Feeds

Security 101 fail: 3G/4G modems expose control panels to hackers

Embedded kit depressingly riddled with cross-site request forgery vulns, says researcher

Combat fraud and increase customer satisfaction

Vulnerabilities in a number of 3G and 4G USB modems can be exploited to steal login credentials – or rack up victims' mobile bills by sending text messages to premium-rate numbers – a security researcher warns.

Andreas Lindh claims that all the devices he has looked at so far are managed via their built-in web servers and – you guessed it – are vulnerable to cross-site request forgery (CSRF) attacks. This means a malicious website visited by a victim can quietly and automatically access the USB modem's control-panel web page and tamper with the device.

Thus, a vulnerable gadget can be tricked into sending SMS messages over the mobile network to a miscreant-controlled premium-rate number. Similarly, a malicious web page could masquerade as a legit login page – such as the account sign-in page for Twitter – and covertly text the victim's intercepted username and password to the hacker.

Lindh demonstrated he was able to contain a counterfeit Facebook login page in a data URI hidden behind a TinyURL link, which could be sent to a victim by email or a social network: opening the data URI renders the bogus Facebook page in the browser, and when the user submits his or her username and password, some cunning JavaScript texts the credentials via the connected vulnerable USB modem.

The web interface for each affected device is usually reached from a 192.168.x.x or 10.x.x.x network address: it can be used to configure roaming or set a SIM PIN. But one of the less publicized features is the ability to silently send and receive text messages, once the user has successfully connected the device to the phone network.

"I fairly quickly found a CSRF vulnerability that would allow me to make the modem send a text message to any number of my choosing, simply by having the user go to a website under my control," Lindh claimed. "Unlike Wi-Fi routers, there is no login functionality for USB modems so I didn’t have to worry about bypassing authentication."

Martijn Grooten, Virus Bulletin's anti-spam test director, added that the vulnerability in USB mobile devices uncovered by Lindh are ideal for spear-phishing attacks.

"It's not hard to see how an attacker could turn this hack into a money-making scheme by having the modem send SMS messages to a premium rate number under their control," Grooten said. "But it can also be used in a rather cunning spear-phishing attack, which would be especially useful given that these modems are mostly used by corporate customers."

David Rogers, who teaches mobile systems security at the University of Oxford and runs the mobilephonesecurity.org blog, told The Register that the hole uncovered by Lindh is similar to the shortcomings in the web control panels of insecure home broadband routers, such as the flawed EE BrightBox.

The problems all stem from a lack of consideration for security in the design of cheap consumer communications kit and, more particularly, a lack of testing. The 3G/4G modem issue is due to a lack of authentication, and this could be resolved by a firmware update combined with a fresh set of instructions to consumers, Rogers explained.

"The 3G/4G modem issue might be abused in a number of ways in criminal attacks and fraud," he said. "The easy money would be in sending premium-rate SMS messages that would run up bills at the expense of victims."

"Someone could grab someone else's dongle and use it for free. We've heard a lot about backdoors in equipment as a result of the Snowden leaks but the main thing that's going to affect people from this one is criminal. Fortunately the problem is easily fixed." ®

SANS - Survey on application security programs

Whitepapers

Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.