Vodafone Femtocells Rooted, Secret Keys Exposed

Streisand by gizmod · 2011-07-14 21:05 · Score: 0

Streisand Launch in 4, 3, 2, 1 ...

Re:Streisand by rbrausse · 2011-07-14 21:12 · Score: 1

nope, not Streisand - afaik Vodafone isn't trying to suppress this information.
Re:Streisand by Anonymous Coward · 2011-07-14 21:25 · Score: 1

vodafone guys are on summer vacation, they're not trying to do anything. it's a MASSIVE cock up. you could in theory&practice buy one of those boxes, do a little work on it and go anywhere in the world to steal anyones (who's phone was willing to roam) imsi numbers and call with them as if they were roaming in uk. if they change the authentications they have to replace every friggin femto cell they've sold. and they must do that. and they're fucked as far as knowing who has done this or not.
Re:Streisand by migla · 2011-07-14 21:41 · Score: 1

nope, not Streisand - afaik Vodafone isn't trying to suppress this information.
That's what they want you to think. They're going for a reverse double anti-streisand. It's a smokescreen. A double-bluff. It's an XK-Red-27 technique.

--
Some of my favourite people are from th US; Vonnegut, Chomsky, Bill Hicks.
Re:Streisand by DeathToBill · 2011-07-14 21:41 · Score: 1

if they change the authentications they have to replace every friggin femto cell they've sold.
Yes, or they could remotely patch the firmware. Which they've done.
You get full marks for logic and grammar.

--
Slashdot - News for Nerds, Stuff that Matters, in ISO-8859-1 Has just realised that beta makes this signature redundant
Re:Streisand by rbrausse · 2011-07-14 21:42 · Score: 2

according to this press release they reacted. Last year. with an update.
even THC's wikipage claims that the project was enden mid-2010 because of "too much fun with other things". This hack is very interesting, but more for historical reasons and not because everyone is now vulnerable
Re:Streisand by flux · 2011-07-14 23:58 · Score: 1

This will help, but from the security POV, only the devices which have not been rooted; after that, incoming firmwares could be intercepted and applied either not at all or only partially.
I suppose they could have sign the firmware for the boot loader to check, but given the root password 'newsys', this doen't seem to go with their style..
Re:Streisand by postbigbang · 2011-07-15 00:16 · Score: 1

TFA didn't have any proof of this; is there another link that shows that they did indeed patch the firmware? Can it be remotely updated in a forced push? That would be unusual. Often they're user-driven push routines.

--
---- Teach Peace. It's Cheaper Than War.
Re:Streisand by cbiltcliffe · 2011-07-15 01:11 · Score: 1

Yes, or they could remotely patch the firmware. Which they've done.
No, no, no...all you need to do is add a HOSTS file, and everything will be 100% secure until the end of the universe!!
hehehe.

--
"City hall" in German is "Rathaus" Kinda explains a few things......
Re:Streisand by RobbieThe1st · 2011-07-15 02:17 · Score: 1

_ I've seen enough APK posts to find that funny. :P
Re:Streisand by cayenne8 · 2011-07-15 04:42 · Score: 1

Hmm...might be a good time to go out and buy one of these things....for *ahem* research.
:)

--
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
Re:Streisand by Jeremiah+Cornelius · 2011-07-15 05:08 · Score: 1

newsys.
Ferchrissake! plaintext, all lowercase. Not even a long, machine generated key!
It looks like the credentials for the dev lab were never updated.

--
"Flyin' in just a sweet place,
Never been known to fail..."

Femtocells: the next big thing! by MyFirstNameIsPaul · 2011-07-14 21:07 · Score: 1

Wait, we're still explaining to people on Slashdot what the function of one is?

--

I once took an excursion to Reddit, and later HN. Unlimited up/down voting sucks when dealing with a hive-mind.

