Comcast Used '0000' as Default PIN for Xfinity Mobile Customers, Leaving Them Vulnerable to Hacking

[MacRumors]

Comcast's Xfinity Mobile service used "0000" as a default PIN for all of its mobile customers, which left them vulnerable to hacking attempts, identity theft, and more.

Comcast's decision to use simple default PINs for all of its customers came to light in a "Help Desk" article from The Washington Post included one Comcast customer's tech horror story.

Larry Whitted, an Xfinity Customer in California, had someone hijack his phone number, port it to a new account on another network, and steal his identity to commit fraud.

The thief put Samsung Pay on a new phone with Whitted's phone number and credit card then bought himself a computer at the Apple Store.

This was possible because Comcast does not ask its customers to create a PIN to secure their accounts to prevent them from being transferred to another carrier. Instead, Comcast uses the default 0000 code. From Comcast's support document:

We don't require you to create an account PIN, so you don't need to provide that information to your new carrier.

Taking control of a person's telephone number is a popular way to obtain logins for email, social media accounts, bank accounts, and more. Any site that uses a phone number as a way of authenticating data can be accessed when someone has your phone number.

Charismatic hackers who use social engineering techniques can often get access to phone numbers from customer service representatives who don't know any better, but many carriers have implemented PIN codes to make it more difficult. Not Comcast.

This has led to other Xfinity Mobile customers having their phone numbers hijacked as well, and with phone numbers used for so much, hackers can access a lot of a person's data.

Comcast says that it has since implemented new measures to make it harder to steal phone numbers and that it is "working aggressively" to create a PIN-based solution, something that common sense dictates should have been available from the time the service launched.

Comcast says that a "very small number" of its customers have been impacted by this issue, and rightly admits that having even "one customer impacted" is "one too many." Comcast claims that customers who were affected perhaps used passwords leaked in other data breaches

Article Link: Comcast Used '0000' as Default PIN for Xfinity Mobile Customers, Leaving Them Vulnerable to Hacking

 

[Packdude]

That's some security there.

 

[ilikewhey]

class action negligence suit incoming

 

[jeff275]

And cue the class action lawsuit in 3... 2...

 

[Cyberpower678]

Comcast: Security is for sissies. You don't really need a password, 2FA, or device security codes, bank PINs, thumbprints, or Face ID. We live in an honest world. Right? RIGHT?

 

[LizKat]

Comcast: Security is for sissies. You don't really need a password, 2FA, or device security codes, bank PINs, thumbprints, or Face ID. We live in an honest world. Right? RIGHT?

Man it seems like such a long time ago that in my college town in New England there was a general store and fruit market that had a cigar box parked outside every morning along with the racks of fresh produce on sale... with about four or five bucks worth of change, a couple of singles and a five dollar bill.

"Please make your own change if you can manage it, and spare us both the hassle of having to maintain a separate line for produce sales, thank you."
​

EDIT: well actually it was quite awhile ago... 1960s...

 

[ghostface147]

Hahaha. But even no matter how secure systems are, they are smarter people out there. For example, I was reading about a hacker who had access to the T-mobile program that the CSRs use to look at your account. I mean how do you stop that?

 

[Apple_Robert]

I am not one to use the "sue" word very often. In this case, I believe Comcast earned it.

 

[tennisproha]

class action negligence suit incoming

And rightly so. This type of negligence destroys lives.

 

[MikeAnd]

Charismatic hackers who use social engineering techniques can often get access to phone numbers from customer service representatives who don't know any better, but many carriers have implemented PIN codes to make it more difficult. Not Comcast.

In fairness to Comcast, I can definitely see the logic here. You'd think that having to deal with Comcast customer service, particularly in the context of porting your number to a new provider, would be sufficient to deter all but the most hardened of criminals.

 

[StellarVixen]

They should change it to "password" or 1234

 

[KGBguy]

Oh, a lawsuit is already being cooked. However, a pretty dumb decision on the Comcast side. Oh, well... will watch drama.

