Security 101 fail: 3G/4G modems expose control panels to hackers
Embedded kit depressingly riddled with cross-site request forgery vulns, says researcher
Vulnerabilities in a number of 3G and 4G USB modems can be exploited to steal login credentials – or rack up victims' mobile bills by sending text messages to premium-rate numbers – a security researcher warns.
Andreas Lindh claims that all the devices he has looked at so far are managed via their built-in web servers and – you guessed it – are vulnerable to cross-site request forgery (CSRF) attacks. This means a malicious website visited by a victim can quietly and automatically access the USB modem's control-panel web page and tamper with the device.
Thus, a vulnerable gadget can be tricked into sending SMS messages over the mobile network to a miscreant-controlled premium-rate number. Similarly, a malicious web page could masquerade as a legit login page – such as the account sign-in page for Twitter – and covertly text the victim's intercepted username and password to the hacker.
The web interface for each affected device is usually reached from a 192.168.x.x or 10.x.x.x network address: it can be used to configure roaming or set a SIM PIN. But one of the less publicized features is the ability to silently send and receive text messages, once the user has successfully connected the device to the phone network.
"I fairly quickly found a CSRF vulnerability that would allow me to make the modem send a text message to any number of my choosing, simply by having the user go to a website under my control," Lindh claimed. "Unlike Wi-Fi routers, there is no login functionality for USB modems so I didn’t have to worry about bypassing authentication."
Martijn Grooten, Virus Bulletin's anti-spam test director, added that the vulnerability in USB mobile devices uncovered by Lindh are ideal for spear-phishing attacks.
"It's not hard to see how an attacker could turn this hack into a money-making scheme by having the modem send SMS messages to a premium rate number under their control," Grooten said. "But it can also be used in a rather cunning spear-phishing attack, which would be especially useful given that these modems are mostly used by corporate customers."
David Rogers, who teaches mobile systems security at the University of Oxford and runs the mobilephonesecurity.org blog, told The Register that the hole uncovered by Lindh is similar to the shortcomings in the web control panels of insecure home broadband routers, such as the flawed EE BrightBox.
The problems all stem from a lack of consideration for security in the design of cheap consumer communications kit and, more particularly, a lack of testing. The 3G/4G modem issue is due to a lack of authentication, and this could be resolved by a firmware update combined with a fresh set of instructions to consumers, Rogers explained.
"The 3G/4G modem issue might be abused in a number of ways in criminal attacks and fraud," he said. "The easy money would be in sending premium-rate SMS messages that would run up bills at the expense of victims."
"Someone could grab someone else's dongle and use it for free. We've heard a lot about backdoors in equipment as a result of the Snowden leaks but the main thing that's going to affect people from this one is criminal. Fortunately the problem is easily fixed." ®