Re:Femtocells: the next big thing! by EdIII · 2011-07-15 12:17 · Score: 1

Wait, we're still explaining to people on Slashdot what the function of one is?
The function of a femtocell is to expand the cellular range of a provider, while providing revenue to the provider instead of being an expense. Additionally, the bandwidth consumed is not on their network (cellular network), but on the customers bandwidth.
In the US at least this is abhorrent because the people, through government, granted them so many easements and right of ways, financial incentives, tax breaks, etc.
Despite how much has been given to them they continue to raise prices, encourage "mystery fees", enjoy near infinite profit margins on txt messages, etc. and do not contribute nearly enough to their infrastructures. At just what point are the American People (I don't know how this situation relates to EU), going to get compensated or some sort of benefit from all of "help" we gave the carriers to create the infrastructure?
When the bandwidth runs out and starts costing more... then it becomes issues about piracy and other bullshit that gets us all arguing about Net Neutrality.
The reason why Netflix is such a big deal is because not everyone in a neighborhood can actually be using all of their bandwidth at once. Netflix, regardless of CDNs, causes problems for them.
It is related, because it is all related to the costs of bandwidth and infrastructure.
A femtocell explained more simply is a big FUCK YOU to the consumer by the wireless carriers.
I might be more amenable to it if they leased it and gave me a discount for running one on my bandwidth.
Re:Femtocells: the next big thing! by EdIII · 2011-07-15 12:28 · Score: 1

Ohhhh, and to add insult to injury in this case the dipshits who configured the femtocells setup a 6 character password.
Seriously?
So now every femtocell they charged a consumer for to get, so they could get better reception and download speeds of their own bandwidth is not only exposing themselves to danger, but the femtocell itself can be used to wreak havoc on the cellular customers in general.
I hate to admit this, but part of me wants to laugh hysterically. The only option is to no longer accept connection from the femtocells and refund all the money, or deliver new femtocells to the existing owners.
Either way, Vodafone is going to get bent over for a jolly good time. They deserve it.

old news by shortscruffydave · 2011-07-14 21:10 · Score: 4, Insightful

this was fixed in 2010... http://www.theregister.co.uk/2011/07/14/voda_dismisses_femtocell_base_station_hack/

Re:old news by EdZ · 2011-07-14 21:41 · Score: 3, Informative

They 'fixed' it by changing the default password, not by preventing the devices from sniffing and decrypting data from passers by. Break the new password, and the attack still works as before.
Re:old news by naranek · 2011-07-14 21:45 · Score: 3, Funny

So I guess the old root password was 'sys'

--
Only dumb birds land downwind.
Re:old news by kyz · 2011-07-14 21:51 · Score: 2

http://thcorg.blogspot.com/2011/07/vodafone-hacked-root-password-published.html
"What we have seen is that Vodafone fixed the way THC gained administrator access to the femto.
This of course does not fix the core of the problem: The femto transfers key material from the core network right down to the femto."

--
Does my bum look big in this?
Re:old news by Dunbal · 2011-07-14 22:05 · Score: 1

nope, that was too short. So it was "sys123".

--
Seven puppies were harmed during the making of this post.
Re:Old news by Anonymous Coward · 2011-07-14 22:35 · Score: 0

Yet it is the first hit in search?
http://www.google.com/url?sa=t&source=web&cd=1&sqi=2&ved=0CBkQFjAA&url=http%3A%2F%2Fwww.wired.com%2Fthreatlevel%2Ftag%2Fbradley-manning%2F&rct=j&q=bradley%20manning%20wired.com&ei=XhcgTr7gCpGYOo_dmLcD&usg=AFQjCNHLcHxDfaluJIFxYRvIEUruBqUTUQ&cad=rja
--
Teun
Re:old news by Rich0 · 2011-07-14 23:17 · Score: 1

This of course does not fix the core of the problem: The femto transfers key material from the core network right down to the femto."
I'd say the core of the problem is that authentication credentials ever leave the phone in the first place. Didn't they ever hear of RSA/etc?
I just don't get it - why doesn't ANYBODY use asymmetric crypto for authentication. And when they do something remotely clever, why don't they ever use a proven off-the-shelf cryptosystem to do it? DRM may be mathematically impossible to achieve, but authentication is something that is completely achievable with the right key infrastructure. And they obviously have the key infrastructure already since symmetric crypto doesn't work without it either...
Re:old news by Anonymous Coward · 2011-07-14 23:23 · Score: 0

I've got to change the password on my luggage!
Re:old news by Timmmm · 2011-07-15 00:26 · Score: 2

Because authentication is done on the SIM card. When GSM was created I doubt they were capable of public key cryptography.
Re:old news by Anonymous Coward · 2011-07-15 05:14 · Score: 0

Sadly, you're probably not far off. The newer password "newsys" is six letters, and, as you've observed, "sys" is apparently the old part... and "system" is six letters too. I'm guessing the old root password was "system."
Re:old news by Rich0 · 2011-07-16 02:38 · Score: 1

