Comcast Security Flaws Exposed Customers

Comcast Security Flaws Exposed Customers' Data

The company quickly resolved the problem in its Xfinity customer software.

Security flaws in Comcast Xfinity customer software reportedly exposed customers' partial home addresses and social security numbers.

Security researcher Ryan Stevenson found that two vulnerabilities in the internet service provider's online portal for its more than 26.5 million customers left data open to hackers. Comcast patched the vulnerabilities after Buzzfeed News reported the findings.

"We quickly investigated these issues and within hours we blocked both vulnerabilities, eliminating the ability to conduct the actions described by these researchers," a company spokesperson said.

One flaw was found on Xfinity's in-home authentication page, which allowed customers to pay bills without signing in after proving their identity using a partial home address. Hackers could spoof a customer's IP address and refresh the page, allowing them to figure out the partial address as that one would stay through each refresh.

The other vulnerability was in the Comcast Authorized Dealers sign-up page. If a hacker that had a customer's billing address brute-forced it, by trying random four-digit combinations until they happened on the right one, they could get digits of the customer's social security numbers.

The brute-force method was possible because Comcast didn't limit the number of sign-in attempts, but has added a strict rate limit.

Comcast has not gotten any reports to suggest that the flaws were used to compromise the data of any users.

About the Author

Sydny Shepard is the Executive Editor of Campus Security & Life Safety.

Featured

New Products

  • HD2055 Modular Barricade

    Delta Scientific’s electric HD2055 modular shallow foundation barricade is tested to ASTM M50/P1 with negative penetration from the vehicle upon impact. With a shallow foundation of only 24 inches, the HD2055 can be installed without worrying about buried power lines and other below grade obstructions. The modular make-up of the barrier also allows you to cover wider roadways by adding additional modules to the system. The HD2055 boasts an Emergency Fast Operation of 1.5 seconds giving the guard ample time to deploy under a high threat situation.

  • FEP GameChanger

    FEP GameChanger

    Paige Datacom Solutions Introduces Important and Innovative Cabling Products GameChanger Cable, a proven and patented solution that significantly exceeds the reach of traditional category cable will now have a FEP/FEP construction.

  • ResponderLink

    ResponderLink

    Shooter Detection Systems (SDS), an Alarm.com company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols.