This topic

Potential Serious Security Flaw with BT Smarthub 2

jonkendall — Mon, 10 Feb 2025 11:10:04 GMT

My neighbour and I have the same setup, full fibre and smarthub 2.

But out broadbands are connected together somehow. I have had engineers from BT and OpenReach and noone can work out how this has hapended.

Basically my neighbour and I have never exchanged WiFi passwords yet I can see his routers admin page and make changes on it (like turning the light on his router on an off) and he can see mine.

It is not wifi because I have connected to my router using an ethernet cable and the same happens.

This means the 2 routers are talking to each other and can create a tunnel between them.

This is potentially a massive security flaw as I could see what he is doing and he could see what I doing with no encryption whatsoever.

This looks like a serious flaw in the BT Smarthub 2 software and something that needs to be addressed urgently.

Re: Potential Serious Security Flaw with BT Smarthub 2

licquorice — Mon, 10 Feb 2025 11:15:12 GMT

I suspect one or both of you are using powerline adapters.

Re: Potential Serious Security Flaw with BT Smarthub 2

jonkendall — Mon, 10 Feb 2025 11:16:44 GMT

OK. Why?

Re: Potential Serious Security Flaw with BT Smarthub 2

imjolly — Mon, 10 Feb 2025 11:18:20 GMT

similar problems have been posted before and the cause was found to be powerline adapters probably in adjoining wall

Re: Potential Serious Security Flaw with BT Smarthub 2

jonkendall — Mon, 10 Feb 2025 11:18:23 GMT

I have a powerline adaptor for BT TV which BT supplied. I have to because I have Fibre broadband and the fibre has to be by the front door and the tv is in the lounge and this requires a wired connector.

Re: Potential Serious Security Flaw with BT Smarthub 2

jonkendall — Mon, 10 Feb 2025 11:19:33 GMT

Yes it is an adjourning wall? So are you saying the powerline adaptor is basically "hopping" onto my neighbour's ringmain?

Re: Potential Serious Security Flaw with BT Smarthub 2

licquorice — Mon, 10 Feb 2025 11:23:32 GMT

Yes.

Easily proved, remove adapter temporarily.

Re: Potential Serious Security Flaw with BT Smarthub 2

WSH — Mon, 10 Feb 2025 11:24:55 GMT

Most powerline adapters have for encryption. You may be able to change the key. If you and your neighbour are still using the default key they will be able to talk to each other. It's a "flaw" that's been well known for over 10 years and works through the shared mains supply.

Re: Potential Serious Security Flaw with BT Smarthub 2

jonkendall — Mon, 10 Feb 2025 11:31:32 GMT

Unplugged it now. Great that BT who supplied the powerline adaptor don't seem to know about this.

Re: Potential Serious Security Flaw with BT Smarthub 2

jonkendall — Mon, 10 Feb 2025 11:33:41 GMT

When you say shared mains supply, this is a modern house with 100A supply so would it be "shared". Are you saying that everyone on the same single phase as me could potentially have this issue, or is it that because my neighbour and my ringmains are either side of the same wall we are getting "interference"

Re: Potential Serious Security Flaw with BT Smarthub 2

licquorice — Mon, 10 Feb 2025 11:40:59 GMT

I'm of the opinion it is when neighbours are on the same phase which is not the norm. Normally houses are fed red, yellow, blue etc along the street so that adjacent houses are not on the same phase so that a house on the same phase is far enough away for the signal to be attenuated sufficiently.

Re: Potential Serious Security Flaw with BT Smarthub 2

WSH — Mon, 10 Feb 2025 11:48:15 GMT

I've not had any involvement with powerline adapters for ten years but the manufactuters even back then used to claim they would go for 300m and, of course, you both share the same supply in the street. Even if it's a different phase there may be cross over at the meter.

I also not familiar with the BT kit but as I said, you should be able to change the encryption key. Never leave any device on the default keys, the bad guys can look up the default settings and try them.

Edit: Just to clarify the phase issue. I once worked for an industrial concern that had two different rooms on two different phases. (We knew that because one room lost power one time and it turned out to be a problem with that phase). We could still get the powerlines to talk to each other, however.

Re: Potential Serious Security Flaw with BT Smarthub 2

jonkendall — Mon, 10 Feb 2025 12:03:16 GMT

OK. That's interesting about the phases. I wrongly assumed they were limited to your ring or at least your meter.

So I am guessing (which I will confirm later) that my neighbour has a powerline network that he is using for Wifi too, hence why the powerline network knows the SSID and WiFi passcode and hence why, via my powerline adaptor (which is probably the same TP link model provided via BT) knows about his network.

Now I have turned off the powerline adaptor the WiFi performance has increased massively. Which is good.

However I need the powerline adaptor for the TV, so need to work out how to limit that to only work with mine

Re: Potential Serious Security Flaw with BT Smarthub 2

WSH — Mon, 10 Feb 2025 12:12:08 GMT

The big increase in Wi-Fi performance is interesting. If they are producing a lot of RF, they could be communicating direct through the wall. (It was the sparky that suggested it was via the meter, so who knows?) They're not Wi-Fi capable powerlines are they?

Re: Potential Serious Security Flaw with BT Smarthub 2

jonkendall — Mon, 10 Feb 2025 12:42:38 GMT

Not sure it is RF. I think in effect what I has was 2 routes out using the same IP addresses and therefore there were alot of unseen errors and retries which made the performance look poor on occasions.

Re: Potential Serious Security Flaw with BT Smarthub 2

jonkendall — Mon, 10 Feb 2025 12:46:20 GMT

I suspect my neighbour's might be wifi enabled. Now I just need to figure out the Poweline to make sure they won't link up with next door's.

Looking at the TP Link manual it is not clear how I ensure that my 2 TP Links only talk to each other?

Re: Potential Serious Security Flaw with BT Smarthub 2

iniltous — Mon, 10 Feb 2025 12:51:49 GMT

Because the powerline adapter plugs into an Ethernet port on the router , the router SSID and wireless password are irrelevant, if you connected a laptop via an Ethernet cable to the router there are no credentials to enter to be accepted onto the network , powerline is a wired device , the ‘WiFi’ credentials are only for wireless devices…..as stated this issue crops up occasionally somehow the adjacent property ‘mains’ wiring allows one neighbours powerline adapter to pair to the powerline unit in the neighbouring property, effectively joining the ‘wrong’ if the neighbouring property also has powerline type adapters, far as a security flaw , this isn’t particular to the BT hub, if it’s a design/security flaw , rather than customer mis operation, its with the way powerline devices pair up .

Re: Potential Serious Security Flaw with BT Smarthub 2

jonkendall — Mon, 10 Feb 2025 12:54:01 GMT

Yes I agree, as you say there are no credentials because there don't need to be any.

My question is there any way to avoid this. Can I force my TP Links to pair with each other and nothing else.

Re: Potential Serious Security Flaw with BT Smarthub 2

licquorice — Mon, 10 Feb 2025 12:58:03 GMT

The credentials are between the master and slave adapters, not the router. The pairing should be encrypted.

Re: Potential Serious Security Flaw with BT Smarthub 2

jonkendall — Mon, 10 Feb 2025 13:00:17 GMT

Yes but currently my powerline network seems to be include my neighbours powerline devices hence where I got to this problem in the first place.

So not sure how I ensure that this doesn't happen in the future