7 ms·

Change your passwords: Comcast hushes, minimizes serious hack

92 points by 6cxs2hd6 13y ago

colinbartlett 13y ago
I haven't been a Comcast subscriber in years, but I wonder if my credentials from ages ago could have been compromised?
- erichurkman 13y ago
  Set them up with a unique password; then, even when this situation repeats, you'll only have exposed your Comcast account (likely not that important).
pmorici 13y ago
I really dislike Comcast I wish there was a viable competitor for Internet in my area.
- shakeel_mohamed 13y ago
  +1
- nathancahill 13y ago
  Yes. Going to post a write up shortly on how I waived the $250 installation fee for 105 Mbps internet.
- fernly 13y ago
  Specifically why? Because I am really tired of DSL and comcast is the only broadband I could get.
  - GabrielF00 13y ago
    Monopolistic tendencies. High prices. OK quality. Terrible customer service. They're repeatedly ranked among the worst companies in the US in customer service and they've actually gotten lower scores than the IRS in the American Consumer Satisfaction Index. In the ACSI Comcast's Internet service gets a score of 62 - the lowest of any ISP measured.[1] The IRS gets a 75 for individual e-filers and a 64 for self-employed and small business filers (scores are lower for big business and paper filers)[2]. [1]http://www.theacsi.org/index.php?option=com_content&view=article&id=149&catid=&Itemid=214&c=Comcast&i=Internet+Service+Providers http://www.theacsi.org/index.php?option=com_content&view=art... [2]http://www.theacsi.org/index.php?option=com_content&view=article&id=149&catid=&Itemid=214&c=Comcast&i=Internet+Service+Providers http://www.theacsi.org/index.php?option=com_content&view=art...
    - fernly 13y ago
      Yeah, I am aware of their customer satisfaction ratings. I've no intention of switching away from DirecTv for enterntainment TV, but I pay $39.95/month for 3Mbs download, just tolerable for one video stream with nothing else going on. Seems like every couple months AT&T sends me a splashy brochure begging me to sign up for U-Verse but when I actually tried, it was, "oh, soooo sorry you are just that tiny bit too far from a central office for us to promise anything better than 3Mbs..." (in their own customer demo center the video on display was clearly posterized and pixellated -- not confidence-building). So I am kind of driven to consider "xfinity" for internet only. (Or moving. Perhaps to Europe.)
      - namityadav 13y ago
        I just switched from AT&T U-verse to Comcast 30Mbps because my newly purchased house can't get U-verse. However, almost everything (streaming, gaming, downloads, etc) has been poor since I switched. Usually at the 1Mbps mark. Major internet speed tests show my speed as 30Mbps, but unpopular ones show my speed as 1Mbps. As if Comcast is throttling everything else, and giving very high priority to major speed test servers. I've talked to their customer service multiple times, but no luck. Oh, and this is after spending at least a total of 5 hours (I had to call them 7 times. Yes, I was counting!) with their customer service over the past few months trying to get them to mark my newly purchased modem from Amazon as my own modem, and stop charging me a modem lease fee. If there was even a single competitor that could provide me even decent internet service, I'd switch to them today!
- mcpherrinm 13y ago
  Really? I am new to the US but I have been really happy with my Comcast. Self install was easy and quick, billing has always worked out fine, and while not super affordable, 50mbit is the fastest internet I've ever had at home. IPv6 too!
  - hueving 13y ago
    Are you still on an introductory rate? Wait until you see the 'real' prices and after that and you will start to being the path to hating your cable provider.
    - existencebox 13y ago
      There's a trick to this. When signing up on the promo rate, make sure to discuss any terms of extending the promo/getting it reissued. One of two things will happen. A. they will say "that'll be easy, just ask before it runs out and we can fix it" or B. They will say "we can't do that"; in which case you ask if you can cancel and restart your service to re-get the special deals and they'll get confused, potentially ask a manager, and then say "I guess so." (they'll first make a huff about if your card appears in the system making you ineligable for the new deals, but you can fix this by either making enough of a huff, or using your spouses/your own alternate card, for example, I have a visa and a master card.) In either case, when your deal is about to run out, call them up again, ask for the extension. There's a chance they may _just give it to you_ if the attendant is feeling very friendly, but usually you have to ask to get sent to customer retention (the magic words in all of this) and then tell retention