Feeds

MAJOR HACK: Voda femtocells open phones up to intercept

Pass within 50m of one, they own your phone

Beginner's guide to SSL certificates

Updated Security researchers claim to have uncovered a serious security hole in Vodafone's mobile network.

Security shortcomings in the femtocell technology supplied by the mobile phone giant create a means to extract information that would allow hackers to intercept calls or impersonate users that connect through a compromised device, The Hacker's Choice (THC) claims.

Femtocells are home routers that use broadband connections to improve mobile coverage, allowing calls to be made indoors more easily. Vodafone's Sure Signal Femto equipment is marketed to consumers and small businesses and costs around £160.

THC claims to have reverse-engineered the Sagem-manufactured kit and discovered a way for any subscriber to use a femtocell. A second vulnerability creates a means for hackers to grab secret subscriber information from Vodafone (specifically IMSI - international mobile subscriber identity - data from Home Location Register and authentication systems). Because of this second security shortcoming, it's possible to turned a hacked femtocell into an interception device, the researchers claim.

The grey hats claim that the approach can be used to compromise Vodafone UK accounts in order to either intercept or make calls at the expense of victims. Access to a victim's voicemail would also be possible. All these hacks would only work once a victim had been tricked into using a compromised base station, something that can happen automatically, but only over a short distance of around 50m, within range of the device.

The root cause of the problem is that the allegedly insecure base station kit is assigned functions normally restricted to carriers' core network authentication systems.

"The femtocell contains a Mini-RNC/Node-B, which is not a real RNC [Radio Network Controller] nor a Node-B. It's something in-between," the security researchers explain. "The mini-RNC can request real encryption keys and authentication vectors for any Vodafone UK customer from the Vodafone core network (like a real RNC). The Vodafone core network still authenticates every single phone (like a Node-B)."

Technical details of the hack are listed in a blog post by THC here.

Another separate group of researchers plans to give a talk on femtocell hacks at the upcoming Black Hat conference in Las Vegas later this month.

We asked Vodafone to comment on the research, but have yet to hear back from the mobile phone giant. We'll update this story as and when we hear more. ®

Updated to add

We finally heard back from Vodafone to the effect that the vuln in question is an old one and was patched in 2010. By then the story was all over the place, so we thought it was worth another headline.

Secure remote control for conventional and virtual desktops

More from The Register

next story
Brits: Google, can you scrape 60k pages from web, pleeease
Hey, c'mon Choc Factory, it's our 'right to be forgotten'
Of COURSE Stephen Elop's to blame for Nokia woes, says author
'Google did have some unique propositions for Nokia'
FCC, Google cast eye over millimetre wireless
The smaller the wave, the bigger 5G's chances of success
It's even GRIMMER up North after MEGA SKY BROADBAND OUTAGE
By 'eck! Eccles cake production thrown into jeopardy
Mobile coverage on trains really is pants
You thought it was just *insert your provider here*, but now we have numbers
Don't mess with Texas ('cos it's getting Google Fiber and you're not)
A bit late, but company says 1Gbps Austin network almost ready to compete with AT&T
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.