14 DAY TRIAL // European Internet service provider UPC has supplied its Austrian customers with routers that set up hidden wireless access points accessible by anyone.
According to security researchers from Secure Business Austria (SBA), UPC's Thomson TWG850-4U wireless router creates a secondary wireless network (WLAN) with a predefined WPA key.
The WLAN's identifier (SSID) is hidden so it doesn't appear in a regular scan of nearby wireless networks. However, a user who knows this identifier can connect to it.
The problem is this hidden WLAN is bridged with both the primary one, giving a potential attacker who connects through it access to the user's entire home network.
In addition, by connecting through this network attackers can access the router's administration interface and make modifications to its configuration.
The SBA researchers claim that they've found hundreds of insecure networks by driving around on several streets in Vienna.
According to H Security, UPC confirmed the problem and said there are around 100,000 such routers in circulation. The device is normally distributed to customers who sign up for both the company's Internet and cable TV services.
UPC is currently in the process or deploying a patch to affected customers, but it's unclear how long this process will take. The company said the hidden network existed as part of its future plans, but did not go into details.
This is not the first time when UPC is putting its customers at risk in this way. Last year, the ISP's Dutch subsidiary distributed an update to Thomson routers that opened a similar hidden wireless network, however, it wasn't bridged with the other one.
UPC is also not the only ISP to supply customers with insecure routers. In October 2009 we reported about thousands of SMC8014 routers distributed by Time Warner in US having several issues, including wireless networks secured by default with the deprecated WEP protocol, administration interfaces accessible from the Internet and default administrative passwords.