HanaBi
Nexus 9.1 For Sale. One Careful Owner
Something to be aware of if Virgin Media is your ISP, and you're lumbered with these ancient SuperHub Router/Modems (specifically "Super Hub 2" and "Super Hub 2AC")
There is/was a critical vulnerability in the firmware of these boxes, that could potentially be exploited by a remote hacker.
QUOTE - "They found vulnerabilities in a feature allowing users to create backups of their custom configurations (such as port forwarding and dynamic DNS settings).
Although configuration backups were encrypted, the private encryption key was the same across all hubs in the UK. This meant that an attacker with access to the administrative interface of a user's hub could download a configuration file, add additional instructions to enable remote access and restore the file to the hub.
The technique would have given moderately skilled miscreants to ability to pwn devices and monitor traffic in and out of the hub."
VM have rolled out a silent patch, which should have automatically updated these routers remotely (standard VM practice). However, I am not certain how an affected user can check to see if this patch has been implemented (usually requires a manual reboot of the router).
Users should be able to access their Virgin Media SuperHub Admin console locally, (usually on 192.168.0.1 or 192.168.100.1). This will usually give the firmware version and age. Otherwise it might be an idea to access the VM Community Forum, for assistance.
Virgin Media resolves flaw in config backup for Super Hub routers
There is/was a critical vulnerability in the firmware of these boxes, that could potentially be exploited by a remote hacker.
QUOTE - "They found vulnerabilities in a feature allowing users to create backups of their custom configurations (such as port forwarding and dynamic DNS settings).
Although configuration backups were encrypted, the private encryption key was the same across all hubs in the UK. This meant that an attacker with access to the administrative interface of a user's hub could download a configuration file, add additional instructions to enable remote access and restore the file to the hub.
The technique would have given moderately skilled miscreants to ability to pwn devices and monitor traffic in and out of the hub."
VM have rolled out a silent patch, which should have automatically updated these routers remotely (standard VM practice). However, I am not certain how an affected user can check to see if this patch has been implemented (usually requires a manual reboot of the router).
Users should be able to access their Virgin Media SuperHub Admin console locally, (usually on 192.168.0.1 or 192.168.100.1). This will usually give the firmware version and age. Otherwise it might be an idea to access the VM Community Forum, for assistance.
Virgin Media resolves flaw in config backup for Super Hub routers