Sure, but there was no reason that this couldn't have been upgraded ages ago. Support both protocols in parallel for a few years until tower software is updated.
Instead, we're going to hit a wall at some point when GSM is completely cracked, and suffer with a ton of issues as a result.
I would say the problem is the market, but even the NPV of a hit that big is large today. The real problem is that nobody holds managers accountable for the real consequences of failing to take action over the long term. Sure, you can fire them, but you can't take back the money you paid them for years beforehand.
Re:old news by Anonymous Coward · 2011-07-16 03:29 · Score: 0

Uh, GSM *is* completely cracked.
Plus quite a few providers run stuff unencrypted anyway - China Telecom for one.
The Apple Beta2 software was interesting in that it would warn you about that, unfortunately beta3 has removed that useful feature..

Is the audiance listening? by Anonymous Coward · 2011-07-14 21:16 · Score: 0

still a good movie.

S.I. preffix's by rossdee · 2011-07-14 21:16 · Score: 1

Don't you think that the marketing guys are overdoing it with all these S.I. preffix's

You couldn't even see a femtocell (10 to the minus 15) in an electron microscope

Re:S.I. preffix's by Rich0 · 2011-07-14 23:19 · Score: 1

The base unit is parsec, you insensitive clod!
Re:S.I. preffix's by Megane · 2011-07-14 23:38 · Score: 1

I think they should start using S.I. prefixes on reward points. They could call them "atto-boys".

--
#naabhaprzrag, #sverubfr-000, #agi-fcbafberq, negvpyr[pynff*=' negvpyr-ary-'] { qvfcynl: abar !vzcbegnag; }
Re:S.I. preffix's by Neil+Boekend · 2011-07-15 00:29 · Score: 1

The base unit should be "distance light travels in vacuum in 1 cycle of radiation corresponding to the transition between two energy levels of the cesium-133 atom"
This is the distance light travels in 1/9,192,631,770 second. Light travels at 299 792 458 m/s, so this is 299,792,458 / 9,192,631,770 = 0.0326122557174941 m (=1.28394708 inch).
That would be a distance that's based on the constants in physics.
However, if we can't convince the USA to switch to the metric system, how can we ever hope to force the complete world to switch?

--
Well, I might have a way, but it only works on a semi spherical planet in a vacuum.
Re:S.I. preffix's by Anonymous Coward · 2011-07-15 01:12 · Score: 0

That's a bizarre base unit. What's so special about cesium-133? You're picking it arbitrarily because it's the base of the current standard.
Clearly, the units of the future should be based on the Planck units, instead.
Re:S.I. preffix's by Neil+Boekend · 2011-07-15 01:49 · Score: 1

I stand corrected.
However we should invent new SI prefixes, as the current (yotta = 10^24) isn't going to cut it (Planck length is around 1.616252x10^-35 m). To represent something in human scale we'd need a simple word for 10^11 yotta Planck lengths. Maybe terra-yotta Planck lengths? with 10^36 it should be close enough to fit.

--
Well, I might have a way, but it only works on a semi spherical planet in a vacuum.
Re:S.I. preffix's by VortexCortex · 2011-07-15 03:49 · Score: 1

However, if we can't convince the USA to switch to the metric system, how can we ever hope to force the complete world to switch?
The USA does use the metric system. Their military, scientists and medical practitioners do. (Hint: "Click = Kilometer")
It's only the general populous that is forced into using antiquated and difficult to convert between standards by the USA's school system, and thus parents as well (being that they were taught to use those units too).
FTWA

According to the American Central Intelligence Agency's Factbook, the International System of Units is the official system of measurement for all nations in the world except for Burma, Liberia and the United States.

It seems the USA is deliberately hindering the populous with their obsolete units of measure. Considering that it is the corporations that control Capitalist America via limitless campaign contributions and lobyists, I think it's safe to say they have an interest in keeping the people of America confused; If it was easy to convert between units the people would be better equipped to be more intelligent shoppers -- "This is $3.99 per pound, but the no-name store-brand is $7.89 for 40oz -- I bet the products are made in the same plant; How much of what dollar ounce pound?! [conversion error -- select familiar name brand to continue shopping]"
Note: Tinfoil hats can not be made from Aluminum Foil; They've made fools of us all!
Re:S.I. preffix's by cayenne8 · 2011-07-15 05:51 · Score: 1

It's only the general populous that is forced into using antiquated and difficult to convert between standards by the USA's school system, and thus parents as well (being that they were taught to use those units too).