EXACTLY WHAT YOU SAID INITIALLY WHEN YOU BOUGHT THE SERVICE THAT EXTENDING IT WAS POSSIBLE. I don't know whether it's verifiable, I just know that this pattern works, and I'd rather not be lying to them, so I always make sure to ask on the front end. Every time I've done this, in this manner (over the last.... 6-12 renewals?) I've gotten the initial price again, slight deviations from this script result only in a partial time extension/no extension at all. Long story short version; you know comcast is terrible when you have enough experimental data to draw out some crude state diagrams of how to get around their terrible support. (I also have decades of stories of getting charged for them to repair nonworking internet that was their own fault, lying about services I asked for, charging me for services I didn't sign up for, and taking up what is at this point probably man-weeks of my life just trying to resolve billing and service issues.) Man. This did not set out to be such a rant, guess there was really some latent Comcast hatred in there...
TrainedMonkey 13y ago
Can someone confirm exposure level? From article it seems only comcast email and forum servers were hacked. Comcast user here, wondering if I need to change comcast account password.
- thezilch 13y ago
  Just do it; assume the worst; save yourself real trouble.
  - TrainedMonkey 13y ago
    Just did it. I checked and it seems they bundle email account even if you never use it.
  - sxates 13y ago
    I have comcast, but have no idea what my account credentials are. I have never logged in to anything for them...
    - AH4oFVbPT4f8 13y ago
      https://login.comcast.net/myaccount/lookup https://login.comcast.net/myaccount/lookup Use that with your service location to get your username and from there do a password reset.
  - vangale 13y ago
    Assuming the worst, for me, means they won't bother patching the Zimbra vulnerability.
- schnable 13y ago
  Your master email account is that same as account that is used to sign into their billing system. So yes you are exposed.
GabrielF00 13y ago
Free HBOGO for everyone!
rikacomet 13y ago
Apparently they did more. On 8th Feb, I had these two IP addresses checking out my who.is page. 64.246.165.10 216.145.14.142 I was certainly only curious, because it was a unpublished website with deny-all for all robots., so tried a reverse-ip using Who.is; To my surprise, the who.is page for the above two I.P. didn't load, thought it was maybe my connection, but then, when I used Whois.net to end up with the same result, I knew something was going on. It was only after I googled the I.P address I found some dutch reverse I.P sites that said it was from comcast servers. Though I have nothing worth hiding, and it was just a testing ground for me, this was apparently not nice. I only got to know about the hack yesterday. Perhaps they bulk collected data, using comcast servers?
- dangrossman 13y ago
  Those IPs have nothing to do with Comcast; they're not owned, hosted by or routed through Comcast. They both resolve to whois.sc -- a whois lookup site; indexing whois records is what they do. # nslookup 64.246.165.10 10.165.246.64.in-addr.arpa name = www.whois.sc. # nslookup 216.145.14.142 142.14.145.216.in-addr.arpa name = www.whois.sc.
- conorclearshot 13y ago
  How do you find who's being doing a whois on you?
josefresco 13y ago
It's impossible for me to change my Comcast password ... let me explain. I have a "custom" email address for my Comcast account. I have never used the Comcast provided email or login (customer for 10+ years). Many years ago when I signed up I managed to setup my own email and have used it ever since. Fast forward 5 years and I'm attempting to authenticate an iPad TV app with my Comcast account and I have a brain freeze on my password. I attempt a reset and it doesn't' work. I try again, and again, from differing machines and finally call. Long story short they have no record of my email and can't reset the password. My only option is to revert to the Comcast supplied email which I have never used and don't even know. Luckily I remembered my password and was able to simply move on but was shocked that there was simply no official way for me to retrieve or reset my password yet I have an account that still works (even for billing)
- dec0dedab0de 13y ago
  Support will reset your password if you verify your information with them. I just had to do this for my mom so she could watch the Olympics on her ipad.
  - josefresco 13y ago
    I tried (via telephone) and they basically told me it was impossible, they had no record of my email in their system. This could have been simply incompetent support, however as I successfully guessed my old password I didn't feel like wasting another hour explaining my situation to a new rep with a small likelihood of solving or even improving my situation.

