{"id":14050,"date":"2017-06-12T11:07:57","date_gmt":"2017-06-12T10:07:57","guid":{"rendered":"http:\/\/www.ispreview.co.uk\/?p=14050"},"modified":"2017-06-12T11:08:16","modified_gmt":"2017-06-12T10:08:16","slug":"virgin-media-fixes-security-flaw-superhub-2-2ac-backup-system","status":"publish","type":"post","link":"https:\/\/www.ispreview.co.uk\/index.php\/2017\/06\/virgin-media-fixes-security-flaw-superhub-2-2ac-backup-system.html","title":{"rendered":"Virgin Media Fixes Security Flaw in SuperHub 2 and 2AC Backup System"},"content":{"rendered":"

Cable operator Virgin Media<\/a> has patched a security flaw in their NETGEAR based SuperHub 2 (VMDG485) and 2AC (VMDG490) broadband routers, which meant that a hacker could abuse a file backup routine for the device’s configuration and use it to gain admin level access.<\/p>\n

The vulnerability was discovered by researchers at Context<\/strong> and a detailed account of what they found has been posted online (here<\/a>). Most routers include a backup feature, which allows you to save your custom router configuration \/ settings to an external file on your computer (useful if your device ever needs a hard-reset or you lose your settings and need to restore them etc.).<\/p>\n

The backup files are encrypted but unfortunately the private key that is used for this was found to be the same across all SuperHubs in the UK, which makes it easy for a hacker with access to the router’s admin interface (granted you’d already have to be on their network) to download a config file, add some naughty code (e.g. enable remote access) and then restore the file back to the hub.<\/p>\n

Context’s Timeline<\/strong><\/span><\/p>\n

On discovering these issues, Context reported them to Virgin Media<\/a> and provided proof-of-concept code. After verifying our findings, Virgin Media<\/a> worked with us to develop mitigations which were released as part of their existing firmware patching cycle. We would like thank Virgin Media for their professionalism and responsiveness in working with Context to fix this issue.<\/p>\n

The following shows the main events in the disclosure timeline:<\/p>\n