Six million Sky routers had serious security flaw

guest · Nov 19, 2021

Six million Sky routers had serious security flaw
November 19, 2021
https://www.bbc.co.uk/news/technology-59332840

The problem has been fixed - but researchers say it took Sky 18 months to address.

The vulnerability could have affected anyone who had not changed the router's default admin password.

"After being alerted to the risk, we began work on finding a remedy for the problem and we can confirm that a fix has been delivered to all Sky-manufactured products."
Click to expand...

Stealing passwords
The flaw in software code, found by researcher Raf Fini, from Pen Test Partners, would have allowed a hacker to reconfigure a home router simply by directing the user to a malicious website via a phishing email.

And then they could "take over someone's online life", stealing passwords for banking and other websites, Pen Test Partner's Ken Munro told BBC News.
There was no evidence the flaw had been exploited but the delay fixing it was baffling, he said.
Click to expand...

Anyone with a router should change passwords from the ones set by default, Mr Munro added.
Click to expand...

Pen Test Partners: SkyFail. 6 million routers left exposed

TL;DR

Around 6 million Sky routers were vulnerable to a DNS rebinding vulnerability that allowed a customer’s home network to be compromised from the internet.

It affected users with the default router’s admin password (admin:sky), which was the case for a high percentage of routers. Brute force of non-default creds was also possible.

Vulnerable users could have their home network exposed to the internet, allowing direct access to computers and devices.

The attack happened when a user clicks on a malicious link or visited a malicious website.

Sky did not prioritise fixing the issue, taking nearly 18 months to fully resolve it, failing to meet numerous deadlines they set themselves

Despite having a published vulnerability disclosure programme, Sky’s communications were particularly poor and had to be chased multiple times for responses. Only after we had involved a trusted journalist was the remediation programme accelerated.

Click to expand...

Log in or Sign up

Six million Sky routers had serious security flaw

guest Guest

Log in or Sign up

Six million Sky routers had serious security flaw

guest Guest

Useful Searches