article: The BBC has presented the company with evidence that many of its customers' router credentials have been hacked, putting them at risk of data theft. The UK broadband provider confirmed that the sample of stolen router IDs it had been shown was real. But it is still advising users that there is "no need" to change their routers' settings. A cyber-security advisor to Europol said he was astounded by the decision. "If TalkTalk has evidence that significant numbers of passwords are out in the wild, then at the very least they should be advising their customers to change their passwords," said the University of Surrey's Prof Alan Woodward. "To say they see no need to do so is, frankly, astonishing." A spokeswoman for TalkTalk said that customers could change their settings "if they wish" but added that she believed there was "no risk to their personal information". She referred the BBC to another security expert. But when questioned, he also said the company should change its advice. The risk to TalkTalk's subscribers was first flagged over the weekend by cyber-security researchers at Pen Test Partners. They had been investigating the spread of a variant of the Mirai worm, which was causing several makes of routers to stop working properly. During tests of a TalkTalk model, the researchers discovered that the vulnerability exploited by the worm was also being abused to carry out a separate attack that forced the router to reveal its wi-fi password. But TalkTalk played down the discovery, saying it had "not seen anything to confirm" that users' router credentials had been stolen. It said it was also making "good progress" to protect its routers. The BBC was subsequently contacted by someone who said he had access to a database of 57,000 router IDs that had been scraped before any fix had been rolled out. He did not reveal his identity, but agreed to share a sample of the credentials that had been harvested. The list contained details of about 100 routers including: The source said he wanted to highlight the problem because other more malevolent actors might have carried out a similar operation. The BBC passed the details on to TalkTalk. "The list that you sent me, I can confirm that they are TalkTalk router IDs," said its head of corporate communications. "But we haven't seen anything to suggest that there are 57,000 of them out there." Hackers could not use the credentials to carry out a mass attack from afar - but they could use the IDs to identify high value targets to travel to, or they could simply drive through the streets hunting for a match. Prof Alan Woodward said once a hacker was outside a vulnerable property, they could: TalkTalk's spokeswoman referred the BBC to Steve Armstrong, a cyber-security instructor that she said would support it on the matter. He said the risk to an individual user was relatively low. "If you look at the average home user and what is on their home network, that would be exposed to an attacker,... then there is not
summary: TalkTalk's handling of a wi-fi password breach is being criticised by several cyber-security experts.