92 points by 6cxs2hd6 13y ago

colinbartlett 13y ago

I haven't been a Comcast subscriber in years, but I wonder if my credentials from ages ago could have been compromised?

erichurkman 13y ago
Set them up with a unique password; then, even when this situation repeats, you'll only have exposed your Comcast account (likely not that important).

pmorici 13y ago

I really dislike Comcast I wish there was a viable competitor for Internet in my area.

shakeel_mohamed 13y ago
+1
nathancahill 13y ago
Yes. Going to post a write up shortly on how I waived the $250 installation fee for 105 Mbps internet.
fernly 13y ago
Specifically why? Because I am really tired of DSL and comcast is the only broadband I could get.
- GabrielF00 13y ago
  Monopolistic tendencies. High prices. OK quality. Terrible customer service. They're repeatedly ranked among the worst companies in the US in customer service and they've actually gotten lower scores than the IRS in the American Consumer Satisfaction Index. In the ACSI Comcast's Internet service gets a score of 62 - the lowest of any ISP measured.[1] The IRS gets a 75 for individual e-filers and a 64 for self-employed and small business filers (scores are lower for big business and paper filers)[2]. [1]http://www.theacsi.org/index.php?option=com_content&view=article&id=149&catid=&Itemid=214&c=Comcast&i=Internet+Service+Providers http://www.theacsi.org/index.php?option=com_content&view=art... [2]http://www.theacsi.org/index.php?option=com_content&view=article&id=149&catid=&Itemid=214&c=Comcast&i=Internet+Service+Providers http://www.theacsi.org/index.php?option=com_content&view=art...
  - fernly 13y ago
    Yeah, I am aware of their customer satisfaction ratings. I've no intention of switching away from DirecTv for enterntainment TV, but I pay $39.95/month for 3Mbs download, just tolerable for one video stream with nothing else going on. Seems like every couple months AT&T sends me a splashy brochure begging me to sign up for U-Verse but when I actually tried, it was, "oh, soooo sorry you are just that tiny bit too far from a central office for us to promise anything better than 3Mbs..." (in their own customer demo center the video on display was clearly posterized and pixellated -- not confidence-building). So I am kind of driven to consider "xfinity" for internet only. (Or moving. Perhaps to Europe.)
    - namityadav 13y ago
      I just switched from AT&T U-verse to Comcast 30Mbps because my newly purchased house can't get U-verse. However, almost everything (streaming, gaming, downloads, etc) has been poor since I switched. Usually at the 1Mbps mark. Major internet speed tests show my speed as 30Mbps, but unpopular ones show my speed as 1Mbps. As if Comcast is throttling everything else, and giving very high priority to major speed test servers. I've talked to their customer service multiple times, but no luck. Oh, and this is after spending at least a total of 5 hours (I had to call them 7 times. Yes, I was counting!) with their customer service over the past few months trying to get them to mark my newly purchased modem from Amazon as my own modem, and stop charging me a modem lease fee. If there was even a single competitor that could provide me even decent internet service, I'd switch to them today!
mcpherrinm 13y ago
Really? I am new to the US but I have been really happy with my Comcast. Self install was easy and quick, billing has always worked out fine, and while not super affordable, 50mbit is the fastest internet I've ever had at home. IPv6 too!
- hueving 13y ago
  Are you still on an introductory rate? Wait until you see the 'real' prices and after that and you will start to being the path to hating your cable provider.
  - existencebox 13y ago
    There's a trick to this. When signing up on the promo rate, make sure to discuss any terms of extending the promo/getting it reissued. One of two things will happen. A. they will say "that'll be easy, just ask before it runs out and we can fix it" or B. They will say "we can't do that"; in which case you ask if you can cancel and restart your service to re-get the special deals and they'll get confused, potentially ask a manager, and then say "I guess so." (they'll first make a huff about if your card appears in the system making you ineligable for the new deals, but you can fix this by either making enough of a huff, or using your spouses/your own alternate card, for example, I have a visa and a master card.) In either case, when your deal is about to run out, call them up again, ask for the extension. There's a chance they may _just give it to you_ if the attendant is feeling very friendly, but usually you have to ask to get sent to customer retention (the magic words in all of this) and then tell retention EXACTLY WHAT YOU SAID INITIALLY WHEN YOU BOUGHT THE SERVICE THAT EXTENDING IT WAS POSSIBLE. I don't know whether it's verifiable, I just know that this pattern works, and I'd rather not be lying to them, so I always make sure to ask on the front end. Every time I've done this, in this manner (over the last.... 6-12 renewals?) I've gotten the initial price again, slight deviations from this script result only in a partial time extension/no extension at all. Long story short version; you know comcast is terrible when you have enough experimental data to draw out some crude state diagrams of how to get around their terrible support. (I also have decades of stories of getting charged for them to repair nonworking internet that was their own fault, lying about services I asked for, charging me for services I didn't sign up for, and taking up what is at this point probably man-weeks of my life just trying to resolve billing and service issues.) Man. This did not set out to be such a rant, guess there was really some latent Comcast hatred in there...

