Comcast Xfinity accounts hacked in widespread 2FA bypass attacks

Comcast Xfinity customers report their accounts being hacked in widespread attacks that bypass two-factor authentication. These compromised accounts are then used to reset passwords for other services, such as the Coinbase and Gemini crypto exchanges.

Starting on December 19th, many Xfinity email users began receiving notifications that their account information had been changed. However, when attempting to access the accounts, they could not log in as the passwords had been changed.

After regaining access to the accounts, they discovered they had been hacked and a secondary email at the disposable @yopmail.com domain was added to their profile.

Similar to Gmail, Xfinity allows customers to configure a secondary email address to be used for account notifications and password resets in the event they lose access to their Xfinity account.

BleepingComputer first learned of these account hacks after numerous Xfinity customers reached out to us to share their experiences. In addition, other customers shared similar reports on Reddit [1, 2], Twitter [1, 2, 3], and Xfinity’s own support forum.

All Xfinity customers we spoke to said they have two-factor authentication enabled on their accounts, yet the threat actors could bypass it and log in to their accounts.

“Someone was able to reset my password and change personal account information, they bypassed 2FA. the email they setup was xxxxxxxx@yopmail.com,” explained an Xfinity customer on Reddit.

2FA bypass allegedly circulating privately

A researcher has told BleepingComputer that the attacks are being conducted through credential stuffing attacks to determine the login credentials for Xfinity attacks.

Once they gain access to the account and are prompted to enter their 2FA code, the attackers allegedly use a privately circulated OTP bypass for the Xfinity site that allows them to forge successful 2FA verification requests.

Once logged into the account, they can change the secondary email to the @yopmail.com account and perform password resets.

The main Xfinity email will also receive a notification that their information was changed, but as the password has been changed as well, will be unable to access it.

Once they gain full access to an Xfinity email account, the threat actors attempt to breach further online services used by the customer, verifying password reset requests to the now compromised email account.

BleepingComputer has been told by some of the affected customers that the hackers attempted to reset passwords at DropBox, Evernote, and the Coinbase and Gemini cryptocurrency exchanges.

While BleepingComputer has been unable to verify the legitimacy of this OTP bypass independently and whether it has been used in the reported hacks, it would explain how the threat actors can gain access to accounts with 2FA enabled.

BleepingComputer reached out to Comcast press contacts several times this week but has yet to receive a reply to our emails.

However, an Xfinity customer posted on Reddit that the company is aware of the account breaches and looking for the source of the hacks.

“I spoke to a second person in the xfinity security department that told me not to worry about the fraudulent yopmail account on my xfinity account and indicated that this had happened with many (maybe all) xfinity accounts,” a user posted to Reddit about the hacks.

“She indicated that xfinity is still working to find the source of the hack. Apparently this this is a much more widespread issue than is being reported. It does not seem that xfinity e-mail is secure at this time.”

Source: https://www.bleepingcomputer.com/news/security/comcast-xfinity-accounts-hacked-in-widespread-2fa-bypass-attacks/