I wouldn't term it as forced.
For the most part...the avg US citizen can't really see any major benefit to their day to day lives switching over vs the bit of upheaval and increased monetary costs it would encounter forcing us to change to metric for everything in our ever day lives.
I mean, we're a large country, and the majority of us rarely find need or opportunity to interact with those outside the US that use metric measurements.
I've used metric when I was in college (chemistry, etc)...but honestly, I don't see any benefit it would give me to switch everything over.
At my age..the biggest PITA would be temperature. I know innately how to dress when I hear on the morning weather forecast that the high will be 50F or 90F.
I have no idea without having to look things up on how I'd dress at 20C or 50C.....those values hold no intrinsic meaning to me on how hot or cold things are....just by way of growing up with it and living in a culture with F as the measurement of temperature.
But, no one is forcing us to keep our measurements....we just don't have any compelling reason in every day normal life to want to change. Just be 'be like everyone else' isn't a good enough reason (like jumping off a bridge).

--
Light travels faster than sound. This is why some people appear bright until you hear them speak.........

Vodafone = Bad by improfane · 2011-07-14 21:21 · Score: 3

I can't say I am surprised.

Vodafone are a terrible company. They are one of the most expensive in the UK. They gouge me. I am changing as soon as I can. They claim to offer unlimited texts but if you send a text that is bigger than 160 characters, they charge you. They also don't pay taxes in the UK, they owe 4.8 billion in taxes but our government decided 'to let it go'.

Now in the UK we're facing cuts to public services, education, electricity rises. I'm not bitter. Vodafone is a bad business. You should change from them and warn people of the same. Didn't they have something to do with Egypt censorship too?

Their website is also littered with Java exceptions.

Vodafone = Incompetent

--
Slashdot needs Geekcode | Can anyone recommend any good SCIFI? My tastes: Foundation, Startide Rising, CITY, Ringworld,

Re:Vodafone = Bad by Anonymous Coward · 2011-07-14 21:34 · Score: 0

Offtopic. Replying to the signature.

--
Slashdot needs Geekcode | Can anyone recommend any good SCIFI? My tastes: Foundation, Startide Rising, CITY, Ringworld,
Have you tried any Stanislaw Lem? It's kind of like Asimov science-wise, but more like real literature literature-wise. Some of it is serious, some is humorous. Try both kinds.
Re:Vodafone = Bad by rbrausse · 2011-07-14 21:46 · Score: 0

Lem is great! A good starting point are The Star Diaries, a collection of short stories - they give a good overview of the range of Lem's style(s).
Re:Vodafone = Bad by Inda · 2011-07-14 23:58 · Score: 1

" if you send a text that is bigger than 160 characters, they charge you."

How does that work?

My phone automatically chops messages up into 160 char parts, one SMS message per part. It's not a modern phone either.

Just curious.

I use Tesco, btw. I can't fault them.

--
This post contains benzene, nitrosamines, formaldehyde and hydrogen cyanide.
Re:Vodafone = Bad by NJRoadfan · 2011-07-15 00:16 · Score: 1

Its likely that the phone is sending the longer messages as MMS or EMS, which is likely NOT covered by the "unlimited text messages" plan.
Re:Vodafone = Bad by improfane · 2011-07-15 00:25 · Score: 1

My phone chops it up into small messages but the 'unlimited' only applies to the first message. I get charged a for additional texts if my message spans more than one. It's a money grab because if I break the text manually into two separate texts, I do not get charged.
This happens on my old W595 (supports MMS) and my current Nokia 1661 (no MMS, no 3G).

--
Slashdot needs Geekcode | Can anyone recommend any good SCIFI? My tastes: Foundation, Startide Rising, CITY, Ringworld,
Re:Vodafone = Bad by Timmmm · 2011-07-15 00:28 · Score: 1

Yeah Android had (maybe still has) a bug where texts longer than 3*160 are sent as an MMS.
Re:Vodafone = Bad by improfane · 2011-07-15 00:28 · Score: 1

My Nokkia 1661 does not support MMS.
Vodafone treat multipart text messages as separate texts on the server side to rip people off. Especially when you consider that it does not charge if you break up a text manually by yourself.

