Slashdot Mirror
Comcast Security Flaw Exposes Partial Addresses, Social Security Numbers of 26 Million Users (buzzfeednews.com)
olsmeister writes: A security flaw in the Comcast Xfinity online portal exposed social security numbers and partial home addresses of more than 26.5 million subscribers, according to security researcher Ryan Stevenson. Comcast says the flaws have already been patched and that it currently has no reason to believe that the flaws were ever exploited. BuzzFeed reports of the two vulnerabilities: One of the flaws could be exploited by going to an "in-home authentication" page where customers can pay their bills without signing in. The portal asked customers to verify their account by choosing from one of four partial home addresses it suggested, if the device was (or seemed like it was) connected to the customer's home network. If a hacker obtained a customer's IP address and spoofed Comcast using an "X-forwarded-for" technique, they could repeatedly refresh this login page to reveal the customer's location. That's because each time the page refreshed, three addresses would change, while one address, the correct address, remained the same. Eventually, the page would show the first digit of the street number and first three letters of the correct street name, while asterisks hid the remaining characters. A hacker could then use IP lookup websites to determine the city, state, and postal code of the partial address.
In the second vulnerability that Stevenson discovered, a sign-up page through the website for Comcast's Authorized Dealers (sales agents stationed at non-Comcast retail locations) revealed the last four digits of customers' Social Security numbers. Armed with just a customer's billing address, a hacker could brute-force (in other words, repeatedly try random four-digit combinations until the correct combination is guessed) the last four digits of a customer's Social Security number. Because the login page did not limit the number of attempts, hackers could use a program that runs until the correct Social Security number is inputted into the form. After learning of these vulnerabilities, Comcast disabled in-home authentication and put a strict rate limit on the portal. Here's what a Comcast spokesperson had to say about the matter: "We quickly investigated these issues and within hours we blocked both vulnerabilities, eliminating the ability to conduct the actions described by these researchers. We take our customers' security very seriously, and we have no reason to believe these vulnerabilities were ever used against Comcast customers outside of the research described in this report."
In the second vulnerability that Stevenson discovered, a sign-up page through the website for Comcast's Authorized Dealers (sales agents stationed at non-Comcast retail locations) revealed the last four digits of customers' Social Security numbers. Armed with just a customer's billing address, a hacker could brute-force (in other words, repeatedly try random four-digit combinations until the correct combination is guessed) the last four digits of a customer's Social Security number. Because the login page did not limit the number of attempts, hackers could use a program that runs until the correct Social Security number is inputted into the form. After learning of these vulnerabilities, Comcast disabled in-home authentication and put a strict rate limit on the portal. Here's what a Comcast spokesperson had to say about the matter: "We quickly investigated these issues and within hours we blocked both vulnerabilities, eliminating the ability to conduct the actions described by these researchers. We take our customers' security very seriously, and we have no reason to believe these vulnerabilities were ever used against Comcast customers outside of the research described in this report."
A local ISP near me puts the device's MAC address into the reverse DNS lookup of every IP address assigned on their network. Just increase/decrease the MAC address by 1 or 2, and you'll usually get the routers WiFi MAC instead of WAN MAC. With the WiFi MAC in hand, you can use publicly available free online tools to geolocate the access point down to about a 2-4 house accuracy. In other words, you can get near-exact physical location of any user on this ISP from just their IP address. ... It has been like this for over a decade too ... Just verified a few minutes ago that it is indeed still in place ...
Oh, buzzfeed. This site is beginning to worry me.
Is there some powerful security model where the data is split up and kept different places? Or just some ass covering weasel-speak? Anonymous Coward wants to know!
Did you mean: Unable to tell if the flaws were ever exploited?
Huh!?
I envision a world, a brave world, brimming with life, awash with wonder and excitement.
Then I open my eyes..
Lot of companies still collect and keep too much sensitive information on customers. Just too bad everyone adopted the SS number as the means of identification for credit checks. Yes some stuff was not completely exposed but these days its not hard to fill in the blanks from other sources.
If you're going to put up a web-facing app, you should give that app access only to the data it needs. Why is a subscriber's SSN required for the app in question here?
A security flaw in the Comcast Xfinity online portal exposed social security numbers and partial home addresses of more than 26.5 million subscribers
So my beef with this isn't that a security flaw happened. I expect that to happen from time to time even though I think the consequences for it aren't nearly severe enough currently. The problem I have is that Comcast is storing Social Security Numbers in the first place. They have absolutely zero need to store this information. Yes I'm aware that lots of companies do it and for the most part they don't need it either. But let's ignore that and say they do need/want to store my SSN. Then there should be consequences with serious teeth for security failures regarding sensitive information about me. We have these leaks in part because there are effectively zero consequences for mismanagement of sensitive customer data. The companies simply don't have to care very much. Failure to keep this data secure should result in heavy fines and odious government oversight. It should be ugly enough to make them think seriously about what data they really ought to be storing and how they go about it and what best practices to use. Companies that act responsibly should be free to go about their business but those that can't or won't handle sensitive data responsibly should be very afraid.
Better question: Why do we pretend that SSNs are "secret"?
Lot's of data is technically public that you really don't want to be made more available than necessary. Identity theft is a serious problem and given how casually SSN's are handled and how they are used for authentication (even when they shouldn't be) giving a lookup table for them is a terrible idea currently.
They are already semi-public, and generally used as a "citizenship number".
That doesn't make it a good idea or desirable. It's certainly at odds with a lot of privacy considerations.
Why not just go all the way, and make SSNs fully public?
