Comcast Security Flaws Exposed Customers

Comcast Security Flaws Exposed Customers' Data

The company quickly resolved the problem in its Xfinity customer software.

Security flaws in Comcast Xfinity customer software reportedly exposed customers' partial home addresses and social security numbers.

Security researcher Ryan Stevenson found that two vulnerabilities in the internet service provider's online portal for its more than 26.5 million customers left data open to hackers. Comcast patched the vulnerabilities after Buzzfeed News reported the findings.

"We quickly investigated these issues and within hours we blocked both vulnerabilities, eliminating the ability to conduct the actions described by these researchers," a company spokesperson said.

One flaw was found on Xfinity's in-home authentication page, which allowed customers to pay bills without signing in after proving their identity using a partial home address. Hackers could spoof a customer's IP address and refresh the page, allowing them to figure out the partial address as that one would stay through each refresh.

The other vulnerability was in the Comcast Authorized Dealers sign-up page. If a hacker that had a customer's billing address brute-forced it, by trying random four-digit combinations until they happened on the right one, they could get digits of the customer's social security numbers.

The brute-force method was possible because Comcast didn't limit the number of sign-in attempts, but has added a strict rate limit.

Comcast has not gotten any reports to suggest that the flaws were used to compromise the data of any users.

About the Author

Sydny Shepard is the Executive Editor of Campus Security & Life Safety.

  • How COVID-19 Has Revolutionized Aviation Security How COVID-19 Has Revolutionized Aviation Security

    In this episode of SecurPod, Ralph C. Jensen and Steve Karoly talk about the COVID-19 pandemic and the changes experienced in the aviation security vertical. The pandemic has changed society and our way of life. It has also brought about seismic changes.

Digital Edition

  • Security Today Magazine - April 2021

    April 2021


    • Transforming Security
    • Driving COVID Adaptations
    • A Capitol Breach
    • Running the Gauntlet
    • On a Cloud of its Own

    View This Issue

  • Environmental Protection
  • Occupational Health & Safety
  • Infrastructure Solutions Group
  • Spaces4Learning
  • Campus Security & Life Safety