Comcast has just been caught in a major security snafu: revealing the passwords of its customers’ Xfinity-provided wireless routers in plaintext on the web. Anyone with a subscriber’s account number and street address number will be served up the Wi-Fi name and password via the company’s Xfinity internet activation service.
Security researchers Karan Saini and Ryan Stevenson reported the issue to ZDnet.
The site is meant to help people setting up their internet for the first time: ideally, you put in your data, and Comcast sends back the router credentials while activating the service.
The problem is threefold:
- You can “activate” an account that’s already active
- The data required to do so is minimal and it is not verified via text or email
- The wireless name and password are sent on the web in plaintext
This means that anyone with your account number and street address number (e.g. the 1425 in “1425 Alder Ave,” no street name, city, or apartment number needed), both of which can be found on your paper bill or in an email, will instantly be given your router’s SSID and password, allowing them to log in and use it however they like or monitor its traffic. They could also rename the router’s network or change its password, locking out subscribers.
This only affects people who use a router provided by Xfinity/Comcast, which comes with its own name and password built in. Though it also returns custom SSIDs and passwords, since they’re synced with your account and can be changed via app and other methods.
What can you do? While this problem is at large, it’s no good changing your password — Comcast will just provide any malicious actor the new one. So until further notice all of Comcast’s Xfinity customers with routers provided by the company are at risk.
One thing you can do for now is treat your home network as if it is a public one — if you must use it, make sure encryption is enabled if you conduct any private business like buying things online. What will likely happen is Comcast will issue a notice and ask users to change their router passwords at large.
Another is to buy your own router — this is a good idea anyway, as it will pay for itself in a few months and you can do more stuff with it. Which to buy and how to install it, however, are beyond the scope of this article. But if you’re really worried, you could conceivably fix this security issue today by bringing your own hardware to the bargain.
I’ve contacted the company for comment and will update when I hear back.
The United States Postal Service has unveiled new stamps it will be launching this summer, ones that revolve around a hot 80s trend: scratch-and-sniff scents. The scented stamps will feature images of iconic summer treats, such as popsicles and fudge pops, also including the scents that come with each unique treat. It’s a first for the Postal Service, and one … 
The following is a OnePlus 6 Review Companion – this is the article you read after you’ve seen some opinions on the phone. This is a rundown of 10 items of interest for the OnePlus 6 buyer – just before buy, once you’ve bought, and once you’ve got the device in-hand. This device appears first online in less than 24 … 
The Federal Aviation Administration has approved Boeing’s futuristic folding wing design intended for future 777X jetliners. Once launched, these will be the first commercial jets to feature hinged wings, which will rotate and point skyward after the plane touches down. The Boeing 777X is the company’s next evolution, one that builds upon both the 777 and 787 Dreamliner. The 777X … 
Just because Syfy dropped The Expanse doesn’t mean the cult sci-fi hit has met its end. Sources talking to Deadline, Variety and Hollywood Reporter have all claimed that Amazon is in discussions to resurrect The Expanse for a fourth season. Neither…
Given how many photos we tend to take with our phones and cameras, it’s easy to amass hundreds if not thousands of photos over the years. This means that going back in our archives, it can be difficult to try and look for our favorite photos. However if you’re using Google Photos, that could change.
With WWDC 2018 
Just like what you’d expect from a fashion brand, Coach has 
