Home » 

UK ISP News Archives

 » 
Sponsored Links

ISP O2 UK Fixes Wireless Box Broadband CSRF Vulnerability after 6 Months

Posted: 18th Feb, 2010 By: MarkJ
o2 logoPaul Mutton, the man responsible for unearthing a Cross-Site Request Forgery (CSRF) attack vulnerability in O2's Wireless Box II and III (Thomson TG585 and TG585n) broadband routers last year (here), recently informed us that the problem had not been correctly resolved.

The situation is particularly unusual because an O2 spokesperson told us last September that the operator had, "identified a solution" and would "be applying this remotely to all of our customers O2 wireless boxes" (here). Needless to say O2 did not offer a time frame but 5-6 months is surely far too long to wait for a proper solution.

Upon contacting several of O2's customers we were able to confirm that some of their O2 Wireless Box II and Wireless Box III broadband routers still had vulnerable firmware. This matched Mr Mutton's experienced and appeared to confirm that O2 had not corrected the problem for everybody.

Paul Mutton blogged:

"I asked O2 whether this was going to be fixed, and I was told that I could resolve it by performing a hard reset of my router. I was rather sceptical of this working, and indeed it did not fix the problem. I'm truly disappointed by this. From my point of view at least, O2 does not appear to have fixed the firmware.

...

For avoidance of doubt, I have just re-run the proofs of concept that I came up with last year and these confirm that the O2 Wireless Box III is still vulnerable to CRSF attacks that allow an attacker to steal your WEP/WPA key, set up port forwarding, and so on. I don't think that's an acceptable position to leave customers in, particularly more than 5 months after claiming to have identified a solution."

We have subsequently been in contact with O2 throughout the week and are pleased to say that they have now taken action to correct the mistake. It’s understood that the operator’s temporary 2009 fix could have been wiped off by a hard reset, which the new firmware will not be susceptible to.

An O2 Spokesperson told ISPreview:

"The factory reset done with Mr Mutton on 13 February wiped off the temporary fix put in place last year. We have now pushed new firmware to the router that can’t be removed by performing a factory reset, as part of a rollout to all affected customers which fixes the underlying issues."

The update (8.2.N.1 for Wireless Box III owners) is expected to be rolled out to customers in the very near future (hopefully without another 6 month wait). In the meantime O2 has very kindly gifted Paul a year's free broadband to make up for the hassle.
Search ISP News
Search ISP Listings
Search ISP Reviews
 Latest UK ISP News
 Cheap BIG ISPs for 100Mbps+
Community Fibre UK ISP Logo
150Mbps
Gift: First 3 Months Free
Vodafone UK ISP Logo
Vodafone £23.00
150Mbps
Gift: None
Youfibre UK ISP Logo
Youfibre £23.99
150Mbps
Gift: None
NOW UK ISP Logo
NOW £25.00
100Mbps
Gift: None
Virgin Media UK ISP Logo
Virgin Media £25.99
132Mbps
Gift: None
150,000+ Customers | View More ISPs
 Cheapest ISPs for 100Mbps+
BeFibre UK ISP Logo
BeFibre £19.00
150Mbps
Gift: None
Gigaclear UK ISP Logo
Gigaclear £19.00
300Mbps
Gift: None
Community Fibre UK ISP Logo
150Mbps
Gift: First 3 Months Free
toob UK ISP Logo
toob £22.00
150Mbps
Gift: None
Vodafone UK ISP Logo
Vodafone £23.00
150Mbps
Gift: None
Modest Availability | View More ISPs
Cheap BIG ISPs for 100Mbps+
Community Fibre UK ISP Logo
150Mbps
Gift: First 3 Months Free
Vodafone UK ISP Logo
Vodafone £23.00
150Mbps
Gift: None
Youfibre UK ISP Logo
Youfibre £23.99
150Mbps
Gift: None
NOW UK ISP Logo
NOW £25.00
100Mbps
Gift: None
Virgin Media UK ISP Logo
Virgin Media £25.99
132Mbps
Gift: None
Large Availability | View All
Cheapest ISPs for 100Mbps+
BeFibre UK ISP Logo
BeFibre £19.00
150Mbps
Gift: None
Gigaclear UK ISP Logo
Gigaclear £19.00
300Mbps
Gift: None
Community Fibre UK ISP Logo
150Mbps
Gift: First 3 Months Free
toob UK ISP Logo
toob £22.00
150Mbps
Gift: None
Vodafone UK ISP Logo
Vodafone £23.00
150Mbps
Gift: None
Large Availability | View All
Sponsored Links
The Top 15 Category Tags
  1. FTTP (6150)
  2. BT (3691)
  3. Politics (2775)
  4. Business (2480)
  5. Openreach (2446)
  6. Building Digital UK (2364)
  7. Mobile Broadband (2199)
  8. FTTC (2094)
  9. Statistics (1951)
  10. 4G (1855)
  11. Virgin Media (1811)
  12. Ofcom Regulation (1614)
  13. Fibre Optic (1489)
  14. Wireless Internet (1477)
  15. 5G (1452)
Sponsored

Copyright © 1999 to Present - ISPreview.co.uk - All Rights Reserved - Terms  ,  Privacy and Cookie Policy  ,  Links  ,  Website Rules