Feeds

Security 101 fail: 3G/4G modems expose control panels to hackers

Embedded kit depressingly riddled with cross-site request forgery vulns, says researcher

Build a business case: developing custom apps

Vulnerabilities in a number of 3G and 4G USB modems can be exploited to steal login credentials – or rack up victims' mobile bills by sending text messages to premium-rate numbers – a security researcher warns.

Andreas Lindh claims that all the devices he has looked at so far are managed via their built-in web servers and – you guessed it – are vulnerable to cross-site request forgery (CSRF) attacks. This means a malicious website visited by a victim can quietly and automatically access the USB modem's control-panel web page and tamper with the device.

Thus, a vulnerable gadget can be tricked into sending SMS messages over the mobile network to a miscreant-controlled premium-rate number. Similarly, a malicious web page could masquerade as a legit login page – such as the account sign-in page for Twitter – and covertly text the victim's intercepted username and password to the hacker.

Lindh demonstrated he was able to contain a counterfeit Facebook login page in a data URI hidden behind a TinyURL link, which could be sent to a victim by email or a social network: opening the data URI renders the bogus Facebook page in the browser, and when the user submits his or her username and password, some cunning JavaScript texts the credentials via the connected vulnerable USB modem.

The web interface for each affected device is usually reached from a 192.168.x.x or 10.x.x.x network address: it can be used to configure roaming or set a SIM PIN. But one of the less publicized features is the ability to silently send and receive text messages, once the user has successfully connected the device to the phone network.

"I fairly quickly found a CSRF vulnerability that would allow me to make the modem send a text message to any number of my choosing, simply by having the user go to a website under my control," Lindh claimed. "Unlike Wi-Fi routers, there is no login functionality for USB modems so I didn’t have to worry about bypassing authentication."

Martijn Grooten, Virus Bulletin's anti-spam test director, added that the vulnerability in USB mobile devices uncovered by Lindh are ideal for spear-phishing attacks.

"It's not hard to see how an attacker could turn this hack into a money-making scheme by having the modem send SMS messages to a premium rate number under their control," Grooten said. "But it can also be used in a rather cunning spear-phishing attack, which would be especially useful given that these modems are mostly used by corporate customers."

David Rogers, who teaches mobile systems security at the University of Oxford and runs the mobilephonesecurity.org blog, told The Register that the hole uncovered by Lindh is similar to the shortcomings in the web control panels of insecure home broadband routers, such as the flawed EE BrightBox.

The problems all stem from a lack of consideration for security in the design of cheap consumer communications kit and, more particularly, a lack of testing. The 3G/4G modem issue is due to a lack of authentication, and this could be resolved by a firmware update combined with a fresh set of instructions to consumers, Rogers explained.

"The 3G/4G modem issue might be abused in a number of ways in criminal attacks and fraud," he said. "The easy money would be in sending premium-rate SMS messages that would run up bills at the expense of victims."

"Someone could grab someone else's dongle and use it for free. We've heard a lot about backdoors in equipment as a result of the Snowden leaks but the main thing that's going to affect people from this one is criminal. Fortunately the problem is easily fixed." ®

The essential guide to IT transformation

More from The Register

next story
Rupert Murdoch says Google is worse than the NSA
Mr Burns vs. The Chocolate Factory, round three!
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
Know what Ferguson city needs right now? It's not Anonymous doxing random people
U-turn on vow to identify killer cop after fingering wrong bloke
Germany 'accidentally' snooped on John Kerry and Hillary Clinton
Dragnet surveillance picks up EVERYTHING, USA, m'kay?
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
Who needs hackers? 'Password1' opens a third of all biz doors
GPU-powered pen test yields more bad news about defences and passwords
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Solving today's distributed Big Data backup challenges
Enable IT efficiency and allow a firm to access and reuse corporate information for competitive advantage, ultimately changing business outcomes.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.