Slashdot Mirror
3G and 4G USB Modems Are Security Threat, Black Hat Presenter Says
alphadogg writes "The vast majority of 3G and 4G USB modems handed out by mobile operators to their customers are manufactured by a handful of companies and run insecure software, according to two security researchers from Russia. Researchers Nikita Tarakanov and Oleg Kupreev analyzed the security of 3G/4G USB modems obtained from Russian operators for the past several months. Their findings were presented this week at the Black Hat Europe 2013 security conference in Amsterdam. Most 3G/4G modems used in Russia, Europe, and probably elsewhere in the world, are made by Chinese hardware manufacturers Huawei and ZTE, and are branded with the mobile operators' logos and trademarks, Tarakanov said. Because of this, even if the research was done primarily on Huawei modems from Russian operators, the results should be relevant in other parts of the world as well, he said."
I did a small study on a few USB modems in the US. I found several setuid vulnerabilities and a lot of strange behavior that I didn't have the time or resources to fully analyze. You may feel safe on your personal hotspot but it does open a few potential openings if not mitigated.
Mandated backdoors aren't very well hidden. The only alternative for the authorities is to arrest the people who uncover them. Soon the 'blackhats' will have to meet in secret to protect themselves.
Tarakanov said that they weren't able to test baseband attacks against the Qualcomm chips found inside the modems because it's illegal in Russia to operate your own GSM base station if you're not an intelligence agency or a telecom operator. "We'll probably have to move to another country for a few months to do it," he said.
“He’s not deformed, he’s just drunk!”
...for the owner of a piece of hardware to be able to reprogram it?
I suppose it is, when the owner is running Windows.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
Modem modulates YOU!
Seriously... I'm beginning to wonder about the quality of presentations at Black Hat if this was even there .
The modems themselves aren't a threat. It's the fact that many of them cart around drivers and "manager" applications which could provide storage based attack vectors or through compromised versions of the driver or manager that you have any problems... Unsurprising and already well known by most security researchers.
1) For many of those "security threat" modems, Linux works wonders as does *BSD as they support the devices out of box with OS provided support.
2) There's a panopoly of devices that don't expose the machines to any of these vectors that runs $50-150 provided by vendors such as Zoom and Cradlepoint (in fact, it's what I use since it allows the LTE dongle (that doesn't have these "risks" by the way...) be able to switch between 3G and 4G seamlessly (Linux supports both, but NetworkManager doesn't support switching gears between the differing ways both modes are accessed yet...). The devices either have their own battery or not but allow multiple (more than a MiFi type device does...) devices on the connection.
3) If you're wanting something with a few less moving parts and slightly more compact, you can always get a MiFi (which is what the Telcos are now leaning towards because it allows things like your Nook or Kindle to link up to the Internet as well as your notebook...).
I'd be ashamed of myself if I were to try to have ran this "issue" up the flagpole at BlackHat or DEFCON. Really, guys?
I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
in round numbers it's the only consumer operating system laptops use, 93% of the global market. and the other 7% *isn't* mostly linux and open source bsd....
yeah, all those 'universities' will have to pretend they aren't studying security and privacy in modern technology....
Never say never. Ah!! I did it again!
.. so the 3/4G modem software cannot connect to that Chinese IP during startup.
The three laws of thermodynamics:(1) You can't win. (2) You can't break even. (3) You can't even quit.
The 3G and 4G products here in the US are made by Samsung, Novatel, Sierra Wireless, and others. None that I could find were made by Chinese manufacturers Huawei and ZTE.
This article only applies to Russia where those things are even available. Headline should read "Russian Mobile Providers' 3G and 4G USB Modems Are Security Threat, Black Hat Presenter Says"
But with that headline, nobody would care or read the article.
You can disable the cdrom emulation using QPST pretty easily and use native Windows Tools to dial (And not have to hack about ejecting the cdrom). (ZTE / Huawei doesn't seem to matter they are all qualcomm iirc it is slightly more annoying to enter diag mode on a Huawei but like maybe 5 mins more effort in total.
ZTE and Huawei products are in fact for sale in the USA and Europe as well. I don't know about South America, but I presume you can get them there as well. Maybe the major US telco's don't bundle ZTE or Huawei products with their 3G/4G offerings, but the hardware is for sale for certain. Several EU operators (notably Vodafone) bundle these products. Assuming that because you don't see the products in the USA they are only available in Russia is kind of short sighted, the world is more than just Russia and the bundled hardware you get in the USA, you know?
I was promised a flying car. Where is my flying car?
Would this be the right place to complain about evil modeswitching USB modems?
Used to be when you got a piece of hardware, you'd get a CD with the drivers on it. Later on, somebody got the idea to include USB modem drivers right on the device itself, since it's USB anyway.
The way they implement this is to make the device into a USB Storage Device upon bootup. Then, depending on circumstances, it switches the mode to a USB modem.
This is evil because the protocol isn't totally well defined, and it usually works well only on a particular version of Windows.
Linux tries to cope, but it doesn't always work.
The article which is the subject of this thread just seems to confirm that these companies just make it up as they go along, and then pump out millions of copies of the same thing.
I'm not a lawyer, but I play one on the Internet. Blog
then one could still consider the device to be a security risk. Even Linux tends to use many vendor-supplied firmwares.
Operating the devices under Qubes OS would help greatly in reducing the risk: It can use IOMMU (if present) to operate questionable hardware and drivers within VMs and even has a GUI for managing this.
I don't really care if they spy on my modem, but I don't want their paws inside my hardware. Are there any ethernet-connected devices? I've seen some WiFi-based ones, which should be fine, but it overly complicates the matter and adds additional power requirements which wouldn't be useful.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
I've got sun hardware from the early to mid 90s and it ALL had IOMMUs in it. I'm not sure how they compare feature-wise to the modern implementations, but you could segregate each IO device into it's own address space in order to avoid one device taking out the system.
The other topics from the conference have posted their materials:
https://www.blackhat.com/eu-13/archives.html
I don't see any materials for this presentation. Does any body have the link to the actual paper/results/research?
is what i have in my pants