--
Slashdot needs Geekcode | Can anyone recommend any good SCIFI? My tastes: Foundation, Startide Rising, CITY, Ringworld,
Re:Vodafone = Bad by Anonymous Coward · 2011-07-15 00:39 · Score: 0

Would be hard to call that a bug. Quite a few older handsets can't deal with concatenated SMS messages with more than 3 parts.
Re:Vodafone = Bad by mikael_j · 2011-07-15 01:33 · Score: 1

That seems weird, the common way to do it is to have an ID imbedded in the message so that the receiving device can tell which messages are actually parts of the same longer message.
The biggest problem with this scheme is when a device receives only part of the message, all phones seem to handle this differently. Some show what they got after a while, others simply chuck it, others still will hang on to the data just in case a matching ID shows up later (which can lead to hilarity since the IDs are far from unique).

--
Greylisting is to SMTP as NAT is to IPv4
Re:Vodafone = Bad by Anonymous Coward · 2011-07-16 03:42 · Score: 0

You should realize the people developing these devices are not from Vodafone, but from outside. Mobile companies just brand the device, but give the work to others like Huawei, Siemens, etc. You also realize people working in the marketing department(who most likely operate the website) are not the ones that operate the mobile network. The website malfunctioning is just lost public image, the mobile network not functioning is lost revenue in the most explicit form.
Your assessment that Vodafone is incompetent is maybe just a bit hasty.

zing! by Anonymous Coward · 2011-07-14 21:21 · Score: 0

You couldn't even see a femtocell (10 to the minus 15) in an electron microscope

Just like your wang?

The root password is "newsys"? by Sparx139 · 2011-07-14 21:28 · Score: 1

Isn't that kind of insecure? As in, the sort of thing that you would slap people for setting a root password as?

--
Our culture doesn't get smarter, it just finds new ways of being retarded.

Not a big thing... by SonOfSengaya · 2011-07-14 21:36 · Score: 2

... if you read Harald Welte's blog: http://laforge.gnumonks.org/weblog/2011/07/14/#20110714-vodafone_femtocell_thc

--
My spirit takes a journey through my mind...

End-to-end by bWareiWare.co.uk · 2011-07-14 21:42 · Score: 3, Funny

Why dose having root on any cell, let alone a femtocell give you the ability to impersonate and eavesdrop? They should be simply forwarding the encrypted streams to/from Vodaphone they have no need to interpret or modify them. In fact it would have been trivial to design a phone system where even the operators can't eavesdrop, encrypting each call with the receiver's public key. The first time you rang a new number you would have to trust you were getting the correct public-key, but any abuse would be easy to detect and prove. This would mean that voice-mail etc. was only accessible with the original SIM, but that may not be too much of a compromise! You could still require that any phone connecting to the network submits its private keys to law enforcement.

Re:End-to-end by Anonymous Coward · 2011-07-14 21:47 · Score: 1

Are you crazy? Vodafone is notorious for enabling easy and unquestioned access to law enforcement. Any form of encryption would make it harder for them to hand over your data.
Re:End-to-end by drolli · 2011-07-14 21:52 · Score: 1

It would not be legally trivial, for a number of reasons.
Re:End-to-end by kyz · 2011-07-14 22:05 · Score: 1

Cell networks have the same need for time-critical end-to-end delivery as fixed line networks, and thus have a very similar architecture. They don't look anything like IP networks.
Cell sites place calls on behalf of the mobile, and talk with other cell sites to handover calls in progress as the mobile passes through. They have to be trusted to do that.
GSM encryption works on the basis that the company who issued the SIM card also knows the secret keys inside the SIM card. That way, both ends can synchronise encryption/decryption, even if packets are lost and not re-transmitted. Public-key encryption almost invariably uses a block cipher that can't do that. What use is that to a phone network?

