Slashdot Mirror
Vodafone Femtocells Rooted, Secret Keys Exposed
AmiMoJo writes "Hackers have discovered the root password for Vodafone femtocells, devices that provide the user with a mobile phone signal piggybacked onto their home broadband. The root password was 'newsys.' Once root access is obtained, phones can be forced to connect to the cell and private keys captured, allowing the user to spoof the victim's phone and potentially make calls or send texts on their account, not to mention eavesdrop."
Wait, we're still explaining to people on Slashdot what the function of one is?
I once took an excursion to Reddit, and later HN. Unlimited up/down voting sucks when dealing with a hive-mind.
this was fixed in 2010... http://www.theregister.co.uk/2011/07/14/voda_dismisses_femtocell_base_station_hack/
nope, not Streisand - afaik Vodafone isn't trying to suppress this information.
Don't you think that the marketing guys are overdoing it with all these S.I. preffix's
You couldn't even see a femtocell (10 to the minus 15) in an electron microscope
I can't say I am surprised.
Vodafone are a terrible company. They are one of the most expensive in the UK. They gouge me. I am changing as soon as I can. They claim to offer unlimited texts but if you send a text that is bigger than 160 characters, they charge you. They also don't pay taxes in the UK, they owe 4.8 billion in taxes but our government decided 'to let it go'.
Now in the UK we're facing cuts to public services, education, electricity rises. I'm not bitter. Vodafone is a bad business. You should change from them and warn people of the same. Didn't they have something to do with Egypt censorship too?
Their website is also littered with Java exceptions.
Vodafone = Incompetent
Slashdot needs Geekcode | Can anyone recommend any good SCIFI? My tastes: Foundation, Startide Rising, CITY, Ringworld,
vodafone guys are on summer vacation, they're not trying to do anything. it's a MASSIVE cock up. you could in theory&practice buy one of those boxes, do a little work on it and go anywhere in the world to steal anyones (who's phone was willing to roam) imsi numbers and call with them as if they were roaming in uk. if they change the authentications they have to replace every friggin femto cell they've sold. and they must do that. and they're fucked as far as knowing who has done this or not.
Isn't that kind of insecure? As in, the sort of thing that you would slap people for setting a root password as?
Our culture doesn't get smarter, it just finds new ways of being retarded.
... if you read Harald Welte's blog: http://laforge.gnumonks.org/weblog/2011/07/14/#20110714-vodafone_femtocell_thc
My spirit takes a journey through my mind...
nope, not Streisand - afaik Vodafone isn't trying to suppress this information.
That's what they want you to think. They're going for a reverse double anti-streisand. It's a smokescreen. A double-bluff. It's an XK-Red-27 technique.
Some of my favourite people are from th US; Vonnegut, Chomsky, Bill Hicks.
if they change the authentications they have to replace every friggin femto cell they've sold.
Yes, or they could remotely patch the firmware. Which they've done.
You get full marks for logic and grammar.
Slashdot - News for Nerds, Stuff that Matters, in ISO-8859-1 Has just realised that beta makes this signature redundant
according to this press release they reacted. Last year. with an update.
even THC's wikipage claims that the project was enden mid-2010 because of "too much fun with other things". This hack is very interesting, but more for historical reasons and not because everyone is now vulnerable
Why dose having root on any cell, let alone a femtocell give you the ability to impersonate and eavesdrop? They should be simply forwarding the encrypted streams to/from Vodaphone they have no need to interpret or modify them. In fact it would have been trivial to design a phone system where even the operators can't eavesdrop, encrypting each call with the receiver's public key. The first time you rang a new number you would have to trust you were getting the correct public-key, but any abuse would be easy to detect and prove. This would mean that voice-mail etc. was only accessible with the original SIM, but that may not be too much of a compromise! You could still require that any phone connecting to the network submits its private keys to law enforcement.
A 6 digit, all alpha, all lowercase password, made from real words.
While it's entirely possible the password would have been hacked if the password was 16 alpha-numeric-punc chars, it's hard to by sympathetic to Vodaphone when they're this sloppy.
------ The best brain training is now totally free : )
In embedded devices like these, there is no reason to use a root password. The devices should be locked down completely with a process to update them with signed firmware.
If they need some form of remote access, they should at the very least use SSH PKI.
'Can everyone hear me now?'
Their blog archive goes all the way back to July 2011!
I'm sure "SlashdotMedia" will improve on all the wonders that Dice Holdings blessed us all with
This will help, but from the security POV, only the devices which have not been rooted; after that, incoming firmwares could be intercepted and applied either not at all or only partially.
I suppose they could have sign the firmware for the boot loader to check, but given the root password 'newsys', this doen't seem to go with their style..
TFA didn't have any proof of this; is there another link that shows that they did indeed patch the firmware? Can it be remotely updated in a forced push? That would be unusual. Often they're user-driven push routines.
---- Teach Peace. It's Cheaper Than War.
Yes, or they could remotely patch the firmware. Which they've done.
No, no, no...all you need to do is add a HOSTS file, and everything will be 100% secure until the end of the universe!!
hehehe.
"City hall" in German is "Rathaus" Kinda explains a few things......
_ I've seen enough APK posts to find that funny. :P
I worked for a company that made a security device with a default password for updates. The password was changed, post build, using the asset (serial) number of the device, a label added to the bottom of the device after install, with the default password added to the end of the string. This ensured that every device had a semi-unique password that required physical access to the device for anyone to figure out the first part of the manufacturer password. Not being a dumb ass company, that was not sufficient for them. Why? Despite the fact that the asset number was alpha numeric, all one needed to do is look at two devices to see the sequence (nn-cc-nnnn-cc-nnnnn). From there, generating nn-cc-nnnn-cc-nnnnn sequences in front of a properly guessed default password would allow brute force attacks. Anyway, the simple answer to the problem is to have a good enough UNIQUE default password then force the buyer to enter a password before the device would work.
Having to work for a living is the root of all evil.
How could a major project at a major public company start without addressing security?
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
newsys.
Ferchrissake! plaintext, all lowercase. Not even a long, machine generated key!
It looks like the credentials for the dev lab were never updated.
"Flyin' in just a sweet place,
Never been known to fail..."
why does anyone ship anything with a six-character password? why does any website allow them? eight is barely sufficient given recent gpu-based attacks, and i seriously doubt people who have trouble remembering eight characters have any less trouble with six.
Media that can be recorded and distributed can be recorded and distributed.
-kfg
Umm, is there a way to modify my HOSTS file so I don't ever have to see your ramblings again? 'Cuz that would be a good reason to modify my HOSTS file.
Wow! Watch the spittle fly!!!
"City hall" in German is "Rathaus" Kinda explains a few things......