Feeds

MAJOR HACK: Voda femtocells open phones up to intercept

Pass within 50m of one, they own your phone

Eight steps to building an HP BladeSystem

Updated Security researchers claim to have uncovered a serious security hole in Vodafone's mobile network.

Security shortcomings in the femtocell technology supplied by the mobile phone giant create a means to extract information that would allow hackers to intercept calls or impersonate users that connect through a compromised device, The Hacker's Choice (THC) claims.

Femtocells are home routers that use broadband connections to improve mobile coverage, allowing calls to be made indoors more easily. Vodafone's Sure Signal Femto equipment is marketed to consumers and small businesses and costs around £160.

THC claims to have reverse-engineered the Sagem-manufactured kit and discovered a way for any subscriber to use a femtocell. A second vulnerability creates a means for hackers to grab secret subscriber information from Vodafone (specifically IMSI - international mobile subscriber identity - data from Home Location Register and authentication systems). Because of this second security shortcoming, it's possible to turned a hacked femtocell into an interception device, the researchers claim.

The grey hats claim that the approach can be used to compromise Vodafone UK accounts in order to either intercept or make calls at the expense of victims. Access to a victim's voicemail would also be possible. All these hacks would only work once a victim had been tricked into using a compromised base station, something that can happen automatically, but only over a short distance of around 50m, within range of the device.

The root cause of the problem is that the allegedly insecure base station kit is assigned functions normally restricted to carriers' core network authentication systems.

"The femtocell contains a Mini-RNC/Node-B, which is not a real RNC [Radio Network Controller] nor a Node-B. It's something in-between," the security researchers explain. "The mini-RNC can request real encryption keys and authentication vectors for any Vodafone UK customer from the Vodafone core network (like a real RNC). The Vodafone core network still authenticates every single phone (like a Node-B)."

Technical details of the hack are listed in a blog post by THC here.

Another separate group of researchers plans to give a talk on femtocell hacks at the upcoming Black Hat conference in Las Vegas later this month.

We asked Vodafone to comment on the research, but have yet to hear back from the mobile phone giant. We'll update this story as and when we hear more. ®

Updated to add

We finally heard back from Vodafone to the effect that the vuln in question is an old one and was patched in 2010. By then the story was all over the place, so we thought it was worth another headline.

Boost IT visibility and business value

More from The Register

next story
Brit celebs' homes VANISH from Google's Street View
Tony Blair's digs now a Tone-y Blur
Virgin Media goes titsup AGAIN. The cause? Yet MORE DNS strife
ISP refuses to comment on why outages keep happening
ISPs haul GCHQ into COURT over dragnet interwebs snooping
'Exploitation of network infrastructure is unlawful,' says co-claimant
REVEALED: The sites blocked by Great Firewall of Iraq
Reg obtains list of banned sites in crisis-hit nation
Islamic terror peril hits US giants' phone wallets
'We have made the decision to rebrand' says ISIS Isis
BT slapped down by BSkyB over O2 broadband 'switch off' porkies
Ad watchdog tells one-time state monopoly to behave
Street View Wi-Fi slurp nightmare: US Supremes snub Google's appeal
Ad giant must now face up to class-action suit over wireless data grab
FTC: T-Mobile USA took '$100s of millions' in bogus txt charges
Network CEO blasts Feds' allegations as baseless
BlackBerry knocks Google's KNOX LOCK PICK for Android
John Chen disses Samsung's security solution
Keith McMahon, tech analyst, dies at 50
Once urged Branson to 'take the money and run, Beardie'
prev story

Whitepapers

How modern custom applications can spur business growth.
In this whitepaper learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
The Power of One eBook: Top reasons to choose HP BladeSystem
Only the Power of One delivers leading infrastructure convergence, availability and scalability with federation, and agility through data center automation.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Maximizing your infrastructure through virtualization
Virtualization continues to be one of the most effective ways to consolidate, reduce cost, and make data centers more efficient.
Build a Business Case: Developing Custom Apps
In this whitepaper learn how to maximize the value of custom applications by accelerating and simplifying their development.