8 ms·
Comcast is leaking the names and passwords of customers’ wireless routers
- hedora 8y agoResponsible disclosure?
- RandomBK 8y agoThe linked article mentions: "Comcast, when contacted prior to publication, did not comment." However, when I go on the activation page, it prompts for either a Comcast login or SMS verification, so this may have been fixed.
- lawnchair_larry 8y agoIt’s “responsible” to let the public know that they are exposed to this.
- strictnein 8y agoTo take advantage of this, you need the target's account number. Not impossible to get, but it's also not something you can readily get your hands on.
- DmenshunlAnlsis 8y agoYou could probably find it in most peoples’ trash, reliably, intact, on a regular schedule.
- mcbutterbunz 8y agoOne more reason to enter into paperless statements.
- mamon 8y agoOr to buy a shredder.
- oneeyedpigeon 8y agoThat negates many of the other reasons to go paperless, though.
- slumberlust 8y agoDon't buy a shredder. Buy the Shredder: https://smile.amazon.com/Teenage-Mutant-Ninja-Turtles-Figure/dp/B00007KQCU?sa-no-redirect=1 https://smile.amazon.com/Teenage-Mutant-Ninja-Turtles-Figure...
- Clubber 8y agoYa, but that's pretty out there. The big problem with vulnerabilities is millions of hackers from all over the world can actively exploit them at the same time. If you limit it to someone digging in your trash, you would have to be a pretty high value target for someone to go through that. I wouldn't expect anyone in my neighborhood to go through that for free internet.
- Retric 8y agoIt's common for apartments to have trash can in their mail room that's just got mail in it. So, it's not going to be unclean and being able to leech internet is likely worth it for many people.
- IncRnd 8y agoYou fundamentally misunderstand the attack. Nobody needs to dig in your trash. A malicious third party only needs one account number/address from any Comcast customer. With that, they can use your equipment to download child porn or launch illegal traffic that will trace back to you.
- gwbas1c 8y agoUpvoted. A lot of the security breeches we see are, in practice, extremely difficult to exploit. If I had a Comcast router, (which I don't,) I wouldn't worry one about this exploit. (As long as it's fixed in a timely manner.)
- alasdair_ 8y agoSure, unless you have a stalker-ish ex, or you're a politician, or you've ever had someone else pay your bill, or you once had a bit of mail go missing or...
- sykh 8y agoI have Comcast and my own modem/router. It’s a good idea to have your modem/router as the article suggests but you’ll have to be tech savvy enough to counteract Comcasts’ tech support people. Every time there is an issue with the internet connection their tech support always say it’s my modem/router that is the problem and that I need to use a Comcast supplied modem/router. It’s annoying and those who are not savvy enough will capitulate and get Comcasts’ equipment. I hate Comcast and would gladly pay another company double what I pay for internet service with similar speeds. Alas, no such competition exists is my area. I hope Comcast goes bankrupt some day.
- gnicholas 8y agoYep, and you have to also watch out for their multiple EOL lists. I have a modem that has been EOL'd if it's a leased modem (meaning they will give you a new one if you're leasing it) but has explicitly not been EOL'd if it's customer-owned. But guess how many Comcast reps catch that distinction? None, of course. Even when I show them their own page that explains this, they insist that I need to get a new modem.
- Mrtierne 8y agoI have Spectrum and the best decision I ever made was buying my own modem and router. I've had zero issues since and consistent speeds.
- dhimes 8y agoI second this. With Comcast (business). No complaints coming up on the first year. Caveat: I don't need blinding speed to push code back and forth. Verizon DSL was fine, actually, when I used that.
- Onawa 8y agoI was in the same situation. Their all-in-one modem/router is the most insufferable piece of equipment I've ever had to work with. Trying to do any kind of video chat using it was a nightmare with constant freezing and buffering issues even when standing right next to it. Bought my own Surfboard and TP-Link router and installed DDWRT and have been free of most issues since then except one. I randomly lost internet connection once and tried everything that I could to get it back up and running. Finally got a technician out and he showed me that sometimes you have to keep the power on the surfboard and only unplug/replug the coaxial cable to the wall and then it will start working again. I had never seen an issue like that before in my life and I'm still trying to figure out why that fixed it.
- em3rgent0rdr 8y agoearlier post: https://news.ycombinator.com/item?id=17122312 https://news.ycombinator.com/item?id=17122312
- ocdtrekkie 8y agoYou should most likely be shutting off the Wi-Fi on a Comcast-owned gateway anyways: The wireless they provide is trash to begin with, and you have less options and ability to ensure it's running modern firmware.
- stephengillie 8y agoAlso it allows any Comcast customer to leech off your bandwidth. That's what those Xfinity wifi hotspots are, you sign in with your Xfinity user/pass.
- gergles 8y agoThere's a separate DOCSIS QoS stream allocated for it, it isn't using "your" bandwidth. (Of course, there's only so much uplink at the CMTS, but...)
- jerf 8y agoAs someone who occasionally uses the xfinity login while out and about, you can tell it is absolutely on a separate stream because it definitely gets reduced service. I haven't run a speed test on it formally, but it definitely gets less bandwidth than the customer wifi signal, and I'd swear it has some latency added to it just to ensure that it's a nicer alternative to cell signals but not something you want to use full time.
- thrownaway954 8y agois there a way to verify this? I have wifi turned on and restrict connections to certain devices so how could I tell?
- stephengillie 8y agoThey won't show up on your local network. They're on a type of guest wifi. If you connect to your local Xfinity wifi connection, you might be able to sniff them out, if the wifi allows "promiscuous" connections. (Promiscuous mode works because LANs are like cell networks - they operate on an "honor system", where all devices on the network receive all IP packets, but ignore those which don't match their address.)
- chatmasta 8y agoPSA: Any problems you have with Comcast, you can solve with a sternly worded email to their “executive support” secret email: Comcast_CustomerSupport@cable.comcast.com Comcast_ESC@cable.comcast.com
- SpaceManiac 8y agoThanks for the tip. Maybe if I complain with just the right tone I can get them to stop injecting "you have used 75% of your monthly bandwidth" popups into my HTTP responses >:(
- tbyehl 8y agoThey're very proud of this incarnation of their notification injection system. There have been presentations and an RFC. https://tools.ietf.org/html/rfc6108 https://tools.ietf.org/html/rfc6108
- josefresco 8y agoJust complain on Twitter. Works every time, even if you didn't want help and were just venting.
- tbyehl 8y agohttps://support.xfinity.com/svp-contact-form https://support.xfinity.com/svp-contact-form This is another path to the Executive Escalation team. IME, they respond quickly and get stuff done.
- Yhippa 8y agoI've had great success filing regulatory complaints where I have exhausted the help from the company in question: https://www.fcc.gov/consumers/guides/filing-informal-complaint https://www.fcc.gov/consumers/guides/filing-informal-complai.... Companies usually have a team to deal with these and take them seriously.
- calimac 8y agoComcast is like a bloated obese cat. Can you imagine the logic of knowingly doing this and the decision process of justifying it in the development meeting.
- retSava 8y agoWell, why not see it as a feature? Plausible deniability for anything that happens on your wifi, also plausible that it is out of your control.
- deleted 8y ago[deleted]