Customers of O2 UK could be at risk after one of the ISPs users claimed to have discovered a serious security vulnerability in the operators home broadband routers. The issue, which allows remote attackers to access a home users private network and view/change settings on the router, allegedly affects both the O2 Wireless Box II and III.

The threat, which was discovered by Paul Mutton, appears to be a Cross-Site Request Forgery (CSRF) attack that could affect a significant number of O2's 456,882 broadband customers. The O2 Wireless Box III is a branded version of the Thomson TG585n router, which is also used by other UK / EU ISPs and users - highlighting the potential for serious widespread impact.


The implication appears to be that a hacker could abuse this exploit via an Internet website and thus remotely gain unauthorised access to an O2 customer’s broadband router. Such a serious flaw should surely deserve O2's immediate attention, yet Mutton has had a different experience:


Naturally we attempted to contact O2 for ourselves, in the hope of finding out precisely what the situation is. The operator responded by claiming that it has taken steps to ensure customers are aware of how to change their settings and protect themselves from the vulnerability.


It is difficult to know whether O2's advice would be effective because Paul has wisely chosen not to release his proof of concept code to the public. Still, he claims that the O2 recommendations would not protect against this kind of CSRF attack.

Paul has since setup a new website page, which details his many attempts and difficulty at getting O2 to recognise and fix the flaw - http://www.jibble.org/o2-broadband-fail/ . It represents an extremely damning report of the operators seeming inability to recognise the problem.


Presently O2 have requested that Paul escalate his concern via the O2 complaint process, which requires him to send a detailed explanation via the slow postal service. That's perhaps not the fastest way to deal with what could be an extremely serious security flaw affecting thousands, maybe even hundreds of thousands, of customers.

UPDATE - 2nd September 2009 @ 08:32am:

UK ISP O2 and its sister provider Be Broadband are now taking the problem seriously, likewise another UK ISP Zen Internet has said that it is raising the problem with Thomson too. O2 has also apologised for the way the situation has been handled so far.



UPDATE - 4th September 2009:

It's now been FIXED.