[LINK] USB Modems

[stephen at melbpc.org.au]

3G and 4G USB modems are a security threat, researcher says

Researchers showed how to attack 3G and 4G USB modems at Black Hat Europe

By Lucian Constantin (IDG News Service)15 March, 2013 
<http://www.arnnet.com.au/article/456492/3g_4g_usb_modems_security_threat_r
esearcher_says/>


The vast majority of 3G and 4G USB modems handed out by mobile operators to 
their customers are manufactured by a handful of companies and run insecure 
software, according to two security researchers from Russia.

Researchers Nikita Tarakanov and Oleg Kupreev analyzed the security of 
3G/4G USB modems obtained from Russian operators for the past several 
months. 

Their findings were presented Thursday at the Black Hat Europe 2013 
security conference in Amsterdam.

Most 3G/4G modems used in Russia, Europe, and probably elsewhere in the 
world, are made by Chinese hardware manufacturers Huawei and ZTE, and are 
branded with the mobile operators' logos and trademarks, Tarakanov said. 
Because of this, even if the research was done primarily on Huawei modems 
from Russian operators, the results should be relevant in other parts of 
the world as well, he said.

Tarakanov said that they weren't able to test baseband attacks against the 
Qualcomm chips found inside the modems because it's illegal in Russia to 
operate your own GSM base station if you're not an intelligence agency or a 
telecom operator. "We'll probably have to move to another country for a few 
months to do it," he said.

There's still a lot to investigate in terms of the hardware's security. For 
example, the SoC (system on a chip) used in many modems has Bluetooth 
capability that is disabled from the firmware, but it might be possible to 
enable it, the researcher said.

For now, the researchers tested the software preloaded on the modems and 
found multiple ways to attack it or to use it in attacks.

For one, it's easy to make an image of the USB modem's file system, modify 
it and write it on the modem again. There's a tool available from Huawei to 
do modem backup and restore, but there are also free tools that support 
modems from other manufacturers, Tarakanov said.

Malware running on the computer could detect the model and version of the 
active 3G modem and could write an image with malicious customizations to 
it using such tools. That modem would then compromise any computer it's 
used on.

The modem contains the installer for an application that gets installed on 
the computer, as well as the necessary drivers for different OSes. The 
application allows the user to stop, start and manage the Internet 
connection established through the modem.

The configuration files for the installed application, as well as those of 
the application installer stored on the modem, are in plain text and can be 
easily modified. One setting in the configuration files defines what DNS 
servers the modem should use for the Internet connection.

An attacker could change those entries to servers controlled by the 
attacker, Tarakanov said. This would give the attacker the ability to 
direct users to rogue websites when they're trying to visit legitimate ones 
using the modem connection.

While the application installer itself cannot be directly modified to load 
malware because it's a signed executable, there are some entries in its 
configuration file that can be used for this purpose.

For example, many configuration files had paths to antivirus installers and 
an option of whether to install those programs or not, Tarakanov said. The 
researcher said that he never found an antivirus installer shipped with the 
USB modems he tested, but the feature was there.

An attacker could create a custom image with a modified configuration file 
that enables this feature and installs a malicious file stored on the modem 
instead of an antivirus program. If the image is written on a USB modem, 
every time the user would install the modem application, the malware would 
also be installed, Tarakanov said.

The researchers also found a possible mass attack vector. Once installed on 
a computer, the modem application -- at least the one from Huawei -- checks 
periodically for updates from a single server, Tarakanov said. Software 
branded for a specific operator searchers for updates in a server directory 
specific to that operator.

An attacker who manages to compromise this update server, can launch mass 
attacks against users from many operators, Tarakanov said. Huawei 3G modems 
from several different Russian operators used the same server, but there 
might be other update servers for other countries, he said.

Tarakanov said that he didn't look for vulnerabilities in the actual modem 
drivers installed in the OS, but he expects them to have vulnerabilities. 
The vast majority of third-party drivers in general have vulnerabilities, 
he said.

Tarakanov specializes in exploit writing and finding vulnerabilities in the 
Windows kernel mode drivers. However, Oleg Kupreev was the leader for this 
particular research project concerning 3G/4G modems.

Research in this area is just at the beginning and there's more to 
investigate, Tarakanov said. Someone has to do it because many new laptops 
come with 3G/4G modems directly built in and people should know if they're 
a security threat.
--

Cheers,
Stephen

Message sent using MelbPC WebMail Server