Because you have to change a lot of other infrastructure and business practices to make that a practical idea. In principle you are right and it shouldn't matter but because of how the darn things are actually used it is a terrible idea currently.
If companies want something for authentication, they would have to use something sensible instead.
Hahahahahahaaa... Oh wait, you're serious... Umm, yeah I have ZERO faith that would happen given how poorly they handle them now.
comcast open wifi network the backs on your link is also there as well.
So people without logins can be validated.
This is a common practice by utilities, health providers, and govts.
They want people trying to pay not to have trouble. Most people know their address and SSN, but not their account numbers.
Until there is a law that makes asking/using SSN for anything that isn't tax related, it won't stop. In the USA, SSN is commonly used for credit checks, which is why utilities demand one. They won't provide service to any location without either a credit check or huge pre-service cash payment.
I tried to get phone service without providing my SSN last move. They said I could stop by one of their offices and make a pre-payment. I don't remember the amount now, but it was over 5x a monthly bill.
Who cites buzzfeed... Saw those words and immediately stopped reading.
we have no reason to believe these vulnerabilities were ever used against Comcast customers
That's not a no, I'd like a actual no actual customers were harmed with these exploits. Is that to much to ask?
Cannot find REALITY.SYS. Universe halted.
I'm not trying to imply that the SSN is a secret. I'm implying that it's UNIQUE.
Social Security Numbers are NOT unique per person. not even close. People have more than one (often for legitimate reasons) and many numbers are used for more than one person (usually for identity theft). We're talking tens of millions of people here. We tend to think of them as unique identifiers in the sense of a primary key but in reality they definitely are not reliable in that capacity and never have been.
It's far better if you never accept the linkage in the first place because, once you've given a piece of information away, you've completely lost control of it.
Quite so.
If a company handles customer SSNs, they should be required to meet a federally mandated security requirement for handling sensitive data.
An obvious requirement would be to disallow login spams.
I don't see why Google doesn't use a webcrawler to look for sites that can be login spammed and blacklist them.
The fact that such a flaw still exists in 2018 at a major company is astonishing.
Companies should lose money in proportion to the damage as well as in proportion to the obviousness of the mistake.
For verification that the user is who they say they are and they're authorized to make changes to the account. This is their sales portal, so they'll verify the user's information first.
Why is a subscriber's SSN required, period? Okay I can understand to protect against bad apples. But why do you need my SSN for the future when my payment history is all the credit history you need?
Because they are selling your data and your SSN is a great choice for a primary key. This is the user's fault. If you think a $250 deposit costs more than your security is worth, then by all means don't stop giving out your SSN
-dk
...For verification that the user is who they say they are and they're authorized to make changes to the account. ...
Why does the app have access to the SSN? Why not, e.g., hash what the customer enters and compare the hashes? Why not, e.g., send the entered SSN off to a different server that does not have internet access and is more secure?
One of those requirements is that any personally identifying information that is at rest must be encrypted.
That gets routinely and roundly ignored. I've worked in hospital systems and my wife is a doctor. And in most cases nothing really ever comes of it and there are minimal to zero consequences to the organizations that fail to maintain adequate infosec. Plus just because something is encrypted to comply with a statute doesn't mean it is actually secure. That is why you need to have legal consequences with actual teeth to ensure an adequate level of effort is expended to keep data secure and to incentivize companies to not store data that isn't truly critical.
I have for the 3 years gotten emails sent to my yahoo email address, from comcast that were sent to a another comcast email. my yahoo email is no where in comcast's systems and the comcast customer I'm geeting's emails lives on the other side of the state. we don't know each other. Comcast also has no idea why i'm getting copies of this persons emails and I've talked to their security department twice about this and still no fix. The last time they rebuilt his whole email on their system...I still get emails though. So this isn't really surprising honestly.
Because it's not your "social security password" so why would you salt and hash like a password? That's the thinking (or lack thereof) behind it I assume. If we called it a "social security password" maybe braindead developers would recognize it's sensitive and store a randomly-salted hash. But hell, most of them don't even do that and passwords are exposed. It's all this outsourced development in node js and ruby on snails which prevents actual intelligent people from architecting it properly. As long as they have their scrum degree who cares about skill? Someone with 1 year experience who can "do everything" is hired over us 20-year experience folks who really can do most things in order to "save a couple bucks." I personally think they lose out in the long run with way increased development time and constant bugfixes being required and whatnot, but on paper it saves money in the short term. You know what that means! Big bonuses to big wigs! Yay
...just logon to router and turn it off...
nothing to see here - move along
and Comcast has a way of making that turn back on from time to time.
...not mine...
nothing to see here - move along
Our social security numbers have already been leaked by half a dozen negligent organizations.
...Because it's not your "social security password" so why would you salt and hash like a password? ...
I never said it was a password. .
...That's the thinking (or lack thereof) behind it I assume....,
You shouldn't dis someone when you make incorrect assumptions.
He seemed to me to be dissing stupid developers who assume that if the field isn't named "password" then it doesn't matter if it's exposed.
The problem isn't how developers store SSNs, the problem is that they're used in a similar manner to passwords anywhere at all. They should be considered exactly as confidential as a person's name.
CenturyLink asks for an SSN just to email customer service. See https://www.centurylink.com/ho...
...or learn something closer to the real numbers later. As I pointed out earlier these stories follow a pattern and part of that pattern is to lowball the first press release of the number of adversely affected parties. Comcast will likely join the ranks of Equifax, Yahoo, and Hyatt.
Digital Citizen
I have a hunch that net is vulnerable to portal evasion. Call it more than hunch.