Over 1,700 TM UniFi customers can say THANK YOU to TM for enabling the remote management option on their router and a secondary administrator account, without customer’s knowledge.
The remote management option and the secondary administrator account has a very easy to guest password and was probably turned on since 25 March 2010, the day the UniFi service went live, allowing anyone in the internet to “spy” on any TM’s UniFi customer provided they have the right IP address.
The potential damage include spying on all your internet activities, including all password, your online conversation with a friend, access to your Facebook and much more. The potential damage is much greater if you don’t have a firewall enabled on your PC, basically the hacker can have unauthorised access to every single piece of data on your PC/hard drive.
TM has admitted this issue. Below is the statement issued by TM yesterday:
Telekom Malaysia Berhad (TM) wishes to clarify the concerns raised by various parties with regards to the remote accessibility of UniFi routers which are part of the customer premises equipment (CPE) for all UniFi subscribers.
TM would like to assure all concerned parties that the only reason the UniFi router setting for remote access is enabled is for remote access troubleshooting purposes for the express use of our technical support personnel. In the event there is a technical support issue with any of our UniFi subscribers; at the first level of troubleshooting, TM’s network operation centre (NOC) can immediately remotely diagnose the problem before sending a support team on-site.
TM takes note of the security concerns that have been raised, and we have taken these issues to heart.
TM also acknowledges that there is a need to balance the public’s level of comfort with regards to security and privacy and TM’s own commitment to faster support turnaround time. As such, TM would like to maintain the higher level of service enabled by remote access management on customer routers, and in recognition of that TM will immediately change every UniFi customers’ router management password into a high security, unique one (which will be only known to the customer and TM). TM will notify all our Unifi customers of this change accordingly.
Source
Also read- UniFi ‘backdoor’ allows hacking, spying