TrainedMonkey 13y ago

Can someone confirm exposure level? From article it seems only comcast email and forum servers were hacked. Comcast user here, wondering if I need to change comcast account password.

thezilch 13y ago
Just do it; assume the worst; save yourself real trouble.
- TrainedMonkey 13y ago
  Just did it. I checked and it seems they bundle email account even if you never use it.
- sxates 13y ago
  I have comcast, but have no idea what my account credentials are. I have never logged in to anything for them...
  - AH4oFVbPT4f8 13y ago
    https://login.comcast.net/myaccount/lookup https://login.comcast.net/myaccount/lookup Use that with your service location to get your username and from there do a password reset.
- vangale 13y ago
  Assuming the worst, for me, means they won't bother patching the Zimbra vulnerability.
schnable 13y ago
Your master email account is that same as account that is used to sign into their billing system. So yes you are exposed.

GabrielF00 13y ago

Free HBOGO for everyone!

rikacomet 13y ago

Apparently they did more. On 8th Feb, I had these two IP addresses checking out my who.is page. 64.246.165.10 216.145.14.142 I was certainly only curious, because it was a unpublished website with deny-all for all robots., so tried a reverse-ip using Who.is; To my surprise, the who.is page for the above two I.P. didn't load, thought it was maybe my connection, but then, when I used Whois.net to end up with the same result, I knew something was going on. It was only after I googled the I.P address I found some dutch reverse I.P sites that said it was from comcast servers. Though I have nothing worth hiding, and it was just a testing ground for me, this was apparently not nice. I only got to know about the hack yesterday. Perhaps they bulk collected data, using comcast servers?

dangrossman 13y ago
Those IPs have nothing to do with Comcast; they're not owned, hosted by or routed through Comcast. They both resolve to whois.sc -- a whois lookup site; indexing whois records is what they do. # nslookup 64.246.165.10 10.165.246.64.in-addr.arpa name = www.whois.sc. # nslookup 216.145.14.142 142.14.145.216.in-addr.arpa name = www.whois.sc.
conorclearshot 13y ago
How do you find who's being doing a whois on you?

josefresco 13y ago

It's impossible for me to change my Comcast password ... let me explain. I have a "custom" email address for my Comcast account. I have never used the Comcast provided email or login (customer for 10+ years). Many years ago when I signed up I managed to setup my own email and have used it ever since. Fast forward 5 years and I'm attempting to authenticate an iPad TV app with my Comcast account and I have a brain freeze on my password. I attempt a reset and it doesn't' work. I try again, and again, from differing machines and finally call. Long story short they have no record of my email and can't reset the password. My only option is to revert to the Comcast supplied email which I have never used and don't even know. Luckily I remembered my password and was able to simply move on but was shocked that there was simply no official way for me to retrieve or reset my password yet I have an account that still works (even for billing)

dec0dedab0de 13y ago
Support will reset your password if you verify your information with them. I just had to do this for my mom so she could watch the Olympics on her ipad.
- josefresco 13y ago
  I tried (via telephone) and they basically told me it was impossible, they had no record of my email in their system. This could have been simply incompetent support, however as I successfully guessed my old password I didn't feel like wasting another hour explaining my situation to a new rep with a small likelihood of solving or even improving my situation.