Six million Sky broadband routers had major security flaw

25 November 2021, 13:34

Sky stock
Sky stock. Picture: PA

Security researchers said a software bug could have allowed hackers to take over a user’s home network.

Around six million Sky broadband routers contained a software bug that could have allowed hackers to take over home networks and access devices and personal data, a security company has said.

The flaw has been fixed, but the security researchers said it took the company nearly 18 months to fix the problem.

Sky said it took the security of its customers “very seriously” and had begun working to fix the problem as soon as it was made aware of it.

The bug, which was uncovered by the security group Pen Test Partners, affected users who had not changed the router’s default admin password – which was simple and easy to guess – and could enable hackers to easily reconfigure the router and take over a network just by directing the user to a malicious website.

This could then give hackers access to sensitive information including log-in details for online banking and other websites.

According to the researchers, the affected router models were: Sky Hub 3 (ER110), Sky Hub 3.5 (ER115), Booster 3 (EE120), Sky Hub (SR101), Sky Hub (SR203), and the Booster 4 (SE210).

In addition, around 1% of the routers issued by Sky are not made by the company itself and could not be updated with the fix.

But customers who have one can ask Sky to replace it, free of charge.

Pen Test Partners said there was no evidence the flaw had been exploited, but criticised Sky for the time it took to fix the issue.

It claimed the internet service provider had repeatedly pushed back deadlines it had set to fix the problem.

The researchers said they understood the initial delay due to the coronavirus lockdown and the challenges facing internet providers because of the “vastly increased network loading as working from home became the new norm”, which it said it did not want to disrupt.

But they said they were concerned by the overall speed of the company’s response, saying they believed Sky “did not give the patch the priority their customers deserved”.

The group also encouraged anyone with a broadband router to change the passwords on it from the ones set by default.

In response, a Sky spokesperson said: “We take the safety and security of our customers very seriously.

“After being alerted to the risk, we began work on finding a remedy for the problem and we can confirm that a fix has been delivered to all Sky manufactured products.”

By Press Association

More Technology News

See more More Technology News

Sam Thompson using an Echo device to support living with ADHD

Amazon launches campaign to show how Alexa can support those with ADHD

Microsoft introduced the AI assistant button

More funding needed for women-led AI start-ups, report says

Westminster

MPs shown Scottish-made ‘unicorn’ satellite at committee meeting

Facebook staff lay offs

Former Meta HQ in London to become science and tech hub

A Nationwide Building Society sign

Nationwide Building Society launches British Sign Language service

Cyber threat report

UK in ‘better position’ against cyber attacks, but most businesses not resilient

Drone

Flying taxis could take off in two years under Government drones plan

Supermarket technical issues

Tesco and Sainsbury’s hit with technical issues on same day

Apple logo in window of store

Norfolk County Council secures settlement as Apple agrees £384m lawsuit payment

Civil Service roles to relocate

Whitehall lacks the skills to implement AI, says National Audit Office

Laptop under cyber attack

Health board hit by cyber attack with ‘significant quantity’ of data at risk

Children and violent online content

Encountering violent online content starts at primary school – Ofcom

Bitcoin

Australian computer scientist is not Bitcoin founder Satoshi, High Court rules

Google website

Google starts rollout of restrictions on AI as key global election year looms

The gov.uk website

NHS and Government websites should be made free of data charges, ministers told

Schools minister Damian Hinds

Getting a mobile phone ‘a rite of passage’ for children, says schools minister