--
Does my bum look big in this?
Re:End-to-end by bWareiWare.co.uk · 2011-07-14 22:32 · Score: 2

As you say the cells need to be trusted with the routing and hand-off. Obviously the cell can always block/drop/throttle calls but that don't mean you should trust them with everything.
To place a call on behalf of a mobile should require a time-limited signed token from the mobile's SIM. Once the call is established it makes no difference if you are routing an unencrypted voice codec or some encrypted data.
Public-key encryption could simply be used for the initial A5/1 initialization key, the voice data itself can still use a stream cipher.
Re:End-to-end by Rich0 · 2011-07-14 23:27 · Score: 1

Mod parent up - either symmetric or public-key encryption requires authentication with some trusted server (is the phone's account activated, etc), and if the central server can hold a copy of a symmetric key it can hold a copy of a public key.
There is also no need to escrow private keys - the network already needs access to the clear voice conversation and dialing info just to complete the call, and that is all the FBI needs. There is no need to be able to clone phones. Plus, if you wanted to clone a phone just assign a new key and have the central server give a positive authentication for either one (ie you manipulate the central database).
As with most things crypto, the GSM creators decided to re-invent the wheel, and the only reason it works is that hackers just haven't quite caught up yet. Once rogue base stations are seeded all over the place, cloned SIM cards will be sold on every street corner in New York, and once again we'll be punching in PINs or whatever to make phone calls as an almost-effective stop gap until the whole system is torn down and replaced.
Re:End-to-end by Anonymous Coward · 2011-07-15 01:01 · Score: 0

Vodaphone's femtocells decrypted the transmission in the femtocell, before re-transmitting it across the IP link. So if you had physical access to the femtocell, you had physical access to the unencrypted data stream.
The concern was that, if you bought a femtocell and tweaked its firmware, you could trick any Vodaphone handset nearby into using your femtocell. Which you control. And which leaves the data stream unencrypted internally.
(Ars has a decent story on this, http://arstechnica.com/security/news/2011/07/insecure-vodafone-femtocells-allow-eavesdropping-call-fraud.ars )

Nice password by popo · 2011-07-14 21:56 · Score: 1

A 6 digit, all alpha, all lowercase password, made from real words.

While it's entirely possible the password would have been hacked if the password was 16 alpha-numeric-punc chars, it's hard to by sympathetic to Vodaphone when they're this sloppy.

--
------ The best brain training is now totally free : )

Slap anyone that sets a root password by GroovinWithMrBloe · 2011-07-14 21:56 · Score: 1

In embedded devices like these, there is no reason to use a root password. The devices should be locked down completely with a process to update them with signed firmware.

If they need some form of remote access, they should at the very least use SSH PKI.

Old news by Anonymous Coward · 2011-07-14 22:05 · Score: 0

This is old news... Yet Slashdot mysteriously won't cover the story about the unredacted Manning/Lamo chat logs that just came out.
In fact, Google has completely censored it from their news/rss aggregators.

Has Rupert Murdoch by Anonymous Coward · 2011-07-14 23:37 · Score: 0

heard about this yet?

Oblig by ThatsNotPudding · 2011-07-14 23:42 · Score: 1

'Can everyone hear me now?'

Thanks for the shitty blog link, slashdot! by Megaweapon · 2011-07-14 23:43 · Score: 1

Their blog archive goes all the way back to July 2011!

--
I'm sure "SlashdotMedia" will improve on all the wonders that Dice Holdings blessed us all with

Password by Anonymous Coward · 2011-07-15 01:17 · Score: 0

GOD

Resurgence of Phreaking by Anonymous Coward · 2011-07-15 02:23 · Score: 0

Now everything has come full circle and hackers can finally return to their roots.

Asset # + Default password by sgt+scrub · 2011-07-15 03:13 · Score: 1

I worked for a company that made a security device with a default password for updates. The password was changed, post build, using the asset (serial) number of the device, a label added to the bottom of the device after install, with the default password added to the end of the string. This ensured that every device had a semi-unique password that required physical access to the device for anyone to figure out the first part of the manufacturer password. Not being a dumb ass company, that was not sufficient for them. Why? Despite the fact that the asset number was alpha numeric, all one needed to do is look at two devices to see the sequence (nn-cc-nnnn-cc-nnnnn). From there, generating nn-cc-nnnn-cc-nnnnn sequences in front of a properly guessed default password would allow brute force attacks. Anyway, the simple answer to the problem is to have a good enough UNIQUE default password then force the buyer to enter a password before the device would work.

--
Having to work for a living is the root of all evil.

Written Design Plan for Femtocell? by BoRegardless · 2011-07-15 03:34 · Score: 1

How could a major project at a major public company start without addressing security?

Re:Written Design Plan for Femtocell? by Anonymous Coward · 2011-07-15 05:58 · Score: 0

It's more than likely that some of the people responsible for security were simply ignored...

