'

Comcast website bug leaks Xfinity customer data

Exclusive: A bug in Comcast's website leaks sensitive customer information.

(Image: file photo)

A bug in Comcast's website used to activate Xfinity routers can return sensitive information on the company's customers.

The website, used by customers to set up their home internet and cable service, can be tricked into displaying the home address where the router is located, as well as the Wi-Fi name and password.

Two security researchers, Karan Saini and Ryan Stevenson, discovered the bug.

Saini, who previously discovered an Uber two-factor bypass bug and a flaw in India's national biometric database, told ZDNet about the bug.

Only a customer account ID and that customer's house or apartment number is needed -- even though the web form asks for a full address. That information could be grabbed from a discarded bill or obtained from an email. In any case, a determined attacker could simply guess the house or apartment number.

ZDNet obtained permission from two Xfinity customers to check their information. We were able to obtain their full address and zip code -- which both customers confirmed.

The site returned the Wi-Fi name and password -- in plaintext -- used to connect to the network for one of the customers who uses an Xfinity router. The other customer was using his own router -- and the site didn't return the Wi-Fi network name or password.

(Screenshots: ZDNet)

The bug returns data even if the Xfinity Wi-Fi is already switched on.

Even when the Wi-Fi password changes, running the details again will return the new Wi-Fi password. There appears to be no way for customers to opt out when using Xfinity hardware.

It's also possible to rename Wi-Fi network names and passwords, temporarily locking users out.

Saini said that it would be nearly impossible to enumerate account numbers.

Although it's not believed the sensitive data can be used to access the router's settings, an attacker could use the information to access the Wi-Fi network within its range. On the network, an attacker could read unencrypted traffic from other users on the network.

Comcast, after publication, removed the option from its website.

"There's nothing more important than our customers' security," said a Comcast spokesperson. "Within hours of learning of this issue, we shut it down. We are conducting a thorough investigation and will take all necessary steps to ensure that this doesn't happen again."

Got a tip?

You can send tips securely over Signal and WhatsApp at 646-755–8849. You can also send PGP email with the fingerprint: 4D0E 92F2 E36A EC51 DAAE 5D97 CB8C 15FA EB6C EEA5.

Read More