Vodafone Femtocells Rooted, Secret Keys Exposed

AmiMoJo writes "Hackers have discovered the root password for Vodafone femtocells, devices that provide the user with a mobile phone signal piggybacked onto their home broadband. The root password was 'newsys.' Once root access is obtained, phones can be forced to connect to the cell and private keys captured, allowing the user to spoof the victim's phone and potentially make calls or send texts on their account, not to mention eavesdrop."

Comments

old news

[shortscruffydave]

this was fixed in 2010... http://www.theregister.co.uk/2011/07/14/voda_dismisses_femtocell_base_station_hack/

Re:old news

[EdZ]

They 'fixed' it by changing the default password, not by preventing the devices from sniffing and decrypting data from passers by. Break the new password, and the attack still works as before.

Re:old news

[naranek]

So I guess the old root password was 'sys'

Re:old news

[kyz]

http://thcorg.blogspot.com/2011/07/vodafone-hacked-root-password-published.html

"What we have seen is that Vodafone fixed the way THC gained administrator access to the femto.

This of course does not fix the core of the problem: The femto transfers key material from the core network right down to the femto."

Re:old news

[Timmmm]

Because authentication is done on the SIM card. When GSM was created I doubt they were capable of public key cryptography.

Vodafone = Bad

[improfane]

I can't say I am surprised.

Vodafone are a terrible company. They are one of the most expensive in the UK. They gouge me. I am changing as soon as I can. They claim to offer unlimited texts but if you send a text that is bigger than 160 characters, they charge you. They also don't pay taxes in the UK, they owe 4.8 billion in taxes but our government decided 'to let it go'.

Now in the UK we're facing cuts to public services, education, electricity rises. I'm not bitter. Vodafone is a bad business. You should change from them and warn people of the same. Didn't they have something to do with Egypt censorship too?

Their website is also littered with Java exceptions.

Vodafone = Incompetent

Not a big thing...

[SonOfSengaya]

... if you read Harald Welte's blog: http://laforge.gnumonks.org/weblog/2011/07/14/#20110714-vodafone_femtocell_thc

Re:Streisand

[rbrausse]

according to this press release they reacted. Last year. with an update.

even THC's wikipage claims that the project was enden mid-2010 because of "too much fun with other things". This hack is very interesting, but more for historical reasons and not because everyone is now vulnerable

End-to-end

[bWareiWare.co.uk]

Why dose having root on any cell, let alone a femtocell give you the ability to impersonate and eavesdrop? They should be simply forwarding the encrypted streams to/from Vodaphone they have no need to interpret or modify them. In fact it would have been trivial to design a phone system where even the operators can't eavesdrop, encrypting each call with the receiver's public key. The first time you rang a new number you would have to trust you were getting the correct public-key, but any abuse would be easy to detect and prove. This would mean that voice-mail etc. was only accessible with the original SIM, but that may not be too much of a compromise! You could still require that any phone connecting to the network submits its private keys to law enforcement.

Re:End-to-end

[bWareiWare.co.uk]

As you say the cells need to be trusted with the routing and hand-off. Obviously the cell can always block/drop/throttle calls but that don't mean you should trust them with everything.
To place a call on behalf of a mobile should require a time-limited signed token from the mobile's SIM. Once the call is established it makes no difference if you are routing an unencrypted voice codec or some encrypted data.
Public-key encryption could simply be used for the initial A5/1 initialization key, the voice data itself can still use a stream cipher.