Feeds

Security 101 fail: 3G/4G modems expose control panels to hackers

Embedded kit depressingly riddled with cross-site request forgery vulns, says researcher

The essential guide to IT transformation

Vulnerabilities in a number of 3G and 4G USB modems can be exploited to steal login credentials – or rack up victims' mobile bills by sending text messages to premium-rate numbers – a security researcher warns.

Andreas Lindh claims that all the devices he has looked at so far are managed via their built-in web servers and – you guessed it – are vulnerable to cross-site request forgery (CSRF) attacks. This means a malicious website visited by a victim can quietly and automatically access the USB modem's control-panel web page and tamper with the device.

Thus, a vulnerable gadget can be tricked into sending SMS messages over the mobile network to a miscreant-controlled premium-rate number. Similarly, a malicious web page could masquerade as a legit login page – such as the account sign-in page for Twitter – and covertly text the victim's intercepted username and password to the hacker.

Lindh demonstrated he was able to contain a counterfeit Facebook login page in a data URI hidden behind a TinyURL link, which could be sent to a victim by email or a social network: opening the data URI renders the bogus Facebook page in the browser, and when the user submits his or her username and password, some cunning JavaScript texts the credentials via the connected vulnerable USB modem.

The web interface for each affected device is usually reached from a 192.168.x.x or 10.x.x.x network address: it can be used to configure roaming or set a SIM PIN. But one of the less publicized features is the ability to silently send and receive text messages, once the user has successfully connected the device to the phone network.

"I fairly quickly found a CSRF vulnerability that would allow me to make the modem send a text message to any number of my choosing, simply by having the user go to a website under my control," Lindh claimed. "Unlike Wi-Fi routers, there is no login functionality for USB modems so I didn’t have to worry about bypassing authentication."

Martijn Grooten, Virus Bulletin's anti-spam test director, added that the vulnerability in USB mobile devices uncovered by Lindh are ideal for spear-phishing attacks.

"It's not hard to see how an attacker could turn this hack into a money-making scheme by having the modem send SMS messages to a premium rate number under their control," Grooten said. "But it can also be used in a rather cunning spear-phishing attack, which would be especially useful given that these modems are mostly used by corporate customers."

David Rogers, who teaches mobile systems security at the University of Oxford and runs the mobilephonesecurity.org blog, told The Register that the hole uncovered by Lindh is similar to the shortcomings in the web control panels of insecure home broadband routers, such as the flawed EE BrightBox.

The problems all stem from a lack of consideration for security in the design of cheap consumer communications kit and, more particularly, a lack of testing. The 3G/4G modem issue is due to a lack of authentication, and this could be resolved by a firmware update combined with a fresh set of instructions to consumers, Rogers explained.

"The 3G/4G modem issue might be abused in a number of ways in criminal attacks and fraud," he said. "The easy money would be in sending premium-rate SMS messages that would run up bills at the expense of victims."

"Someone could grab someone else's dongle and use it for free. We've heard a lot about backdoors in equipment as a result of the Snowden leaks but the main thing that's going to affect people from this one is criminal. Fortunately the problem is easily fixed." ®

Next gen security for virtualised datacentres

More from The Register

next story
Ice cream headache as black hat hacks sack Dairy Queen
I scream, you scream, we all scream 'DATA BREACH'!
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
New Snowden leak: How NSA shared 850-billion-plus metadata records
'Federated search' spaffed info all over Five Eyes chums
Three quarters of South Korea popped in online gaming raids
Records used to plunder game items, sold off to low lifes
Oz fed police in PDF redaction SNAFU
Give us your metadata, we'll publish your data
prev story

Whitepapers

5 things you didn’t know about cloud backup
IT departments are embracing cloud backup, but there’s a lot you need to know before choosing a service provider. Learn all the critical things you need to know.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Backing up Big Data
Solving backup challenges and “protect everything from everywhere,” as we move into the era of big data management and the adoption of BYOD.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?