Feeds

Security 101 fail: 3G/4G modems expose control panels to hackers

Embedded kit depressingly riddled with cross-site request forgery vulns, says researcher

Internet Security Threat Report 2014

Vulnerabilities in a number of 3G and 4G USB modems can be exploited to steal login credentials – or rack up victims' mobile bills by sending text messages to premium-rate numbers – a security researcher warns.

Andreas Lindh claims that all the devices he has looked at so far are managed via their built-in web servers and – you guessed it – are vulnerable to cross-site request forgery (CSRF) attacks. This means a malicious website visited by a victim can quietly and automatically access the USB modem's control-panel web page and tamper with the device.

Thus, a vulnerable gadget can be tricked into sending SMS messages over the mobile network to a miscreant-controlled premium-rate number. Similarly, a malicious web page could masquerade as a legit login page – such as the account sign-in page for Twitter – and covertly text the victim's intercepted username and password to the hacker.

Lindh demonstrated he was able to contain a counterfeit Facebook login page in a data URI hidden behind a TinyURL link, which could be sent to a victim by email or a social network: opening the data URI renders the bogus Facebook page in the browser, and when the user submits his or her username and password, some cunning JavaScript texts the credentials via the connected vulnerable USB modem.

The web interface for each affected device is usually reached from a 192.168.x.x or 10.x.x.x network address: it can be used to configure roaming or set a SIM PIN. But one of the less publicized features is the ability to silently send and receive text messages, once the user has successfully connected the device to the phone network.

"I fairly quickly found a CSRF vulnerability that would allow me to make the modem send a text message to any number of my choosing, simply by having the user go to a website under my control," Lindh claimed. "Unlike Wi-Fi routers, there is no login functionality for USB modems so I didn’t have to worry about bypassing authentication."

Martijn Grooten, Virus Bulletin's anti-spam test director, added that the vulnerability in USB mobile devices uncovered by Lindh are ideal for spear-phishing attacks.

"It's not hard to see how an attacker could turn this hack into a money-making scheme by having the modem send SMS messages to a premium rate number under their control," Grooten said. "But it can also be used in a rather cunning spear-phishing attack, which would be especially useful given that these modems are mostly used by corporate customers."

David Rogers, who teaches mobile systems security at the University of Oxford and runs the mobilephonesecurity.org blog, told The Register that the hole uncovered by Lindh is similar to the shortcomings in the web control panels of insecure home broadband routers, such as the flawed EE BrightBox.

The problems all stem from a lack of consideration for security in the design of cheap consumer communications kit and, more particularly, a lack of testing. The 3G/4G modem issue is due to a lack of authentication, and this could be resolved by a firmware update combined with a fresh set of instructions to consumers, Rogers explained.

"The 3G/4G modem issue might be abused in a number of ways in criminal attacks and fraud," he said. "The easy money would be in sending premium-rate SMS messages that would run up bills at the expense of victims."

"Someone could grab someone else's dongle and use it for free. We've heard a lot about backdoors in equipment as a result of the Snowden leaks but the main thing that's going to affect people from this one is criminal. Fortunately the problem is easily fixed." ®

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Why did it take antivirus giants YEARS to drill into super-scary Regin? Symantec responds...
FYI this isn't just going to target Windows, Linux and OS X fans
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Home Office: Fancy flogging us some SECRET SPY GEAR?
If you do, tell NOBODY what it's for or how it works
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Syrian Electronic Army in news site 'hack' POP-UP MAYHEM
Gigya redirect exploit blamed for pop-rageous ploy
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
prev story

Whitepapers

10 ways wire data helps conquer IT complexity
IT teams can automatically detect problems across the IT environment, spot data theft, select unique pieces of transaction payloads to send to a data source, and more.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
How to determine if cloud backup is right for your servers
Two key factors, technical feasibility and TCO economics, that backup and IT operations managers should consider when assessing cloud backup.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.