RobbieThe1st - R U A sockpuppet of cbiltcliffe's? by Anonymous Coward · 2011-07-15 06:52 · Score: 0

Or what?? Is that comment of yours supposed to upset me? If so, what's your problem with HOSTS files then??

APK

P.S.=> I'd like to hear about it then, go for it... & then, I'll just tear it apart with facts!

(Just like I tore the "wannabe computer security guru" cbiltcliffe apart, step by methodical destroying step this week -> http://slashdot.org/comments.pl?sid=2324770&cid=36776728 and here again now in regards to HOSTS file here -> http://slashdot.org/comments.pl?sid=2324770&cid=36777198 )

In the 1st link, lol, & in the end he HAD to agree my method for killing the "unkillable rootkit" worked, & his CD was unnecessary... lol!

(Which is WHY he's doing these trolling goadings of myself in "effete retaliation", like pussy's do in real life, instead of owning their screwups like a man instead... he can't handle his own "geek angst" @ being SPANKED by his technical superior in the art & science of computing in myself!)

... apk

six-character passwords considered harmful by adavies42 · 2011-07-15 07:33 · Score: 1

why does anyone ship anything with a six-character password? why does any website allow them? eight is barely sufficient given recent gpu-based attacks, and i seriously doubt people who have trouble remembering eight characters have any less trouble with six.

--
Media that can be recorded and distributed can be recorded and distributed.
-kfg

Re:Cbiltcliffe's "Greatest-Hits" Part #1 (lol, not by WrongSizeGlass · 2011-07-15 08:50 · Score: 1

Umm, is there a way to modify my HOSTS file so I don't ever have to see your ramblings again? 'Cuz that would be a good reason to modify my HOSTS file.

Re:RobbieThe1st - R U A sockpuppet of cbiltcliffe' by cbiltcliffe · 2011-07-15 09:14 · Score: 1

Wow! Watch the spittle fly!!!

--
"City hall" in German is "Rathaus" Kinda explains a few things......

An application of "ReVeRsE-PsyChoLoGy" by Anonymous Coward · 2011-07-15 10:45 · Score: 0

".elif STSOH ym yfidom ot nosaer doog a eb dluow taht zuC' ?niaga sgnilbmar ruoy ees ot evah reve t'nod I os elif STSOH ym yfidom ot yaw a ereht si ,mmU" - by WrongSizeGlass ANOTHER "ne'er-do-well" /. OFF-TOPIC TROLL on Friday July 15, @04:50PM (#36779976)

"???"

Uhm... Could we get a translation of that off-topic "troll-speak/trolllanguage" of yours, please?

* And, you're an off-topic troll - no questions asked...SEE MY SUBJECT LINE ABOVE!

APK

P.S.=> Yes, it must have just have been another off-topic done nothing of significance with his life troll spewing his off-topic b.s. again & not contributing to the ongoing conversations. Oh well - No biggie!

("ReVeRsE-PsYcHoLoGy", for trolls - Courtesy of this code by "yours truly" in less than 1 second flat):

---

#TrollTalkComReversePsychologyKiller.py (Ver #2 by APK)

def reverse(s):
try:
trollstring = ""
for apksays in s:
trollstring = apksays + trollstring
except:
print("error/abend in reverse function")
return trollstring

s = ""
print reverse(s)

try:
s = "Insert whatever 'trollspeak/trolllanguage' gibberish occurs here..."
s = reverse(s)
print(s)
except Exception as e:
print(e)

---

... apk

Is that the "Best You've Got", troll? by Anonymous Coward · 2011-07-15 10:48 · Score: 0

Because you did terribly here, lol -> http://slashdot.org/comments.pl?sid=2324592&cid=36776760

And here too -> http://slashdot.org/comments.pl?sid=2324592&cid=36776972

APK

P.S.=> "Run, Forrest... RUN!"

... apk

Samsung's Verizon and Sprint offerings are similar by Anonymous Coward · 2011-07-17 13:46 · Score: 0

I've gotten to the boot loader and rooted the Verizon 1x, 3g, and Sprint units. The bootloader password is stored in plain text...in their GPL release. From there, if you can figure out MonteVista linux, the ipsec keys are easily found. Also the web management passwords are easy to find. http://rsaxvc.net/cgi-bin/mt/mt-search.cgi?search=scs&IncludeBlogs=3&limit=20

Slashdot Mirror

Vodafone Femtocells Rooted, Secret Keys Exposed

77 comments