 

[MartiNZ]

Man it seems like such a long time ago that in my college town in New England there was a general store and fruit market that had a cigar box parked outside every morning along with the racks of fresh produce on sale... with about four or five bucks worth of change, a couple of singles and a five dollar bill.

"Please make your own change if you can manage it, and spare us both the hassle of having to maintain a separate line for produce sales, thank you."
​

EDIT: well actually it was quite awhile ago... 1960s...

Where exactly did we go wrong to get from there to here? Even into the early 2000s we operated PCs without user logins and passwords. The world is hardly recognisable now. What a sad story about humanity.

 

[npmacuser5]

Comcast careless with security on their devices.

Comcast modem router had no password for admin. Called them and they said the wireless had one so no problem. I replied, are you kidding? No they were not. Suggest anyone with a Comcast modem or modem WiFi check the network admin password.

Very sloppy company about security.

 

[macduke]

Classic Comcast. I would never expect anything better.

 

[npmacuser5]

Where exactly did we go wrong to get from there to here? Even into the early 2000s we operated PCs without user logins and passwords. The world is hardly recognisable now. What a sad story about humanity.

Going on for a longtime. 1970’s, rarely locked the doors in my neighborhood. Nothing ever went missing. Today deadbolts and security plus camera systems the normal.

The decline continues. A truly sad story.

 

[KGBguy]

Classic Comcast. I would never expect anything better.

Comcastic!

 

[LizKat]

Where exactly did we go wrong to get from there to here? Even into the early 2000s we operated PCs without user logins and passwords. The world is hardly recognisable now. What a sad story about humanity.

The band Editors have this line in their dance anthem "Papillon" from the 2009 album In this Light and on this Evening:

"If there really was a god around here, he'd have raised a hand by now."

​

I figure at this point if there really really was a god around here, he'd be helping us hatch out with immutable unique passwords radiating from our heart muscle, with a spare tucked somewhere else that knows when to kick in after a heart transplant.

I mean 2FA just to secure a grocery list stored in the cloud, gee.

And yes, it's a sad tale of a decline in human standards of behavior, no matter what reasons we may variously assign to the trend.

 

[gsmornot]

The whole story is crazy. Stole someone identity, used a Samsung phone, with Samsung Pay to buy a Mac at the Apple Store. They covered a bit of just about everything.

 

[adamjackson]

I'm still waiting for Equifax and Target and Home Depot and every other steward of our data to be fined for negligence. Until these corporations are fined more than it costs to protect our data, they will continue to not give a crap about security.

A million dollars for every individual customer whose data you lose that we entrust with you.

I have to lock my car door and my house door and not leave my wallet on a park bench and keep my medical and insurance up to date and wear my seatbelt and on and on. These companies do not care about our data...only our money. Fine. That's capitalism. I'm not faulting for that but I am faulting regulation for forcing them to care when each customer's data is matched with a dollar sign if they fail to protect our data.

 

[nt5672]

It's always a small number till the truth comes out.

 

[oosamon]

That's the kinda thing an idiot would have on his luggage.....

 

[0388631]

Somehow Comcast manages to outdo themselves all the time. Bravo, lads, bravo.

 

[LizKat]

It's always a small number till the truth comes out.

You got that right. And the number grows even while the original number is "Being Investigated". See they have excuses for delayed reporting, too...

Money talks, and money fines of lax corporate security need to become far more persuasive. Sure there might be reasonable defense arguments in case of certain hacks. On the other hand what we need to do is to stop letting corporations figure that they're going to continue to spend on security exactly the amount it will take to look in court like they made a good faith effort.

Look, I even lock the shop doors at night, and we have a security cam.​

Otherwise they will invest in exactly nothing that keeps them from their appointed rounds of making as much profit as fast as fast traffic can bear, and that means no slightly bothersome bumped-up security on their databases or points of sale operations that get even slightly in the way of conducting business.

​

 

[elvisimprsntr]

The victims only have themselves to blame.

#1 Let Crapca$t in the door
#2 Trusted Crapca$t not to raid the liquor cabinet or take the keys to the sports car.