Slashdot Mirror
Gaining Root Access On Linux-Based Femtocells
viralMeme writes "According to the Register, 'Security researchers have turned their attention to femtocells, and have discovered that gaining root on the tiny mobile base stations isn't as hard as one might hope.' One of the researchers said, 'After hours of sniffing traffic, changing IP address ranges, guessing passwords and investigating hardware pinouts, we had obtained root access on these Linux-based cellular-based devices, which piqued our curiosity [about] the security implications.' Whoever designed these devices should be sent back to computer school. An authentication device that can be bypassed is a contradiction in terms. Or, as some pen-pusher would put it in a report: an unantipicated security excursion.
That's trouble o' some kind, George.
An authentication device that can be bypassed is a contradiction in terms.
You don't need to see his identification.
Huh? Public keys are just that... public. A hash of a public key demonstrates nothing. ...wait a second. You were on the dev team of these femtocell things weren't you?
"linux is just DOS with a UNIX like syntax" -- Galactic Dominator (944134)
But, if an attacker can get control, then so can the owner, which means the owner can fix the security hole.
Not really.. you're assuming the flaw exists in software. Regardless though, I'm interested to see a "fix" for a vulnerability get published which requires people to hack their phone and gives them a list of memory addresses and values that need to be changed. That would go over well.
"Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
changing IP address ranges, guessing passwords
Better passwords would have made all the difference in the world. 16 character, mixed case and symbol types would have been enough of a roadblock to prevent them from gaining access. Too many companies are still shipping products that have no intended user access to the command shell with passwords like "Admin", "12345", and the ever-popular "password". It's not like it costs more to have a longer, more complex password.
All your femtocell are belong to us!
1. "unanticipated", not "unantipicated".
2. "privilege escalation" or "privilege elevation", not "security excursion."
Let me guess ... you went to Simon Fraser. University ...
He also seems to be assuming that the attacker and the owner are two seperate people.
"linux is just DOS with a UNIX like syntax" -- Galactic Dominator (944134)
They're using the wrong gasses, thats what the problem was last time, and is this time as well.
(Yes, I read TFAs)
The Reg article kinda brushed off the risks of a cell-tower MITM attack, relegating it to a mere "loss of privacy" because the 3G cryptosystem is strong.
I assume it means that the cryptosystem is too strong for a realtime attack. It's a damn rare cryptosystem that can't be broken using enough stored ciphertext, so if the modified femtocell is storing and forwarding all traffic, traffic analysis + theoretical weaknesses in the algo + massive compute power == recovered clear material at some point in the future. Depending on the use case, there may be a lot of value in that.
Welcome to the Panopticon. Used to be a prison, now it's your home.
Don't use the regular 3G voicecalls, use only encrypted VoiP. Preferebly with a microSD card filled with one-time pad
Of course its not actually a bad thign that these are hacked, people just need to realise that their communications are not secure. just like when I use my Nokia's SIP client now I know full well that it would be easy for the person who'se WiFi i'm using to intercept my calls but I take the chance anyway.
Femtocells rely on 'security against the user' much like DRM does, in fact a large part of the 3G/GSM network relies on people not being able to fuck around with their own equipment too much, so I am actually surprised it took this long since that client-side security model is doomed anyway
I believe we usually call "fixes" requiring people to "hack" their phones "firmware upgrades" - The fact that many of us hack our phones with other firmware / software doesn't change what the company is going to call it. It would seem to me to be fairly easy to set up even cheap phones for such a firmware upgrade. Any old phone would need to be replaced at end of contract or it simply would stop functioning. While this won't immediately solve the privacy issues, it would provide for a workable solution. For those with smartphones, firmware upgrades can be pushed or dl'ed via itunes/whatever.
I for one welcome our easily-rooted overlords.
Their computer schooling isn't the problem, it's that they've probably also gone to business school. Rule #1, always cut corners to finish the product on time.
The summary mentions "investigating hardware pinouts". This makes me think that the attack is, in part, on the hardware. If one has access to hardware, they've pwned the system. Period. So this is a non-issue.
Second; cell phones trusting the base station has always been a security issue. And "exploits" based upon this weakness are already in use by law enforcement as well as criminals. The whole inmates sneaking cell phones into prisons has been made a non-issue based upon this very approach. Prisons are beginning to cover their facilities with femtocells which give them the ability to monitor all illicit cell traffic on their property. Any truly secure system will assume that the network carrying its traffic is insecure.
Have gnu, will travel.
If you're encrypting stuff with X's public key, then only whoever has X's private key can decrypt it. So, in essence, you're certain you're talking to X and not someone pretending to be X.
So, by displaying the hash of the public key of the device you're talking to, you're effectively showing the true identity of who you're talking to.
I think the OP's idea is that you can use this information to be sure you're connecting to your own femtocell (on which you have fixed the vulnerability) and not you neighbor's (possibly hacked) femtocell.
