Virgin Media O2 UK Still Suffers Router Bug that Exposes VPN IPs

Broadband ISP Virgin Media UK (VMO2) has confirmed to ISPreview.co.uk that they’ve yet to fix a long-running security issue in their HUB 3.0 routers (ARRIS TG2492), which among other things could be used to “silently unmask” the actual, ISP issued, IP address of Virtual Private Network (VPN) users.

A Virtual Private Network (VPN) operates a bit like a network within a network. Such services essentially sit in their own secure and encrypted layer on top of your main internet connection, which routes your traffic over the VPNs own servers and assigns you a different Internet Protocol (IP) address from your ISP.

Suffice to say, VPNs add some extra security to your internet connection, which is especially useful (we’d say essential) when remote working or travelling on holiday (it’s wise to never trust public WiFi or Hotel connections etc.). But at the same time, this does mean putting a lot of trust in the VPN provider itself.

In any case, the one thing that a VPN user really wouldn’t like is for their real – ISP assigned – IP address to be exposed, which appears to be exactly what the aforementioned exploit in Virgin Media’s widely used HUB 3.0 router would allow.

The vulnerability was first discovered by security researchers at Fidus back in October 2019, which was acknowledged by Virgin Media two days later. But in February 2020 the operator requested that Fidus hold back on public disclosure until Q1 2021 and the group agreed. Since then, Fidus has, on several occasions, attempted to secure an update from VM, but none was forthcoming. Details on the issue were then published in March 2021.

Fidus’ Description of CVE-2019-16651

Fidus’ R&D team identified a vulnerability within Virgin Media Super Hub 3 routers that permitted for exfiltration of sensitive information remotely, which, among other things, can be used to determine the actual, ISP issued IP address of VPN users. A vulnerability we were asked to hold back from releasing for a whole year.

A DNS rebinding attack is utilised to reveal a user’s actual IP address by simply visiting a webpage for a few seconds. This has been made graphical for Proof of Concept purposes, but it is important to note this can be silently executed. During our testing, it was possible to unmask the true IP address of users across multiple popular VPN providers – resulting in complete deanonymisation.

The underlying model of router (ARRIS TG2492) and related models are a series of DOCSIS fibre routers known to be used by multiple ISPs around the world, many of which are owned by Liberty Global, who also owns Virgin Media.

In short, such an attack, which involves some DNS rebinding (i.e. manipulating the resolution of domain names), only takes a matter of seconds and a user’s actual underlying IP address can thus be unmasked by doing something as simple as visiting a URL (website / web page). But constructing that attack does take a bit more effort, and it’s unclear if anybody is actively deploying it.

We note how the exploit that Fidus found worked with some VPN providers, but not all. For example, a VPN provider that blocks access to local IP addresses by default will prevent this attack, but many such providers do not do that.

Needless to say, Virgin Media’s seeming inability to respond to Fidus’ requests for an update on their progress toward a resolution led us, following a prompt from one of our readers (credits to Wayne), to chase the operator up. Sadly, they haven’t fixed it yet, which probably explains their earlier silence.

A Virgin Media spokesperson told ISPreview.co.uk:

“We are aware of a highly technical issue which, in very particular circumstances, could impact customers using a VPN while accessing a malicious website. A very specific set of circumstances would need to be in place for a customer to be impacted, meaning that the risk to them is very low.

We have strong security measures in place to protect our network and keep our customers secure. We are not aware of any customers being affected by this issue and they do not need to take any action.”

The fact that a patch has yet to be produced for the HUB 3.0 suggests that it may still be impacting other cable operators that supply the same device from ARRIS. But in Virgin Media’s mind, only a small portion of their base actually use a VPN (small is a relative term when you have 5.5 million+ customers), although that will be little consolation to those who do.

The severity of all this does perhaps depend, at least in part, on how you view the exposure of an ISP supplied IP address in general. Customers who use the internet on a general day-to-day basis will, as a matter of course, be exposing their IP address when visiting any website. But obviously, if one of your expectations when using a VPN is not to expose your ISP assigned IP address, then this may be a much bigger issue.

Arguably the bigger concern here is the passage of time and how the issue, despite being reported two whole years ago, still hasn’t been fixed. Virgin Media did inform us that they were working on a technical fix, which could be implemented while avoiding disruption for all of their customers. But there’s no indication of how much longer that will take before it’s deployed.