that come with standard default passwords are vulnerable to hacking. Attackers will typically bombard a device with login requests, using a list of sourced default usernames and passwords known to be used by a particular company. If the password is weak, this can take a matter of days.

Thankfully, for those customers using a Super Hub 2, changing a weak password is a fairly straightforward process, a guide to which has been created on our sister site expertreviews.

This once again raises the issue of security in IoT devices, as many companies have been criticised for promoting the increased use of connected devices while failing to adequately protect their users.

Featured Resources

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

Download now

Evaluate your order-to-cash process

15 recommended metrics to benchmark your O2C operations

Download now

AI 360: Hold, fold, or double down?

How AI can benefit your business

Download now

Getting started with Azure Red Hat OpenShift

A developer’s guide to improving application building and deployment capabilities

Download now

Recommended

How LogPoint uses MITRE ATT&CK
Whitepaper

How LogPoint uses MITRE ATT&CK

15 Jan 2021
Weekly threat roundup: Microsoft Defender, Adobe, Mimecast
vulnerability

Weekly threat roundup: Microsoft Defender, Adobe, Mimecast

14 Jan 2021
Mimecast admits hackers accessed users’ Microsoft accounts
Security

Mimecast admits hackers accessed users’ Microsoft accounts

13 Jan 2021
What is public key infrastructure (PKI)?
Security

What is public key infrastructure (PKI)?

12 Jan 2021

Most Popular

IT retailer faces €10.4m GDPR fine for employee surveillance
General Data Protection Regulation (GDPR)

IT retailer faces €10.4m GDPR fine for employee surveillance

18 Jan 2021
Citrix buys Slack competitor Wrike in record $2.25bn deal
collaboration

Citrix buys Slack competitor Wrike in record $2.25bn deal

19 Jan 2021
Should IT departments call time on WhatsApp?
communications

Should IT departments call time on WhatsApp?

15 Jan 2021