First of all, this is not an authentication device, it's a cell network extender, which obviously requires some kind of authentication for any measure of security. What "Authentication device" (I think they mean "authentication mechanism") has never had a vulnerability exposed? Are all devices with a privilege escalation vulnerability designed by people who "should be sent back to computer school?" ("computer school?" ...seriously?). How many privilege escalation vulnerabilities were found in the Linux kernel last year? I empathize with the fact that an escalation exploit this serious in a device that is designed to be used by the public is not a trivial matter, but the poster is being sensationalist here, and, honestly, comes across as undereducated in the subject matter. I wouldn't consider myself an expert, but this person doesn't seem to have a clear understanding of the issue. It's a security vulnerability in a device that runs Linux because the designers were lazy when picking a password.
The real issue here is the fact that security is sometimes not taken as seriously with hardware and firmware design in commodity devices as it is with software.
Just what is that supposed to mean exactly? Does this crack require physical access in order to be executed?
"We've sniffed for hours, and nothing." ... ... *knoppix cd spins up*
"Try a different BOOTP request!"
"Damn orinoco firmware..."
"This sucks, how are we gonna get a publication out of this?"
"Fine, gimme the bolt cutters"
*snip* *clink*
"Hmm.. those are intersting pinouts.. they look like.."
"Yeah, dude that's SATA !!"
"We got root! we got root!"
boycott slashdot February 10th - 17th check out: altSlashdot.org
If the public key is public, I can stick it in another femtocell.
If I have physical access to the femtocell, I can copy anything from it and stick it in another femtocell.
You cannot trust a device that untrusted people have physical access to.
Go green: turn off your refrigerator.
Well sure, but this would only be an exceptable solution to the most paranoid of technically minded people. Nobody wants to manually confirm a public key each time they make a phonecall. It's also quite worthless if you are not controlling the femtocell in question, which would be the vast majority of the time.
"linux is just DOS with a UNIX like syntax" -- Galactic Dominator (944134)
If the public key is public, I can stick it in another femtocell.
You surely can stick it into another femtocell, but that will do you no good. This new femtocell can't use this key to communicate, because it doesn't have the corresponding private key.
To give another example: I can get the public key from any bank site and stick it into my own web server. This doesn't mean I can trick people into thinking my web server is the bank's -- I won't be able to decrypt anything they send me!
Agreed. I just mentioned that in some sense the OP's post was not completely bogus.
I had no idea linux proponents were all Jedi. That explains everything.
"You don't NEED the extra features in Photoshop."
"You don't NEED integrated audio processing software."
"You don't NEED anything OpenOffice doesn't have."
"You don't NEED..."
Now those Jedi need to start using their powers for good.
"You NEED to write documentation for non-technical users..."
I've been working on hacking the Vodafone femtocells for fun. They have an internal serial port and the bootloader has no security, not to mention the Linux image uses short default passwords that are easy to crack given the shadow file. So far we don't know of a way to get root given only network control, but it might be possible depending on how their IPSEC tunnel is set up. Our goal would be to use these for our own network, via OpenBSC.
It's worth noting that it's early and we're not entirely sure about the security implications and just how much you can do with these things (e.g. I don't know yet if voice traffic is decrypted inside the femtocell or if it is passed on encrypted to the servers). Chances are there will be some interesting exploits and chances are they will be presented at this year's Chaos Community Congress if they're interesting enough. Unless we get bored and work on something else, which happens sometimes.
Whoever used the term "computer school" should be sent back to university.
BeauHD. Worst editor since kdawson.
Embedded devices and security don't mix. The people who design the devices and software have very different goals. Most embedded guys are just trying to hack some abortion of a CPU+board to work at all for their needs. No one gives security a second thought, beyond setting a password (or not).
The guys who care about security are usually working on bank software etc, where nothing is embedded, mostly working on VM languages on VM OSes, and the simplest feature is thousands of lines of triple-checked code with hundreds of tests against it.
Not surprising at all.
There are two modes: 'anyone' or 'from a list'. Now 'anyone' means that any Sprint customer in range can use the device up to the preprogrammed maximum of 3 simultaneous calls. 'From a list' means that only the phone numbers from a pre selected list are allowed to access the box. The problem is that is if you are a Sprint customer and your # is not on the list you can't have ANY service at all. You are in a 'private network' and therefore excluded from BOTH the Airave and connections to a local tower.
Which is stupid.
At a minimum you should be required to log onto the Airave using a PIN code which expires after "X" hours. And anyone else, who happens to be a Sprint customer is simply ignored by the Airave and ignores it so that they can access a tower.
Hell, even the OP seems to;
gaining root on the tiny mobile base stations isn't as hard as one might hope
Wha? I bought the thing, I might hope I'd have root right off the bat. I know not to expect that, but I'd still hope.
I want it to be hard for everyone else to gain root.
I used to get high on life, but I developed a tolerance. Now I need something stronger.
I spoke with Harald Welte (of OpenBSC etc. fame) on ELC Europe back in October. He told me that he successfully gained root access to one of those Femtocells sold in the UK. As far as i remember he said that it was not very difficult to get access, also that he found some of the builtin features (e.g. check if operated in the correct location) nonworking.
On the other hand: This was bound to happen. Most embedded linux systems which have at least some remote hack-value tend to get opened up some day.