Millions at security risk from old routers, Which? warns

Routers need crucial software updates and secure passwords

Millions of people could be using outdated routers that put them at risk of being hacked, Which? has warned.

The consumer watchdog examined 13 models provided to customers by internet-service companies such as EE, Sky and Virgin Media and found more than two-thirds had flaws.

It estimated about six million people could have a device not updated since 2018 or earlier.

So, in some cases, they would not have received crucial security updates.

Weak passwords

Problems found by its lab tests included:

• weak default passwords cyber-criminals could hack were found on most of the routers

• a lack of firmware updates, important for security and performance

• a network vulnerability with EE's Brightbox 2, which could give a hacker full control of the device

The devices found to be lacking in updates included:

• Sky SR101 and SR102

• Virgin Media Super Hub and Super Hub 2

• TalkTalk HG635, HG523a, and HG533

Several routers from BT, including the Home Hub 3B, 4A and 5B, and Plusnet's Hub Zero 270N, passed all the security tests.

The government plans to ban default passwords being preset on devices, as part of upcoming legislation covering smart devices.

It is also planning to make manufacturers:

• tell customers for how long their device will receive security-software updates

• provide a public point of contact to make it simpler for anyone to report a vulnerability

Which? computing editor Kate Bevan said that proposed legislation "can't come soon enough".

"Internet service providers should be much clearer about how many customers are using outdated routers and encourage people to update devices that pose security risks," she added.

'Constantly monitored'

In response, Virgin said nine out of 10 of its customers were using its latest modem and it did not "recognise or accept the findings of the Which? research".

BT, which owns EE, also said "the vast majority of its customers" used its latest modem.

"We want to reassure customers that all our routers are constantly monitored for possible security threats and updated when needed," it said.

"These updates happen automatically so customers have nothing to worry about."

• Government plans new laws for smart gadgets

• Smart doorbells 'easy target for hackers' study finds

TalkTalk said the routers looked at in the research represented a "very small proportion" of those in use - and customers could easily change their passwords at any time.

And Vodafone said its HHG2500 router examined by Which? had not been supplied to customers beyond August 2019 but updates would continue "as long as the device remains on an active customer subscription".

Sky engaged with the research but did not provide a comment.

'Remotely hijacked'

Pen Test Partners security consultant Ken Munro said the research mirrored his own.

"We have been trying to convince one of the ISPs in question to fix a critical security flaw that allows several million of their customer routers to be remotely hijacked and gain access to home networks," he said.

"We reported the issue over a year ago - but they have procrastinated multiple times."

Mr Munro also suggested ISPs could be "reluctant to push updates to routers in case they fail in the process".