Security researchers have detailed how a serious flaw in Virgin Media wireless home routers could have allowed hackers to remotely monitor users’ internet traffic.
Context Information Security’s Jan Mitchell and Andy Monaghan explained in a lengthy blog post that they began by reverse engineering software on the Netgear-produced Super Hub 2 and Super Hub 2AC models.
The vulnerability in question stems from a feature in the routers which allows users to create backups of custom configurations, which can then be restored at a later date.
Although the back-ups in question were encrypted, the developers made the mistake of having the same private encryption key for all hubs in the UK.
This means that a determined attacker with access to the admin interface of a targeted hub could download a config file, enter instructions to enable remote access, and then restore that file to the hub.
This would give them complete remote access to all traffic flowing in and out of the home router.
“The Super Hub represents the default home router offering from one of the UK’s largest ISPs and is therefore present in millions of UK households, making it a prime target for attackers,” explained Context principal security researcher, Andy Monaghan.
“While ISP-provided routers like this are generally subject to more security testing than a typical off-the-shelf home router, our research shows that a determined attacker can find flaws such as this using inexpensive equipment.”
The good news is that Virgin Media responded positively to the research, sitting down with the Context team and Netgear to develop and test patches to fix the issues highlighted.
In May the broadband giant rolled out the fix as part of its scheduled updates.
Netgear recently partnered with security testing organization Bugcrowd to improve the way it deals with disclosures.
In January an authentication vulnerability was discovered by Trustwave which it was claimed could have affected over a million customers.