Time Warner Cable Modems Expose Users

eldavojohn writes "Wired is reporting on a simple hack putting some 65,000 customers at risk. The hack to gain administrative access to the cable modem/router combo is remarkably simple: '[David] Chen, founder of a software startup called Pip.io, said he was trying to help a friend change the settings on his cable modem and discovered that Time Warner had hidden administrative functions from its customers with Javascript code. By simply disabling Javascript in his browser, he was able to see those functions, which included a tool to dump the router's configuration file. That file, it turned out, included the administrative login and password in cleartext. Chen investigated and found the same login and password could access the admin panels for every router in the SMC8014 series on Time Warner's network — a grave vulnerability, given that the routers also expose their web interfaces to the public-facing internet.' If you use Time Warner's SMC8014 series cable modem/Wi-Fi router combo, watch for firmware to be released soon that they are reportedly in the process of testing."

Comments

VErizon FiOS routers do something similar

[140Mandak262Jamuna]

I was very much worried when I got Verizon FiOS. The Verizon supplied router is actually a linux box that has a web server and it throws a username/password dialog to the WAN side. I was worried so much I had another old router behind the Verizon router and connected my machines to this second router. But the other router was old and it maxed out at 10Mbps and FiOS was delivering 20Mbps. So I did some googling. Found that Verizon has been shipping that kind of routers for more than 5 years and so far no hack has been found. So I removed my second line of defense. Looks like it is a prudent idea to buy a more capable modern router and protect the machines from possible future hacks.