#Spectrum mac address hack full#
#Spectrum mac address hack registration#
#Spectrum mac address hack tv#

#Spectrum mac address hack full#

If the targeted customer had not registered for a TWC ID, a hacker could trick the website and gain full access to the targetвЂ™s account by replacing their own IP address with the customerвЂ™s using the вЂњX-forwarded-forвЂќ technique, which can be executed even by technically unsophisticated hackers with a simple browser extension.

#Spectrum mac address hack registration#

Spectrum does not require its customers to register for a TWC ID, but according to the Charter spokesperson, the вЂњmajorityвЂќ of its legacy customers have already registered.ДЄ registration page where subscribers can create a TWC ID contained the crucial security flaw. The spokesperson did not reveal exactly how many people are in that group, and only stated that the number is вЂњsignificantly lessвЂќ than the companyвЂ™s subscriber base.

#Spectrum mac address hack tv#

In 2016, Charter purchased Time Warner Cable and Bright House Networks, and merged the two internet companies under the Spectrum brand.Д¬laude noted that only a subset of Time Warner CableвЂ™s 14 million pre-merger вЂњlegacyвЂќ customers - those without a вЂњTWC IDвЂќ (an account through which they can pay for bills and watch TV online) - were affected by the security flaw. This can be used to impersonate another computer or router on a Wi-Fi network, and perform a man-in-the-middle type of attack to capture all of that networkвЂ™s web traffic and acquire any data submitted to non-HTTPS sites, including login credentials.Д¬harter Communications, the second largest cable provider in the US, provides residential Internet access to 23 million customers. The myTWC app, which an account provides access to, also shows the MAC address (a number that identifies each device on a network) of any equipment connected to the service. That information could be used to social engineer - in other words, deceive - customer support personnel, who could be fooled into giving up more of a targetвЂ™s data, or even to trick the customer with phishing emails that look like they are legitimate because they include accurate, detailed personal info related to their internet account. With access to a customerвЂ™s internet and cable TV provider account, a hacker can see sensitive personal data like their billing address, email, and account number. We continue to investigate, but at this time have no reason to believe this vulnerability was ever used beyond the security researchers who reported it to BuzzFeed.вЂќ Only a Spectrum customerвЂ™s IP address (a number unique to every Internet-connected device) was required to exploit the flaw, which security researchers Phobia and Nicholas вЂњConvictвЂќ Ceraolo discovered.ДЄfter BuzzFeed News shared the previously unreported findings with parent company Charter Communications, spokesperson Francois Claude said, вЂњWe investigated and quickly implemented a fix to the vulnerability that was brought to our attention. A vulnerability on internet and cable TV provider Spectrum's website made it possible for just about anyone to take over customersвЂ™ accounts without a password.